Current IP Check

24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 53:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T498,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 6b8bec10fc45… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6b8bec10fc45…. Malware family: Trojan.Generic. Threat score 100/100. 11/27 AV engines flagged this file. 16 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d"],"about":{"@type":"SoftwareApplication","name":"TQH0009000AQ.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":11,"total":27},"behavioralIndicators":{"malicious":16,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T402,Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp, 00000000-00003192.00000000.78290.6EC31000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp")26:T4f8,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp")27:T1b4c,Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to "RC2CryptoServiceProvider" (Indicator: "RC2"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to "RC2CryptoServiceProvider" (Indicator: "RC2CryptoServiceProvider"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to "SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to "DESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp, 00000000-00003192.00000000.78290.04900000.00000004.mdmp, 00000000-00003192.00000000.78290.05900000.00000004.mdmp, 00000000-00003192.00000000.78290.07160000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp, 00000000-00003192.00000000.78290.04900000.00000004.mdmp, 00000000-00003192.00000000.78290.05900000.00000004.mdmp, 00000000-00003192.00000000.78290.07160000.00000004.mdmp") Found reference to "RC2CryptoServiceProvider" (Indicator: "RC2"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to "RC2CryptoServiceProvider" (Indicator: "RC2CryptoServiceProvider"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp, 00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found reference to "SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp, 00000000-00003192.00000000.78290.05900000.00000004.mdmp, 00000000-00003192.00000000.78290.07160000.00000004.mdmp") Found reference to "DESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to "Switch.System.Security.Cryptography.AesCryptoServiceProvider.DontCorrectlyResetDecryptor" (Indicator: "Aes"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found reference to "Switch.System.Security.Cryptography.AesCryptoServiceProvider.DontCorrectlyResetDecryptor" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found reference to "HMAC" (Indicator: "HMAC"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found reference to "HMACSHA1" (Indicator: "HMAC"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp")28:T442,Found PE header "MZ" - Source: "00000000-00003192.00000000.78290.00330000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003192.00000000.78290.05900000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003192.00000000.78290.07160000.00000004.mdmp") Found PE header "MZ" - Source: "00000000-00003192.00000000.78290.6EB90000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00003192.00000000.78290.6EC30000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004960.00000000.79000.00D30000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004960.00000001.80921.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004960.00000001.80921.00D30000.00000002.mdmp") Found PE header "MZ" - Source: "00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found PE header "MZ" - Source: "00000000-00004960.00000002.82840.00D30000.00000002.mdmp")29:T9c0,Found reference to API "Crypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "BCryptDecrypt"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API "Crypt.BCryptDecrypt() (get size) failed with status code: {0}" (Indicator: "CryptDecrypt"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API "Crypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "BCryptDecrypt"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API "Crypt.BCryptDecrypt(): authentication tag mismatch" (Indicator: "CryptDecrypt"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API "Crypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "BCryptDecrypt"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API "Crypt.BCryptDecrypt() failed with status code:{0}" (Indicator: "CryptDecrypt"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp")2a:T436,Found reference to API "description="Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt"" (Indicator: "CryptProtectData"; Source: "00000000-00003192.00000000.78290.029C0000.00000004.mdmp") Found reference to API "Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt" (Indicator: "CryptProtectData"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found reference to API "Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt" (Indicator: "CryptProtectData"; Source: "00000000-00004960.00000000.79000.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp") Found reference to API "description="Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt"" (Indicator: "CryptProtectData"; Source: "00000000-00004960.00000000.79000.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp")2b:T40e,Found string "http://www.w3.org/2001/04/xmlenc# EncryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found string "System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" (Indicator: "encryptedkey"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found string "http://www.w3.org/2001/04/xmlenc# EncryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00004960.00000000.79000.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp") Found string "System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" (Indicator: "encryptedkey"; Source: "00000000-00004960.00000000.79000.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp")2c:T1434,".exe" called "RtlGetVersion" (UID: 00000000-00003192) ".exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003192) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003192) ".exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000000010000000011b9ee01482a7204482a7204020000007ac5db71280000009fa3c36e502a7204702d7204a301fd764c000171feffffff0000720460027204d074c36e00000005000000002800000002000000600272042800000028000000280000002800000031ef96710000000018d47300506a007774114206feffffffa0d37300b716fd761c00000028000000a80272048cd373000407c26e0000720470e5a4022800000000000000000000000500000003000000000072041c000000000000008c027204c0d37300ee13fd761c000000ee13fd7600000000000000001c000000ffffffffe0d373005072d57300007204000000001c0000000407c26e (UID: 00000000-00003192) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000fc762871f3062871f3060000000078347204588bf206a06af3061d000000688bf20646000f0050f5fc76e85ff206e85ff2060000000056df0f08e06d7204085ff20602000000f06d72040d000f0050f5fc769834f3069834f306000000002871f306908af2060832f30613000000a08af2060400130000088904640000009ed80f08e85ff206e85ff20600000000feffffff8470d57338d473006570d57300007204000000008470d573aad80f089834f3069834f30600000000e32ebe6ee85ff206b5ceba6eef8dfc4700d47300176fbb6e94d4730070c8d673b27ea77bfeffffff8470d5730a8ebd6e9834f306f08dbd6e60d47300a7ceba6e01000000 (UID: 00000000-00003192) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000fc76306ff306306ff3060000000000000000588bf206a06af3061400000050f5fc767066f2067066f206000000008470d573e06d7204085ff20615000000f06d72040d000b00a80b89046400000050f5fc769834f3069834f30600000000306ff306908af2060832f30613000000a08af2060400130000088904640000007066f2067066f20600000000feffffff8470d57334d473006570d57300007204000000008470d573a6d80f089834f3069834f30600000000e32ebe6e7066f206b5ceba6ed38dfc47fcd37300176fbb6e94d4730070c8d673b27ea77bfeffffff8470d5730a8ebd6e9834f306f08dbd6e5cd47300a7ceba6e01000000504bbb6e (UID: 00000000-00003192) ".exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e8d073008cd07300226ed57300007204000000002d6ed5731edc0f082d000000ecb79e7510d173000000760240c4a30288cfa202170000008000000050d0730000007602d4d0730070c8d6736a7da77bfeffffff2d000000d0ccad7527000000a4d07300856ad7731c23dc73e4d07300f85fd77308000000bb69d673b269d67376dc0f082d000000ecb79e7527000000d0ccad75b8d073002d000000d0ccad7527000000e8d07300856ad7731c23dc7330d173007e8aac75ee8cac75738aac7531c0e35c2d000000ecb79e7527000000d0ccad752cae7204c0ad720431c0e35cf8d07300fc52ea75e4d17300e084ac7539e07829feffffff738aac75 (UID: 00000000-00003192) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004960) ".exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000002a6e187d2a6e00000000d0a97c74000075749011767458cf2e0338dc290330623403b8e71301feffffff60ea1301506a0077fa928cf7feffffff78e81301eaa9fc7658cf2e030000000030623403a11400000a000b00b2972a6e5c762a6e68762a6e30623403203f340314000000000000000000000058cf2e03a0e81301cc2d017730623403000000003c62340300000000f800236e00000000cc0d24385ce8ff766840fe76ac05000030623403000000007740fe76000000000100000084cf2e03180000000000000010e91301400800000000000000000000306234030000236efeffffff7ccf2e03ac05000000000000000000002345fe7600e91301 (UID: 00000000-00004960)2d:T805,".exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTRATIONENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "REGISTERADAPTERNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "DHCPDOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E712CB97-6066-4A95-9107-EF68F40F8718}"; Key: "SEARCHLIST"; Value: "")2e:T583,".exe" queries volume information of "C:\6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.exe" at 00000000-00003192-00000C15-83928570 ".exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll" at 00000000-00003192-00000C15-84244414 ".exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00003192-00000C15-84474067 ".exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll" at 00000000-00003192-00000C15-84524386 ".exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll" at 00000000-00004960-00000C15-100827968 ".exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll" at 00000000-00004960-00000C15-100929454 ".exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll" at 00000000-00004960-00000C15-1013073002f:T1a80,".exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MPCLIENT.DLL (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\X86\MsMpLics.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00003192) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004960) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004960) ".exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004960) ".exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004960) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00004960) ".exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00004960) ".exe" called "LoadLibrary" with a parameter oleaut32 (UID: 00000000-00004960) ".exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00004960) ".exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004960) ".exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004960) ".exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004960) ".exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004960)30:T7e91,".exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CryptAcquireContext (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CryptContextAddRef (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter WldpIsDynamicCodePolicyEnabled (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CryptGetProvParam (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CryptDuplicateKey (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CryptSetKeyParam (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CryptDecrypt (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter ZwUnmapViewOfSection (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter AddRefActCtx (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter ReleaseActCtx (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00003192) ".exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrl (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter WinHttpGetProxyForUrlW (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter ResetEvent (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter GetNetworkParams (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter WSAConnect (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter send (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter CoRegisterMessageFilter (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter PeekMessage (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter WaitMessage (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter shutdown (UID: 00000000-00004960) ".exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004960)31:T77f,Found reference to native API (Indicator: "NtClose"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to native API (Indicator: "NtQueryInformationToken"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to native API (Indicator: "NtOpenProcessToken"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to native API (Indicator: "NtClose"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to native API (Indicator: "NtQueryInformationToken"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to native API (Indicator: "NtOpenProcessToken"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to native API (Indicator: "RtlGetVersion"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to native API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to native API (Indicator: "NtClose"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to native API (Indicator: "NtQueryInformationToken"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to native API (Indicator: "NtOpenProcessToken"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp")32:T32be,"CREATE TABLE meta(key LONGVARCHAR NOT NULL UNIQUE PRIMARY KEY, value LONGVARCHAR)" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, Indicator: "create table meta(key longvarchar not null unique primary key, value longvarchar)"), "CREATE TABLE logins (origin_url VARCHAR NOT NULL, action_url VARCHAR, username_element VARCHAR, username_value VARCHAR, password_element VARCHAR, password_value BLOB, submit_element VARCHAR, signon_realm VARCHAR NOT NULL, date_created INTEGER NOT NULL, blacklisted_by_user INTEGER NOT NULL, scheme INTEGER NOT NULL, password_type INTEGER, times_used INTEGER, form_data BLOB, display_name VARCHAR, icon_url VARCHAR, federation_url VARCHAR, skip_zero_click INTEGER, generation_upload_status INTEGER, possible_username_pairs BLOB, id INTEGER PRIMARY KEY AUTOINCREMENT, date_last_used INTEGER NOT NULL DEFAULT 0, moving_blocked_for BLOB, date_password_modified INTEGER NOT NULL DEFAULT 0, UNIQUE (origin_url, username_element, username_value, password_element, signon_realm))" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, Indicator: "create table logins (origin_url varchar not null, action_url varchar, username_element varchar, username_value varchar, password_element varchar, password_value blob, submit_element varchar, signon_realm varchar not null, date_created integer not null, blacklisted_by_user integer not null, scheme integer not null, password_type integer, times_used integer, form_data blob, display_name varchar, icon_url varchar, federation_url varchar, skip_zero_click integer, generation_upload_status integer, possible_username_pairs blob, id integer primary key autoincrement, date_last_used integer not null default 0, moving_blocked_for blob, date_password_modified integer not null default 0, unique (origin_url, username_element, username_value, password_element, signon_realm))"), "CREATE TABLE sqlite_sequence(name,seq)" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.06070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.06070000.00000004.mdmp, Indicator: "create table sqlite_sequence(name,seq)"), "CREATE TABLE sync_entities_metadata (storage_key INTEGER PRIMARY KEY AUTOINCREMENT, metadata VARCHAR NOT NULL)" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, Indicator: "create table sync_entities_metadata (storage_key integer primary key autoincrement, metadata varchar not null)"), "CREATE TABLE sync_model_metadata (id INTEGER PRIMARY KEY AUTOINCREMENT, model_metadata VARCHAR NOT NULL)" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, Indicator: "create table sync_model_metadata (id integer primary key autoincrement, model_metadata varchar not null)"), "CREATE TABLE insecure_credentials (parent_id INTEGER REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, insecurity_type INTEGER NOT NULL, create_time INTEGER NOT NULL, is_muted INTEGER NOT NULL DEFAULT 0, UNIQUE (parent_id, insecurity_type))" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.06070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.06070000.00000004.mdmp, Indicator: "create table insecure_credentials (parent_id integer references logins on update cascade on delete cascade deferrable initially deferred, insecurity_type integer not null, create_time integer not null, is_muted integer not null default 0, unique (parent_id, insecurity_type))"), "CREATE TABLE breached (url VARCHAR NOT null, username VARCHAR NOT null, status INTEGER NOT null, alert_state INTEGER NOT null, last_checked_time INTEGER NOT null, sanitized_username VARCHAR, alert_seen INTEGER, last_seen_time INTEGER, UNIQUE (url, username))" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, Indicator: "create table breached (url varchar not null, username varchar not null, status integer not null, alert_state integer not null, last_checked_time integer not null, sanitized_username varchar, alert_seen integer, last_seen_time integer, unique (url, username))"), "CREATE TABLE logins_edge_extended (id INTEGER PRIMARY KEY AUTOINCREMENT, source VARCHAR NOT null DEFAULT 0, strength_alert_status INTEGER NOT null DEFAULT 0, password_nickname VARCHAR NOT null DEFAULT '' )" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, Indicator: "create table logins_edge_extended (id integer primary key autoincrement, source varchar not null default 0, strength_alert_status integer not null default 0, password_nickname varchar not null default '' )"), "CREATE TABLE stats (origin_domain VARCHAR NOT NULL, username_value VARCHAR, dismissal_count INTEGER, update_time INTEGER NOT NULL, UNIQUE(origin_domain, username_value))" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, Indicator: "create table stats (origin_domain varchar not null, username_value varchar, dismissal_count integer, update_time integer not null, unique(origin_domain, username_value))"), "CREATE TABLE field_info (form_signature INTEGER NOT NULL, field_signature INTEGER NOT NULL, field_type INTEGER NOT NULL, create_time INTEGER NOT NULL, UNIQUE (form_signature, field_signature))" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, Indicator: "create table field_info (form_signature integer not null, field_signature integer not null, field_type integer not null, create_time integer not null, unique (form_signature, field_signature))"), "CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key))" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, Indicator: "create table password_notes (id integer primary key autoincrement, parent_id integer not null references logins on update cascade on delete cascade deferrable initially deferred, key varchar not null, value blob, date_created integer not null, confidential integer, unique (parent_id, key))"), "CREATE TABLE sync_entities_metadata (storage_key INTEGER PRIMARY KEY AUTOINCREMENT, metadata VARCHAR NOT NULL)R" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.06070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.06070000.00000004.mdmp, Indicator: "create table sync_entities_metadata (storage_key integer primary key autoincrement, metadata varchar not null)r"), "CREATE TABLE logins (origin_url VARCHAR NOT NULL, action_url VARCHAR, username_element VARCHAR, username_value VARCHAR, password_element VARCHAR, password_value BLOB, submit_element VARCHAR, signon_realm VARCHAR NOT NULL, date_created INTEGER NOT NULL, blacklisted_by_user INTEGER NOT NULL, scheme INTEGER NOT NULL, password_type INTEGER, times_used INTEGER, form_data BLOB, display_name VARCHAR, icon_url VARCHAR, federation_url VARCHAR, skip_zero_click INTEGER, generation_upload_status INTEGER, possible_username_pairs BLOB, id INTEGER PRIMARY KEY AUTOINCREMENT, date_last_used INTEGER NOT NULL DEFAULT 0, moving_blocked_for BLOB, date_password_modified INTEGER NOT NULL DEFAULT 0, UNIQUE (origin_url, username_element, username_value, password_element, signon_realm))+" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.06070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.06070000.00000004.mdmp, Indicator: "create table logins (origin_url varchar not null, action_url varchar, username_element varchar, username_value varchar, password_element varchar, password_value blob, submit_element varchar, signon_realm varchar not null, date_created integer not null, blacklisted_by_user integer not null, scheme integer not null, password_type integer, times_used integer, form_data blob, display_name varchar, icon_url varchar, federation_url varchar, skip_zero_click integer, generation_upload_status integer, possible_username_pairs blob, id integer primary key autoincrement, date_last_used integer not null default 0, moving_blocked_for blob, date_password_modified integer not null default 0, unique (origin_url, username_element, username_value, password_element, signon_realm))+"), "CREATE TABLE meta(key LONGVARCHAR NOT NULL UNIQUE PRIMARY KEY, value LONGVARCHAR)'" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.06070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.06070000.00000004.mdmp, Indicator: "create table meta(key longvarchar not null unique primary key, value longvarchar)'"), "CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key))N" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.06070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.06070000.00000004.mdmp, Indicator: "create table password_notes (id integer primary key autoincrement, parent_id integer not null references logins on update cascade on delete cascade deferrable initially deferred, key varchar not null, value blob, date_created integer not null, confidential integer, unique (parent_id, key))n"), "CREATE TABLE stats (origin_domain VARCHAR NOT NULL, username_value VARCHAR, dismissal_count INTEGER, update_time INTEGER NOT NULL, UNIQUE(origin_domain, username_value)))" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.06070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.06070000.00000004.mdmp, Indicator: "create table stats (origin_domain varchar not null, username_value varchar, dismissal_count integer, update_time integer not null, unique(origin_domain, username_value)))"), "CREATE TABLE logins_edge_extended (id INTEGER PRIMARY KEY AUTOINCREMENT, source VARCHAR NOT null DEFAULT 0, strength_alert_status INTEGER NOT null DEFAULT 0, password_nickname VARCHAR NOT null DEFAULT '' )f" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.06070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.06070000.00000004.mdmp, Indicator: "create table logins_edge_extended (id integer primary key autoincrement, source varchar not null default 0, strength_alert_status integer not null default 0, password_nickname varchar not null default '' )f"), "CREATE TABLE breached (url VARCHAR NOT null, username VARCHAR NOT null, status INTEGER NOT null, alert_state INTEGER NOT null, last_checked_time INTEGER NOT null, sanitized_username VARCHAR, alert_seen INTEGER, last_seen_time INTEGER, UNIQUE (url, username))/" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.06070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.06070000.00000004.mdmp, Indicator: "create table breached (url varchar not null, username varchar not null, status integer not null, alert_state integer not null, last_checked_time integer not null, sanitized_username varchar, alert_seen integer, last_seen_time integer, unique (url, username))/"), "CREATE TABLE field_info (form_signature INTEGER NOT NULL, field_signature INTEGER NOT NULL, field_type INTEGER NOT NULL, create_time INTEGER NOT NULL, UNIQUE (form_signature, field_signature))3" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.06070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.06070000.00000004.mdmp, Indicator: "create table field_info (form_signature integer not null, field_signature integer not null, field_type integer not null, create_time integer not null, unique (form_signature, field_signature))3")33:Td062,Found reference to API (Indicator: "ReleaseDC"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API (Indicator: "GetDC"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API (Indicator: "GetWindowDC"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API (Indicator: "GetClassName"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API (Indicator: "NtClose"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API (Indicator: "GetWindowLong"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API (Indicator: "SetWindowLong"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API (Indicator: "NtQueryInformationToken"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API (Indicator: "NtOpenProcessToken"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API (Indicator: "SetWindowPos"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API (Indicator: "SetFocus"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API (Indicator: "GetObject"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API (Indicator: "GetCurrentObject"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API (Indicator: "BitBlt"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API (Indicator: "GetParent"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API (Indicator: "SetForegroundWindow"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API (Indicator: "ShowWindow"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API (Indicator: "MessageBox"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API (Indicator: "RegisterHotKey"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API (Indicator: "UnregisterHotKey"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API (Indicator: "GetCurrentDirectory"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API (Indicator: "GetClassName"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLong"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLong"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API (Indicator: "NtQueryInformationToken"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API (Indicator: "NtOpenProcessToken"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp, 00000000-00003192.00000000.78290.05900000.00000004.mdmp, 00000000-00003192.00000000.78290.07160000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentObject"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API (Indicator: "RegisterHotKey"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API (Indicator: "UnregisterHotKey"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectory"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp, 00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003192.00000000.78290.05900000.00000004.mdmp, 00000000-00003192.00000000.78290.07160000.00000004.mdmp, 00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00003192.00000000.78290.05900000.00000004.mdmp, 00000000-00003192.00000000.78290.07160000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp, 00000000-00003192.00000000.78290.6EC31000.00000020.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp, 00000000-00003192.00000000.78290.6EC31000.00000020.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp, 00000000-00003192.00000000.78290.6EC31000.00000020.mdmp") Found reference to API (Indicator: "EventWrite"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp") Found reference to API (Indicator: "EventRegister"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp, 00000000-00003192.00000000.78290.6EC31000.00000020.mdmp") Found reference to API (Indicator: "EventUnregister"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp, 00000000-00003192.00000000.78290.6EC31000.00000020.mdmp") Found reference to API (Indicator: "InstallELAMCertificateInfo"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp, 00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "BCryptCreateHash"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp, 00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "BCryptDestroyHash"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp, 00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "BCryptHashData"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp, 00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "BCryptFinishHash"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp, 00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp, 00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp, 00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp, 00000000-00003192.00000000.78290.6EC31000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp, 00000000-00003192.00000000.78290.6EC31000.00000020.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp, 00000000-00003192.00000000.78290.6EC31000.00000020.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp, 00000000-00003192.00000000.78290.6EC31000.00000020.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp, 00000000-00003192.00000000.78290.6EC31000.00000020.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminCalcHashFromFileHandle"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminAcquireContext"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminEnumCatalogFromHash"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp") Found reference to API (Indicator: "CryptCATAdminReleaseContext"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp") Found reference to API (Indicator: "RpcBindingFromStringBindingW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetAuthInfoExW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingSetOption"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "RpcBindingFree"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "RpcSmDestroyClientContext"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "RpcStringFreeW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "RpcStringBindingComposeW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "UnregisterWaitEx"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "RegisterWaitForSingleObject"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "DeleteTimerQueueTimer"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "CompareFileTime"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "GetLocalTime"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "OpenServiceW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceStatus"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "QueryServiceConfigW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "GetLengthSid"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "CopySid"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "ReportEventW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "RegisterEventSourceW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "DeregisterEventSource"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "OpenThreadToken"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "ChangeServiceConfigW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "InitializeAcl"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "StartServiceW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "IIDFromString"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "NdrClientCall2"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "UuidToStringW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "UuidFromStringW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "OpenFileMappingW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "VirtualLock"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatus"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "DuplicateToken"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "RegNotifyChangeKeyValue"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "CoGetObject"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "CancelSynchronousIo"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpool"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "StartThreadpoolIo"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpool"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolIo"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolIoCallbacks"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "CancelThreadpoolIo"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWorkCallbacks"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMinimum"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolWaitCallbacks"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolThreadMaximum"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolIo"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00003192.00000000.78290.6EC31000.00000020.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "StringFromGUID2"; Source: "00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00003192.00000000.78290.7F170000.00000002.mdmp") Found reference to API (Indicator: "Local State"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "SetWindowsHookExA"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "CryptUnprotectData"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "GetEnvironmentVariable"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "GetKeyboardState"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "CompareString"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to API (Indicator: "BCryptDecrypt"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "BCryptEncrypt"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "GetKeyboardLayout"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "GetWindowText"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "ToUnicodeEx"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "MapVirtualKey"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "BCryptImportKey"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "BCryptDestroyKey"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "LoadLibrary"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateDirectory"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "BCryptSetProperty"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to API (Indicator: "GetClassName"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLong"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLong"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to API (Indicator: "NtQueryInformationToken"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to API (Indicator: "NtOpenProcessToken"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to API (Indicator: "GetObject"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentObject"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to API (Indicator: "MessageBox"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to API (Indicator: "RegisterHotKey"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to API (Indicator: "UnregisterHotKey"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectory"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00004960.00000000.79000.7F660000.00000002.mdmp, 00000000-00004960.00000001.80921.7F660000.00000002.mdmp, 00000000-00004960.00000002.82840.7F660000.00000002.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp")34:T437,Found reference to API "RegisterHotKeys" (Indicator: "RegisterHotKey"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API "RegisterHotKeys" (Indicator: "RegisterHotKey"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API "RegisterHotKeys" (Indicator: "RegisterHotKey"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp")35:T4c6e,"E\SOFTWARE\Micro" in Source: 00000000-00003192.00000000.78290.00638000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\Windows NT\CurrentVersion\ProfileList" in Source: 00000000-00003192.00000000.78290.027E0000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00003192.00000000.78290.029C0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00003192.00000000.78290.029C0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00003192.00000000.78290.029C0000.00000004.mdmp "E\SOFTWARE\Microsoft\Windows NT\" in Source: 00000000-00003192.00000000.78290.046E8000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00003192.00000000.78290.04900000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00003192.00000000.78290.04900000.00000004.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00003192.00000000.78290.6EB91000.00000020.mdmp "Software\Microsoft\RemovalTools\MRT" in Source: 00000000-00003192.00000000.78290.6EB91000.00000020.mdmp "HKLM\" in Source: 00000000-00003192.00000000.78290.6EB91000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00003192.00000000.78290.6EB91000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003192.00000000.78290.6EB91000.00000020.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00003192.00000000.78290.7F170000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00003192.00000000.78290.7F170000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00003192.00000000.78290.7F170000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00003192.00000000.78290.7F170000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00003192.00000000.78290.7F170000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00003192.00000000.78290.7F170000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00003192.00000000.78290.7F170000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00003192.00000000.78290.7F170000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00003192.00000000.78290.7F170000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00003192.00000000.78290.7F170000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00003192.00000000.78290.7F170000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00003192.00000000.78290.7F170000.00000002.mdmp "BraveSoftware\Brave-Browser\User Data\Default\Login Data" in Source: 00000000-00004960.00000000.79000.00400000.00000040.mdmp 00000000-00004960.00000001.80921.00400000.00000040.mdmp 00000000-00004960.00000002.82840.00400000.00000040.mdmp "AVAST Software\Browser\User Data\Default\Login Data" in Source: 00000000-00004960.00000000.79000.00400000.00000040.mdmp 00000000-00004960.00000001.80921.00400000.00000040.mdmp 00000000-00004960.00000002.82840.00400000.00000040.mdmp "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002" in Source: 00000000-00004960.00000000.79000.01038000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004960.00000000.79000.03180000.00000004.mdmp "1uHKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFrameworkonfig^" in Source: 00000000-00004960.00000000.79000.03290000.00000004.mdmp 00000000-00004960.00000001.80921.03290000.00000004.mdmp 00000000-00004960.00000002.82840.03290000.00000004.mdmp "1uAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00004960.00000000.79000.03290000.00000004.mdmp 00000000-00004960.00000001.80921.03290000.00000004.mdmp 00000000-00004960.00000002.82840.03290000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00004960.00000000.79000.03290000.00000004.mdmp 00000000-00004960.00000001.80921.03290000.00000004.mdmp 00000000-00004960.00000002.82840.03290000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "SOFTWARE\Microsoft\Wind" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zones\Pacific Standard Time\Dynamic DST" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "SOFTWARE\Policies\Microsoft\Windows\CurrentVersion\Internet Settings" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "SOFTWARE\Classes\Foxmail.url.mailto\Shell\open\command" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "E\SOFTWARE\Microsoft\Windows NT\" in Source: 00000000-00004960.00000000.79000.070A8000.00000004.mdmp 00000000-00004960.00000001.80921.070A8000.00000004.mdmp 00000000-00004960.00000002.82840.070A8000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004960.00000000.79000.07830000.00000004.mdmp 00000000-00004960.00000001.80921.07830000.00000004.mdmp 00000000-00004960.00000002.82840.07830000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00004960.00000000.79000.07830000.00000004.mdmp 00000000-00004960.00000001.80921.07830000.00000004.mdmp 00000000-00004960.00000002.82840.07830000.00000004.mdmp "\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00004960.00000000.79000.7F660000.00000002.mdmp 00000000-00004960.00000001.80921.7F660000.00000002.mdmp 00000000-00004960.00000002.82840.7F660000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00004960.00000000.79000.7F660000.00000002.mdmp 00000000-00004960.00000001.80921.7F660000.00000002.mdmp 00000000-00004960.00000002.82840.7F660000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00004960.00000000.79000.7F660000.00000002.mdmp 00000000-00004960.00000001.80921.7F660000.00000002.mdmp 00000000-00004960.00000002.82840.7F660000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00004960.00000000.79000.7F660000.00000002.mdmp 00000000-00004960.00000001.80921.7F660000.00000002.mdmp 00000000-00004960.00000002.82840.7F660000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00004960.00000000.79000.7F660000.00000002.mdmp 00000000-00004960.00000001.80921.7F660000.00000002.mdmp 00000000-00004960.00000002.82840.7F660000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00004960.00000000.79000.7F660000.00000002.mdmp 00000000-00004960.00000001.80921.7F660000.00000002.mdmp 00000000-00004960.00000002.82840.7F660000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00004960.00000000.79000.7F660000.00000002.mdmp 00000000-00004960.00000001.80921.7F660000.00000002.mdmp 00000000-00004960.00000002.82840.7F660000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00004960.00000000.79000.7F660000.00000002.mdmp 00000000-00004960.00000001.80921.7F660000.00000002.mdmp 00000000-00004960.00000002.82840.7F660000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00004960.00000000.79000.7F660000.00000002.mdmp 00000000-00004960.00000001.80921.7F660000.00000002.mdmp 00000000-00004960.00000002.82840.7F660000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00004960.00000000.79000.7F660000.00000002.mdmp 00000000-00004960.00000001.80921.7F660000.00000002.mdmp 00000000-00004960.00000002.82840.7F660000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00004960.00000000.79000.7F660000.00000002.mdmp 00000000-00004960.00000001.80921.7F660000.00000002.mdmp 00000000-00004960.00000002.82840.7F660000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00004960.00000000.79000.7F660000.00000002.mdmp 00000000-00004960.00000001.80921.7F660000.00000002.mdmp 00000000-00004960.00000002.82840.7F660000.00000002.mdmp "\REGISTRY\MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00004960.00000001.80921.03180000.00000004.mdmp 00000000-00004960.00000002.82840.03180000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography\Defaults\Provider Types\Type 001" in Source: 00000000-00004960.00000001.80921.03290000.00000004.mdmp 00000000-00004960.00000002.82840.03290000.00000004.mdmp "\BraveSoftware\Brave-Browser\User Data\Default\Login Data" in Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\BraveSoftware\Brave-Browser\User Data\Default\Login Data" in Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "\Opera Software\Opera Stable\Login Data" in Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Login Data" in Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "\AVAST Software\Browser\User Data\Default\Login Data" in Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\AVAST Software\Browser\User Data\Default\Login Data" in Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "Software\Microsoft\.NETFramework" in Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\.NETFramework" in Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp36:T41e,".exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] ".exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135]37:T86b,Observed unmanaged function "UiaRegisterProviderCallback" in "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin" Observed unmanaged function "BitBlt" in "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin" Observed unmanaged function "SetProcessDPIAware" in "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin" Observed unmanaged function "SetWindowPos" in "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin" Observed unmanaged function "ShowWindow" in "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin" Observed unmanaged function "GetClassName" in "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin" Observed unmanaged function "GetCurrentObject" in "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin" Observed unmanaged function "GetDC" in "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin" Observed unmanaged function "GetWindowDC" in "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin" Observed unmanaged function "GetWindowLong" in "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin" Observed unmanaged function "NtClose" in "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin" Observed unmanaged function "NtOpenProcessToken" in "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin" Observed unmanaged function "NtQueryInformationToken" in "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin" Observed unmanaged function "RegisterHotKey" in "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin" Observed unmanaged function "ReleaseDC" in "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin" Observed unmanaged function "SetForegroundWindow" in "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin" Observed unmanaged function "SetWindowLong" in "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin" Observed unmanaged function "UnregisterHotKey" in "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin"38:T15c2,".exe" loaded module "KERNEL32" at base 73a90000 ".exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 73e00000 ".exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 73e00000 ".exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 73e00000 ".exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 73dd0000 ".exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 73e00000 ".exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 73e00000 ".exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 73e00000 ".exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 71d60000 ".exe" loaded module "ADVAPI32.DLL" at base 76f10000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 71ca0000 ".exe" loaded module "SHLWAPI.DLL" at base 750a0000 ".exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 739e0000 ".exe" loaded module "VERSION.DLL" at base 73400000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 714f0000 ".exe" loaded module "USER32.DLL" at base 74750000 ".exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 73e00000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 ".exe" loaded module "MSCOREE.DLL" at base 71e00000 ".exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 75110000 ".exe" loaded module "PSAPI.DLL" at base 739d0000 ".exe" loaded module "KERNEL32.DLL" at base 73a90000 ".exe" loaded module "RPCRT4.DLL" at base 74170000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 70010000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 ".exe" loaded module "OLE32.DLL" at base 74480000 ".exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73220000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 0 ".exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 75110000 ".exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73e00000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6ff80000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\VERSION.DLL" at base 0 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 6f520000 ".exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 6ed00000 ".exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 6ecb0000 ".exe" loaded module "ADVAPI32" at base 76f10000 ".exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74080000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 ".exe" loaded module "BCRYPT.DLL" at base 71f80000 ".exe" loaded module "WLDP.DLL" at base 6ec90000 ".exe" loaded module "AMSI.DLL" at base 6ec80000 ".exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 73400000 ".exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPOAV.DLL" at base 6ec30000 ".exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\X86\MPCLIENT.DLL" at base 6eb90000 ".exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 73a90000 ".exe" loaded module "USERENV.DLL" at base 6ec50000 ".exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 76f10000 ".exe" loaded module "SHELL32.DLL" at base 759c0000 ".exe" loaded module "NTDLL" at base 76f90000 ".exe" loaded module "NTDLL.DLL" at base 76f90000 ".exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6e2c0000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 ".exe" loaded module "IPHLPAPI.DLL" at base 738d0000 ".exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 730d0000 ".exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 730b0000 ".exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 71e60000 ".exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 6e4b0000 ".exe" loaded module "OLEAUT32" at base 739f0000 ".exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 ".exe" loaded module "OLEAUT32.DLL" at base 739f0000 ".exe" loaded module "IMM32.DLL" at base 73dd0000 ".exe" loaded module "COMCTL32.DLL" at base 6e230000 ".exe" loaded module "GDI32.DLL" at base 7536000039:T32be,"CREATE TABLE meta(key LONGVARCHAR NOT NULL UNIQUE PRIMARY KEY, value LONGVARCHAR)" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, Indicator: "create table meta(key longvarchar not null unique primary key, value longvarchar)"), "CREATE TABLE logins (origin_url VARCHAR NOT NULL, action_url VARCHAR, username_element VARCHAR, username_value VARCHAR, password_element VARCHAR, password_value BLOB, submit_element VARCHAR, signon_realm VARCHAR NOT NULL, date_created INTEGER NOT NULL, blacklisted_by_user INTEGER NOT NULL, scheme INTEGER NOT NULL, password_type INTEGER, times_used INTEGER, form_data BLOB, display_name VARCHAR, icon_url VARCHAR, federation_url VARCHAR, skip_zero_click INTEGER, generation_upload_status INTEGER, possible_username_pairs BLOB, id INTEGER PRIMARY KEY AUTOINCREMENT, date_last_used INTEGER NOT NULL DEFAULT 0, moving_blocked_for BLOB, date_password_modified INTEGER NOT NULL DEFAULT 0, UNIQUE (origin_url, username_element, username_value, password_element, signon_realm))" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, Indicator: "create table logins (origin_url varchar not null, action_url varchar, username_element varchar, username_value varchar, password_element varchar, password_value blob, submit_element varchar, signon_realm varchar not null, date_created integer not null, blacklisted_by_user integer not null, scheme integer not null, password_type integer, times_used integer, form_data blob, display_name varchar, icon_url varchar, federation_url varchar, skip_zero_click integer, generation_upload_status integer, possible_username_pairs blob, id integer primary key autoincrement, date_last_used integer not null default 0, moving_blocked_for blob, date_password_modified integer not null default 0, unique (origin_url, username_element, username_value, password_element, signon_realm))"), "CREATE TABLE sqlite_sequence(name,seq)" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.06070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.06070000.00000004.mdmp, Indicator: "create table sqlite_sequence(name,seq)"), "CREATE TABLE sync_entities_metadata (storage_key INTEGER PRIMARY KEY AUTOINCREMENT, metadata VARCHAR NOT NULL)" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, Indicator: "create table sync_entities_metadata (storage_key integer primary key autoincrement, metadata varchar not null)"), "CREATE TABLE sync_model_metadata (id INTEGER PRIMARY KEY AUTOINCREMENT, model_metadata VARCHAR NOT NULL)" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, Indicator: "create table sync_model_metadata (id integer primary key autoincrement, model_metadata varchar not null)"), "CREATE TABLE insecure_credentials (parent_id INTEGER REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, insecurity_type INTEGER NOT NULL, create_time INTEGER NOT NULL, is_muted INTEGER NOT NULL DEFAULT 0, UNIQUE (parent_id, insecurity_type))" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.06070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.06070000.00000004.mdmp, Indicator: "create table insecure_credentials (parent_id integer references logins on update cascade on delete cascade deferrable initially deferred, insecurity_type integer not null, create_time integer not null, is_muted integer not null default 0, unique (parent_id, insecurity_type))"), "CREATE TABLE breached (url VARCHAR NOT null, username VARCHAR NOT null, status INTEGER NOT null, alert_state INTEGER NOT null, last_checked_time INTEGER NOT null, sanitized_username VARCHAR, alert_seen INTEGER, last_seen_time INTEGER, UNIQUE (url, username))" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, Indicator: "create table breached (url varchar not null, username varchar not null, status integer not null, alert_state integer not null, last_checked_time integer not null, sanitized_username varchar, alert_seen integer, last_seen_time integer, unique (url, username))"), "CREATE TABLE logins_edge_extended (id INTEGER PRIMARY KEY AUTOINCREMENT, source VARCHAR NOT null DEFAULT 0, strength_alert_status INTEGER NOT null DEFAULT 0, password_nickname VARCHAR NOT null DEFAULT '' )" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, Indicator: "create table logins_edge_extended (id integer primary key autoincrement, source varchar not null default 0, strength_alert_status integer not null default 0, password_nickname varchar not null default '' )"), "CREATE TABLE stats (origin_domain VARCHAR NOT NULL, username_value VARCHAR, dismissal_count INTEGER, update_time INTEGER NOT NULL, UNIQUE(origin_domain, username_value))" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, Indicator: "create table stats (origin_domain varchar not null, username_value varchar, dismissal_count integer, update_time integer not null, unique(origin_domain, username_value))"), "CREATE TABLE field_info (form_signature INTEGER NOT NULL, field_signature INTEGER NOT NULL, field_type INTEGER NOT NULL, create_time INTEGER NOT NULL, UNIQUE (form_signature, field_signature))" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, Indicator: "create table field_info (form_signature integer not null, field_signature integer not null, field_type integer not null, create_time integer not null, unique (form_signature, field_signature))"), "CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key))" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, Indicator: "create table password_notes (id integer primary key autoincrement, parent_id integer not null references logins on update cascade on delete cascade deferrable initially deferred, key varchar not null, value blob, date_created integer not null, confidential integer, unique (parent_id, key))"), "CREATE TABLE sync_entities_metadata (storage_key INTEGER PRIMARY KEY AUTOINCREMENT, metadata VARCHAR NOT NULL)R" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.06070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.06070000.00000004.mdmp, Indicator: "create table sync_entities_metadata (storage_key integer primary key autoincrement, metadata varchar not null)r"), "CREATE TABLE logins (origin_url VARCHAR NOT NULL, action_url VARCHAR, username_element VARCHAR, username_value VARCHAR, password_element VARCHAR, password_value BLOB, submit_element VARCHAR, signon_realm VARCHAR NOT NULL, date_created INTEGER NOT NULL, blacklisted_by_user INTEGER NOT NULL, scheme INTEGER NOT NULL, password_type INTEGER, times_used INTEGER, form_data BLOB, display_name VARCHAR, icon_url VARCHAR, federation_url VARCHAR, skip_zero_click INTEGER, generation_upload_status INTEGER, possible_username_pairs BLOB, id INTEGER PRIMARY KEY AUTOINCREMENT, date_last_used INTEGER NOT NULL DEFAULT 0, moving_blocked_for BLOB, date_password_modified INTEGER NOT NULL DEFAULT 0, UNIQUE (origin_url, username_element, username_value, password_element, signon_realm))+" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.06070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.06070000.00000004.mdmp, Indicator: "create table logins (origin_url varchar not null, action_url varchar, username_element varchar, username_value varchar, password_element varchar, password_value blob, submit_element varchar, signon_realm varchar not null, date_created integer not null, blacklisted_by_user integer not null, scheme integer not null, password_type integer, times_used integer, form_data blob, display_name varchar, icon_url varchar, federation_url varchar, skip_zero_click integer, generation_upload_status integer, possible_username_pairs blob, id integer primary key autoincrement, date_last_used integer not null default 0, moving_blocked_for blob, date_password_modified integer not null default 0, unique (origin_url, username_element, username_value, password_element, signon_realm))+"), "CREATE TABLE meta(key LONGVARCHAR NOT NULL UNIQUE PRIMARY KEY, value LONGVARCHAR)'" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.06070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.06070000.00000004.mdmp, Indicator: "create table meta(key longvarchar not null unique primary key, value longvarchar)'"), "CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key))N" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.06070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.06070000.00000004.mdmp, Indicator: "create table password_notes (id integer primary key autoincrement, parent_id integer not null references logins on update cascade on delete cascade deferrable initially deferred, key varchar not null, value blob, date_created integer not null, confidential integer, unique (parent_id, key))n"), "CREATE TABLE stats (origin_domain VARCHAR NOT NULL, username_value VARCHAR, dismissal_count INTEGER, update_time INTEGER NOT NULL, UNIQUE(origin_domain, username_value)))" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.06070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.06070000.00000004.mdmp, Indicator: "create table stats (origin_domain varchar not null, username_value varchar, dismissal_count integer, update_time integer not null, unique(origin_domain, username_value)))"), "CREATE TABLE logins_edge_extended (id INTEGER PRIMARY KEY AUTOINCREMENT, source VARCHAR NOT null DEFAULT 0, strength_alert_status INTEGER NOT null DEFAULT 0, password_nickname VARCHAR NOT null DEFAULT '' )f" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.06070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.06070000.00000004.mdmp, Indicator: "create table logins_edge_extended (id integer primary key autoincrement, source varchar not null default 0, strength_alert_status integer not null default 0, password_nickname varchar not null default '' )f"), "CREATE TABLE breached (url VARCHAR NOT null, username VARCHAR NOT null, status INTEGER NOT null, alert_state INTEGER NOT null, last_checked_time INTEGER NOT null, sanitized_username VARCHAR, alert_seen INTEGER, last_seen_time INTEGER, UNIQUE (url, username))/" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.06070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.06070000.00000004.mdmp, Indicator: "create table breached (url varchar not null, username varchar not null, status integer not null, alert_state integer not null, last_checked_time integer not null, sanitized_username varchar, alert_seen integer, last_seen_time integer, unique (url, username))/"), "CREATE TABLE field_info (form_signature INTEGER NOT NULL, field_signature INTEGER NOT NULL, field_type INTEGER NOT NULL, create_time INTEGER NOT NULL, UNIQUE (form_signature, field_signature))3" (Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.06070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.06070000.00000004.mdmp, Indicator: "create table field_info (form_signature integer not null, field_signature integer not null, field_type integer not null, create_time integer not null, unique (form_signature, field_signature))3")3a:T4c1,"6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"3b:T123e,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",12,"System.Windows.Forms Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089",03,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",02,"System.Drawing Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a",02,"Microsoft.VisualBasic Version=10.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a",03,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: 6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.exe.log] Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: 6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.exe.log] Observed system executable string:"3,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: 6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.exe.log] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00003192-00000C24-82981274] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00003192-00000C24-83468152] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00003192-00000C24-83601936] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003192-00000C24-83698311] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003192-00000C24-83877744] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003192-00000C24-83930136] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00003192-00000C24-84001909] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00003192-00000C24-84200194] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00003192-00000C24-84293271] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00003192-00000C24-84396714] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00003192-00000C24-84653238] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00003192-00000C24-84685430] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00003192-00000C24-84718272] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00003192-00000C24-84874095] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00003192-00000C24-85216179] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00003192-00000C24-85638309] Observed system executable string:"%WINDIR%\system32\kernel32.dll" [Source: 00000000-00003192-00000C24-85847613] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00003192-00000C24-86001616] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" [Source: 00000000-00004960-00000C24-94312807] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00004960-00000C24-100584537] Observed system executable string:"C:\windows\temp\VxSSL32.dll" [Source: 00000000-00003192.00000000.78290.003B0000.00000020.mdmp 00000000-00003192.00000000.78290.02780000.00000002.mdmp] Observed system executable string:"C:\WINDOWS\system32\sxsoa.dll" [Source: 00000000-00003192.00000000.78290.003E0000.00000002.mdmp]3c:T57e,".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\6B8BEC10FC45B9CAFC5F9FE08BD936F89A30E2B4107EEED1616D2C2B0D38414D.EXE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\RPC"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "")3d:Tae3,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "IDLETIMERWINDOW"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "6B8BEC10FC45B9CAFC5F9FE08BD936F89A30E2B4107EEED1616D2C2B0D38414D.EXE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "")3e:Ta54,".exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" ".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\MSCORWKS.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSCOREE.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\OLE32.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ole32.dll" ".exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" ".exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\API-MS-WIN-CORE-WINRT-L1-1-0.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\MSCORRC.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll"3f:T8f5,".exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" ".exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\MSCOREE.DLL.local" ".exe" trying to access non-existent file "C:\6B8BEC10FC45B9CAFC5F9FE08BD936F89A30E2B4107EEED1616D2C2B0D38414D.EXE.CONFIG" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\6B8BEC10FC45B9CAFC5F9FE08BD936F89A30E2B4107EEED1616D2C2B0D38414D.EXE.LOG" ".exe" trying to access non-existent file "C:\6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.exe.config" ".exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\VISUALUIAVERIFY" ".exe" trying to access non-existent file "C:\6B8BEC10FC45B9CAFC5F9FE08BD936F89A30E2B4107EEED1616D2C2B0D38414D.INI" ".exe" trying to access non-existent file "C:\6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.INI" ".exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" ".exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.WINDOWS.FORMS" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.INI" ".exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.INI" ".exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.DRAWING" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\SYSTEM.DRAWING.INI" ".exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\MICROSOFT.V9921E851#"40:T1a62,Heuristic match: "bv].UG" Heuristic match: "checkip.dyndns.org" Heuristic match: "info@sienkakupeste.com" Heuristic match: "mail.sienkakupeste.com" Heuristic match: "saleseuropower1@yandex.com" Heuristic match: "S;.Vc" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Pattern match: "Microsoft.Net/assembly/GAC_32/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscW" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitReport" Pattern match: "go.microsoft.com/fwlink/?LinkID=851034&clcid=0x409&" Pattern match: "http://go.microsoft.com/fwlink/?LinkId=42127" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/TR/2001/REC-xml-c14n-20010315" Pattern match: "http://www.w3.org/TR/2001/REC-xml-c14n-20010315#WithComments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#WithComments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/TR/1999/REC-xpath-19991116" Pattern match: "http://www.w3.org/TR/1999/REC-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#XML" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://github.com/Leurak/TrollRAT" Pattern match: "https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.16.0/codemirror.min.css" Pattern match: "https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.16.0/codemirror.min.js" Pattern match: "https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.16.0/mode/clike/clike.min.js" Pattern match: "https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css" Pattern match: "https://code.jquery.com/jquery-2.2.4.min.js" Pattern match: "https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74408&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%d" Pattern match: "https://go.microsoft.com/fwlink/?LinkID=851034&clcid=0x409&" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Pattern match: "api.telegram.org/bot" Pattern match: "http://schemas.microsoft.com/SMI/2005/WindowsSettings" Heuristic match: "EXE;.BA" Heuristic match: "heckip.dyndns.com" Pattern match: "http://checkip.dyndns.org/" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/XML/1998/namespace" Pattern match: "http://schemas.microsoft.com/.NetConfiguration/v2.0" Pattern match: "system.web/anonymousIdentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browserCaps" Pattern match: "system.web/clientTarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customErrors" Pattern match: "system.web/deployment" Pattern match: "system.web/deviceFilters" Pattern match: "system.web/fullTrustAssemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthMonitoring" Pattern match: "system.web/hostingEnvironment" Pattern match: "system.web/httpCookies" Pattern match: "system.web/httpHandlers" Pattern match: "system.web/httpModules" Pattern match: "system.web/httpRuntime" Pattern match: "system.web/identity" Pattern match: "system.web/machineKey" Pattern match: "system.web/membership" Pattern match: "system.web/mobileControls" Pattern match: "system.web/pages" Pattern match: "system.web/partialTrustVisibleAssemblies" Pattern match: "system.web/processModel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/roleManager" Pattern match: "system.web/securityPolicy" Pattern match: "system.web/sessionPageState" Pattern match: "system.web/sessionState" Pattern match: "system.web/siteMap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlMappings" Pattern match: "system.web/webControls" Pattern match: "system.web/webParts" Pattern match: "system.web/webServices" Pattern match: "system.web/xhtmlConformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputCache" Pattern match: "system.web/caching/outputCacheSettings" Pattern match: "system.web/caching/sqlCacheDependency" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/XMLSchema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Heuristic match: "/.NET/NetClasses/HttpWebRequest/CONNECT__Group$$/" Pattern match: "http://checkip.dyndns.org" Heuristic match: "checkip.dyndns.com" Pattern match: "http://checkip.dyndns.com" Heuristic match: "heckip.dyndns.org" Heuristic match: "Host: checkip.dyndns.org"41:T12b7,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003192.00000000.78290.029C0000.00000004.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportindows" - Source: "00000000-00003192.00000000.78290.04720000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found URL "http://github.com/leurak/trollrat" - Source: "00000000-00003192.00000000.78290.05900000.00000004.mdmp") Found URL "https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.16.0/codemirror.min.css" - Source: "00000000-00003192.00000000.78290.05900000.00000004.mdmp") Found URL "https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.16.0/codemirror.min.js" - Source: "00000000-00003192.00000000.78290.05900000.00000004.mdmp") Found URL "https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.16.0/mode/clike/clike.min.js" - Source: "00000000-00003192.00000000.78290.05900000.00000004.mdmp") Found URL "https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css" - Source: "00000000-00003192.00000000.78290.05900000.00000004.mdmp") Found URL "https://code.jquery.com/jquery-2.2.4.min.js" - Source: "00000000-00003192.00000000.78290.05900000.00000004.mdmp") Found URL "https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js" - Source: "00000000-00003192.00000000.78290.05900000.00000004.mdmp") Found URL "http://github.com/leurak/trollrat" - Source: "00000000-00003192.00000000.78290.07160000.00000004.mdmp") Found URL "https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.16.0/codemirror.min.css" - Source: "00000000-00003192.00000000.78290.07160000.00000004.mdmp") Found URL "https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.16.0/codemirror.min.js" - Source: "00000000-00003192.00000000.78290.07160000.00000004.mdmp") Found URL "https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.16.0/mode/clike/clike.min.js" - Source: "00000000-00003192.00000000.78290.07160000.00000004.mdmp") Found URL "https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/css/bootstrap.min.css" - Source: "00000000-00003192.00000000.78290.07160000.00000004.mdmp") Found URL "https://code.jquery.com/jquery-2.2.4.min.js" - Source: "00000000-00003192.00000000.78290.07160000.00000004.mdmp") Found URL "https://maxcdn.bootstrapcdn.com/bootstrap/3.3.6/js/bootstrap.min.js" - Source: "00000000-00003192.00000000.78290.07160000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00003192.00000000.78290.6EC31000.00000020.mdmp")42:Ta01,".exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003192) ".exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00003192) ".exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00003192) ".exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00003192) ".exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00003192) ".exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00003192) ".exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00003192) ".exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00003192) ".exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00003192) ".exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00003192) ".exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00003192) ".exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00003192) ".exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00003192) ".exe" called "FindNextFileW" with parameter v3.0 (UID: 00000000-00003192) ".exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00003192) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\* (UID: 00000000-00003192) ".exe" called "FindNextFileW" with parameter 36eaccfde177c2e7b93b8dbdde4e012a (UID: 00000000-00003192) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\VisualUIAVerify\* (UID: 00000000-00003192) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\* (UID: 00000000-00003192) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\* (UID: 00000000-00003192) ".exe" called "FindNextFileW" with parameter 2c3c912ea8f058f9d04c4650128feb3f (UID: 00000000-00003192) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\* (UID: 00000000-00003192)43:T1926,Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found string "CreateDecryptor" (Indicator: "createdecryptor"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp, 00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found string "CreateDecryptor" (Indicator: "createdecryptor"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp, 00000000-00003192.00000000.78290.04900000.00000004.mdmp, 00000000-00003192.00000000.78290.05900000.00000004.mdmp, 00000000-00003192.00000000.78290.07160000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp, 00000000-00003192.00000000.78290.04900000.00000004.mdmp, 00000000-00003192.00000000.78290.05900000.00000004.mdmp, 00000000-00003192.00000000.78290.07160000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003192.00000000.78290.029C0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003192.00000000.78290.029C0000.00000004.mdmp, 00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found string "AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003192.00000000.78290.029C0000.00000004.mdmp") Found string "SA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003192.00000000.78290.029C0000.00000004.mdmp") Found string "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003192.00000000.78290.029C0000.00000004.mdmp") Found string "description="Uses RsaCryptoServiceProvider to encrypt and decrypt"" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00003192.00000000.78290.029C0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider (Prototype)" (Indicator: "aes"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.AesCryptoServiceProvider.DontCorrectlyResetDecryptor" (Indicator: "aes"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.AesCryptoServiceProvider.DontCorrectlyResetDecryptor" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.AesCryptoServiceProvider.DontCorrectlyResetDecryptor" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found string "Uses RsaCryptoServiceProvider to encrypt and decrypt" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found string "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found string "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found string "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found string "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ecdsa"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found string "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp")44:Tce3,Found reference to API "GetDC" (Indicator: "GetDC"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003192.00000000.78290.029C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003192.00000000.78290.029C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00003192.00000000.78290.029C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003192.00000000.78290.029C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003192.00000000.78290.029C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003192.00000000.78290.029C0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00003192.00000000.78290.029C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003192.00000000.78290.029C0000.00000004.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00003192.00000000.78290.05900000.00000004.mdmp, 00000000-00003192.00000000.78290.07160000.00000004.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp")45:T6a5,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp")46:Tb50,Found reference to API "GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API "GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp, 00000000-00003192.00000000.78290.6EC31000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp, 00000000-00003192.00000000.78290.6EC31000.00000020.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp, 00000000-00003192.00000000.78290.6EC31000.00000020.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003192.00000000.78290.6EB91000.00000020.mdmp, 00000000-00003192.00000000.78290.6EC31000.00000020.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003192.00000000.78290.6EC31000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003192.00000000.78290.6EC31000.00000020.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00003192.00000000.78290.6EC45000.00000002.mdmp") Found reference to API "GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp")47:T860,Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API "NtOpenProcessToken" (Indicator: "NtOpenProcessToken"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; File: "6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "NtOpenProcessToken"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003192.00000000.78290.00332000.00000002.mdmp") Found reference to API "LookupAccountSidW" (Indicator: "LookupAccountSid"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "NtOpenProcessToken"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp") Found reference to API "NtOpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp")48:T1529,Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00003192.00000000.78290.029C0000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00003192.00000000.78290.029C0000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00003192.00000000.78290.029C0000.00000004.mdmp") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00003192.00000000.78290.04900000.00000004.mdmp") Found string "get_passwordField" (Indicator: "password"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found string "set_passwordField" (Indicator: "password"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found string "_password" (Indicator: "password"; Source: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00004960.00000000.79000.03290000.00000004.mdmp, 00000000-00004960.00000000.79000.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.03290000.00000004.mdmp, 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.03290000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00004960.00000000.79000.03290000.00000004.mdmp, 00000000-00004960.00000000.79000.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.03290000.00000004.mdmp, 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.03290000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00004960.00000000.79000.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00004960.00000000.79000.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00004960.00000000.79000.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00004960.00000000.79000.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp") Found string "password_value" (Indicator: "password"; Source: "00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp") Found string "CREATE TABLE logins_edge_extended (id INTEGER PRIMARY KEY AUTOINCREMENT, source VARCHAR NOT null DEFAULT 0, strength_alert_status INTEGER NOT null DEFAULT 0, password_nickname VARCHAR NOT null DEFAULT '' )" (Indicator: "password"; Source: "00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp") Found string "password_notes" (Indicator: "password"; Source: "00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp") Found string "sqlite_autoindex_password_notes_1" (Indicator: "password"; Source: "00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp") Found string "CREATE INDEX foreign_key_index_notes ON password_notes (parent_id)" (Indicator: "password"; Source: "00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp") Found string "password_element VARCHAR" (Indicator: "password"; Source: "00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp") Found string "password_value BLOB" (Indicator: "password"; Source: "00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp") Found string "password_type INTEGER" (Indicator: "password"; Source: "00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp")49:T120e,"oftware\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004960.00000000.79000.00400000.00000040.mdmp 00000000-00004960.00000001.80921.00400000.00000040.mdmp 00000000-00004960.00000002.82840.00400000.00000040.mdmp "oftware\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004960.00000000.79000.00400000.00000040.mdmp 00000000-00004960.00000001.80921.00400000.00000040.mdmp 00000000-00004960.00000002.82840.00400000.00000040.mdmp "oftware\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004960.00000000.79000.00400000.00000040.mdmp 00000000-00004960.00000001.80921.00400000.00000040.mdmp 00000000-00004960.00000002.82840.00400000.00000040.mdmp "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002" in Source: 00000000-00004960.00000000.79000.01038000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004960.00000000.79000.03180000.00000004.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000001" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002" in Source: 00000000-00004960.00000000.79000.05070000.00000004.mdmp 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "Could not find a part of the path 'C:\Users\HAPUBWS\AppData\Roaming\PostboxApp\Profiles'.\Pale Moon\Profiles'." in Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Thunderbird\Profiles\" in Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Thunderbird\Profiles\*" in Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Thunderbird\Profiles" in Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "Could not find a part of the path 'C:\Users\HAPUBWS\AppData\Roaming\Thunderbird\Profiles'." in Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\PostboxApp\Profiles" in Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\PostboxApp\Profiles\*" in Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp "Could not find a part of the path 'C:\Users\HAPUBWS\AppData\Roaming\PostboxApp\Profiles'." in Source: 00000000-00004960.00000001.80921.05070000.00000004.mdmp 00000000-00004960.00000002.82840.05070000.00000004.mdmp4a:T4e0,Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00003192.00000000.78290.6EC21000.00000002.mdmp")4b:Ta55,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\6B8BEC10FC45B9CAFC5F9FE08BD936F89A30E2B4107EEED1616D2C2B0D38414D.EXE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")4c:T4db,"1.0.0.0" "17.0.0.0" Potential IP "4.0.0.0" found in string "4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />", "2.5.29.10", "2.5.29.19", "2.5.29.14", "2.5.29.15", "2.5.29.37", "15.0.0.0", "17.0.3.0", "11.0.0.0", "17.5.0.0", "192.168.241.206", Potential IP "4.0.0.0" found in string "sion=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089 processorArchitecture=MSIL"/>" Potential IP "4.0.0.0" found in string "4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35">", "8.8.8.8", "255.255.255.255", Potential IP "67.218.111.202" found in string "Current IP CheckCurrent IP Address: 67.218.111.202", Potential IP "67.218.111.202" found in string "le>Current IP CheckCurrent IP Address: 67.218.111.202", Potential IP "67.218.111.202" found in string "Current IP Address: 67.218.111.202", Potential IP "67.218.111.202" found in string "Current IP Address: 67.218.111.202", "67.218.111.202", Potential IP "67.218.111.202" found in string "Client IP: 67.218.111.202", Potential IP "4.0.0.0" found in string "Public member '{0}' on type '{1}' not found.ersion=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089"4d:T864,".exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASAPI32"; Key: "ENABLEFILETRACING"; Value: "00000000") ".exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASAPI32"; Key: "ENABLEAUTOFILETRACING"; Value: "00000000") ".exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASAPI32"; Key: "ENABLECONSOLETRACING"; Value: "00000000") ".exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASAPI32"; Key: "FILETRACINGMASK"; Value: "0000FFFF") ".exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASAPI32"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF") ".exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASAPI32"; Key: "MAXFILESIZE"; Value: "00001000") ".exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASAPI32"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing") ".exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASMANCS"; Key: "ENABLEFILETRACING"; Value: "00000000") ".exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASMANCS"; Key: "ENABLEAUTOFILETRACING"; Value: "00000000") ".exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASMANCS"; Key: "ENABLECONSOLETRACING"; Value: "00000000") ".exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASMANCS"; Key: "FILETRACINGMASK"; Value: "0000FFFF") ".exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASMANCS"; Key: "CONSOLETRACINGMASK"; Value: "0000FFFF") ".exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASMANCS"; Key: "MAXFILESIZE"; Value: "00001000") ".exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\TRACING\RASMANCS"; Key: "FILEDIRECTORY"; Value: "%windir%\tracing")4e:Ta21,Found string "ReleaseDC" (Source: 6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin, API is part of module: USER32.DLL) Found string "GetDC" (Source: 6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin, API is part of module: USER32.DLL) Found string "GetWindowDC" (Source: 6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin, API is part of module: USER32.DLL) Found string "SetProcessDPIAware" (Source: 6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin, API is part of module: USER32.DLL) Found string "NtClose" (Source: 6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin, API is part of module: NTDLL.DLL) Found string "NtQueryInformationToken" (Source: 6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin, API is part of module: NTDLL.DLL) Found string "NtOpenProcessToken" (Source: 6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin, API is part of module: NTDLL.DLL) Found string "SetWindowPos" (Source: 6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin, API is part of module: USER32.DLL) Found string "GetCurrentProcess" (Source: 6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin, API is part of module: KERNELBASE.DLL) Found string "SetFocus" (Source: 6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin, API is part of module: USER32.DLL) Found string "GetCurrentObject" (Source: 6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin, API is part of module: GDI32FULL.DLL) Found string "BitBlt" (Source: 6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin, API is part of module: GDI32FULL.DLL) Found string "GetParent" (Source: 6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin, API is part of module: USER32.DLL) Found string "SetForegroundWindow" (Source: 6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin, API is part of module: USER32.DLL) Found string "ShowWindow" (Source: 6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin, API is part of module: USER32.DLL) Found string "RegisterHotKey" (Source: 6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin, API is part of module: USER32.DLL) Found string "UnregisterHotKey" (Source: 6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin, API is part of module: USER32.DLL) Found string "Rectangle" (Source: 6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin, API is part of module: GDI32FULL.DLL)4f:Ta31,".exe" wrote bytes "c002ff73f05d00746006ff73005f0074" to virtual address "0x76F811D8" (part of module "ADVAPI32.DLL") ".exe" wrote bytes "e02a9a73f0299a73702a9a73" to virtual address "0x6ECD700C" (part of module "RSAENH.DLL") ".exe" wrote bytes "edcac06e1069c56e0000000062cbc06e0000000012cbc06e1ccbc06e30cbc06e3acbc06e44cbc06e4ecbc06e58cbc06ef7cac06e26cbc06e00000000" to virtual address "0x6EC23000" (part of module "MPCLIENT.DLL") ".exe" wrote bytes "b07f1174d07f1174b0591574" to virtual address "0x74FA1778" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "a0928c02b0928c02b017010080f00600c0020100b0f0060060b20600e0918c02f0918c02" to virtual address "0x747CAC94" (part of module "USER32.DLL") ".exe" wrote bytes "d04f2d75f0c2177590c6207500cb1775f0f31f7540dd1f7560ef1f75102d187580a6177520be1e7570422075a0be1e75c0ff177540bf1e75e0582075" to virtual address "0x74FA15B0" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "70eb767400ec767440ec7674" to virtual address "0x753201FC" (part of module "COMBASE.DLL") ".exe" wrote bytes "309f6374f0666674702a627420a4637470236274003b637410606374b05b637400b06374805b6374d0816374d00d6174" to virtual address "0x7537E018" (part of module "GDI32.DLL") ".exe" wrote bytes "10369e7320369e73" to virtual address "0x753201A0" (part of module "COMBASE.DLL") ".exe" wrote bytes "30ae0974" to virtual address "0x74221094" (part of module "RPCRT4.DLL") ".exe" wrote bytes "1032fb7680ecff76208afc7600000000" to virtual address "0x75973000" (part of module "WIN32U.DLL") ".exe" wrote bytes "4aad506a" to virtual address "0x714FF798" (part of module "CLR.DLL") ".exe" wrote bytes "10f2767400b97574f0910177109d767490927674c0b4767450887674d067767440b27674209c7674108c7674a0a47674507c767450a97674c0b37674805d7674c0e6767490757674c0ee7674a0c4767400c0767410d2757460aa7674" to virtual address "0x75320228" (part of module "COMBASE.DLL") ".exe" wrote bytes "10d4b26e00b8b26e30d3b26e70d4b26e50d4b26e60adb26ed0d2b26e50b5b26e90adb26e10b4b26ec0b3b26ec0d4b26e307db26e20c2b26e007cb26e7087b26e807eb26e20c3b26e10aeb26e70d2b26eb086b26ec0d5b26ea0d5b26e" to virtual address "0x73FAE0E4" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "40d2fe73300dff73e0f6fe73c0cdfe73" to virtual address "0x74FA16C4" (part of module "WINDOWS.STORAGE.DLL") ".exe" wrote bytes "c002ff736006ff73" to virtual address "0x7532004C" (part of module "COMBASE.DLL")50:T7ce,"checkip.dyndns.org" (Indicator: "checkip.dyndns.org"; File: "PCAP") "GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive" (Indicator: "checkip.dyndns.org"; File: "PCAP") "ttp://checkip.dyndns.org/" (Indicator: "checkip.dyndns.org"; File: "00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp") "checkip.dyndns.org" (Indicator: "checkip.dyndns.org"; File: "00000000-00004960.00000000.79000.03290000.00000004.mdmp, 00000000-00004960.00000000.79000.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp") "http://checkip.dyndns.org/" (Indicator: "checkip.dyndns.org"; File: "00000000-00004960.00000000.79000.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp") "http://checkip.dyndns.org" (Indicator: "checkip.dyndns.org"; File: "00000000-00004960.00000000.79000.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp") "checkip.dyndns.com" (Indicator: "checkip.dyndns.com"; File: "00000000-00004960.00000000.79000.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp") "http://checkip.dyndns.com" (Indicator: "checkip.dyndns.com"; File: "00000000-00004960.00000000.79000.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp") "Host: checkip.dyndns.org" (Indicator: "checkip.dyndns.org"; File: "00000000-00004960.00000000.79000.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp")51:T938,".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\15.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS MESSAGING SUBSYSTEM\PROFILES\9375CFF0413111D3B88A00104B2A6676") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "EMAIL") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "IMAP PASSWORD") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "POP3 PASSWORD") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "HTTP PASSWORD") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "SMTP PASSWORD") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "EMAIL") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "IMAP PASSWORD") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "POP3 PASSWORD") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "HTTP PASSWORD") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\OFFICE\16.0\OUTLOOK\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "SMTP PASSWORD")52:Tb2a,".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA\DEFAULT\YA LOGIN DATA" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\AMIGO\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\XPOM\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\KOMETA\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\NICHROME\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Google\Chrome\User Data\DEFAULT\LOGIN DATA" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TENCENT\QQBROWSER\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\ORBITUM\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SLIMJET\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\IRIDIUM\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\GHOSTBROWSER\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CENTBROWSER\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\XVAST\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\CHEDOT\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\SUPERBIRD\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360BROWSER\BROWSER\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\360CHROME\CHROME\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\TORCH\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\UCBROWSER\USER DATA_I18N\DEFAULT\UC LOGIN DATA.18"1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790406956580,"unified_at":"2026-09-26T07:15:56.580Z","metadata":{"hashes":{"sha256":"6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d","sha1":"be7bb8d81f195e1df299a7eab354717878ef437a","md5":"86501dabe8c2a09915b906659d0902b8","sha512":"e9dc74fe78ca7ec38745ab2d1ef28e1e28b19cd099e68ba4184cb6d10d7f47b7f137a8a4b2a5fcffdcf8dc196165aa9465a57124501fdfe905acdc7dc51bed57","ssdeep":"6144:pL4t6UdpDlM9EfB2Afxhn7D1NwvK7xjA1G4m8isJv0hpESnMX5tqX:d9EfNfxGpnucSMX","ssdeep_chunks":["6144:pL4t6Ud","6144:L4t6Udp","6144:4t6UdpD","6144:t6UdpDl","6144:6UdpDlM","6144:UdpDlM9","6144:dpDlM9E","6144:pDlM9Ef","6144:DlM9EfB","6144:lM9EfB2","6144:M9EfB2A","6144:9EfB2Af","6144:EfB2Afx","6144:fB2Afxh","6144:B2Afxhn","6144:2Afxhn7","6144:Afxhn7D","6144:fxhn7D1","6144:xhn7D1N","6144:hn7D1Nw","6144:n7D1Nwv","6144:7D1NwvK","6144:D1NwvK7","6144:1NwvK7x","6144:NwvK7xj","6144:wvK7xjA","6144:vK7xjA1","6144:K7xjA1G","6144:7xjA1G4","6144:xjA1G4m","6144:jA1G4m8","6144:A1G4m8i","6144:1G4m8is","6144:G4m8isJ","6144:4m8isJv","6144:m8isJv0","6144:8isJv0h","6144:isJv0hp","6144:sJv0hpE","6144:Jv0hpES","6144:v0hpESn","6144:0hpESnM","6144:hpESnMX","6144:pESnMX5","6144:ESnMX5t","6144:SnMX5tq","6144:nMX5tqX","12288:pL4t6Ud","12288:L4t6Udp","12288:4t6UdpD","12288:t6UdpDl","12288:6UdpDlM","12288:UdpDlM9","12288:dpDlM9E","12288:pDlM9Ef","12288:DlM9EfB","12288:lM9EfB2","12288:M9EfB2A","12288:9EfB2Af","12288:EfB2Afx","12288:fB2Afxh","12288:B2Afxhn","12288:2Afxhn7","12288:Afxhn7D","12288:fxhn7D1","12288:xhn7D1N","12288:hn7D1Nw","12288:n7D1Nwv","12288:7D1NwvK","12288:D1NwvK7","12288:1NwvK7x","12288:NwvK7xj","12288:wvK7xjA","12288:vK7xjA1","12288:K7xjA1G","12288:7xjA1G4","12288:xjA1G4m","12288:jA1G4m8","12288:A1G4m8i","12288:1G4m8is","12288:G4m8isJ","12288:4m8isJv","12288:m8isJv0","12288:8isJv0h","12288:isJv0hp","12288:sJv0hpE","12288:Jv0hpES","12288:v0hpESn","12288:0hpESnM","12288:hpESnMX","12288:pESnMX5","12288:ESnMX5t","12288:SnMX5tq","12288:nMX5tqX","6144:d9EfNfx","6144:9EfNfxG","6144:EfNfxGp","6144:fNfxGpn","6144:NfxGpnu","6144:fxGpnuc","6144:xGpnucS","6144:GpnucSM","6144:pnucSMX"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"TQH0009000AQ.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":327680,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1686863116000,"last_seen":1686984091000,"last_multi_scan":1686984091000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["autorun","coinhive","coinminer","commodity","credentialharvesting","informationstealer","keylogger","miner","snakekeylogger","tomdep","windows-server-utility"]},"stats":{"av":{"malicious_count":11,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":73},"sandbox_signatures":{"informative_count":173,"suspicious_count":19,"malicious_count":16,"total":208},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Leonem","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Spy]/MSIL.SnakeLogger","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1309967","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.67541690","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.67541690 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Kryptik.AJBG trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-Spy.MSIL.SnakeLogger.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Keylog-AWJ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Agent.FIM.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Email Accounts","attack_id":"T1585.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1585/002","identifiers":[{"type":"informative","value":"Found email domains (string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Dotnet source code contains suspicious native API"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains NTDLL native APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to interact with Microsoft Outlook"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains the ability to modify system service (API string)"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"},{"type":"informative","value":"Contains ability to register hotkeys"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to encrypt/decrypt data using TripleDES"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric decryption (Dotnet)"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Dotnet code contains potential unpacker"},{"type":"informative","value":"Can loads assembly that contains the code that is currently executing [Dotnet]"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"malicious","value":"Modifies file/console tracing settings (often used to hide footprints on system)"},{"type":"suspicious","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains ability to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"},{"type":"informative","value":"Contains the ability to enumerate service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Tries to identify its external IP address"},{"type":"malicious","value":"Found a reference to an external IP address lookup service"},{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Checks on FTP client related files"},{"type":"suspicious","value":"Tries to access browsers/wallets sensitive information (file access)"},{"type":"suspicious","value":"Found desktop apps credentials related location strings"},{"type":"malicious","value":"Tries to steal desktop applications information (file access)"},{"type":"suspicious","value":"Tries to steal Pidgin account information (file access)"},{"type":"suspicious","value":"Found Pidgin accounts related filepath string"},{"type":"suspicious","value":"Found browsers sensitive information related strings"},{"type":"informative","value":"May execute SQL queries"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"malicious","value":"Tries to steal Mail credentials from registry"},{"type":"suspicious","value":"Tries to access mail clients information (file access)"},{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"},{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Contains ability to perform symmetric crypto operations"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\".exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00003192)\n \".exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00003192)\n \".exe\" called \"FindResourceW\" (UID: 00000000-00003192)\n \".exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00003192)\n \".exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00003192)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\".exe\" called \"LoadResource with parameter {'hModule': '76021761', 'hResInfo': '76023008'}\" (UID: 00000000-00003192)\n \".exe\" called \"LoadResource with parameter {'hModule': '76021761', 'hResInfo': '76023040'}\" (UID: 00000000-00003192)\n \".exe\" called \"LoadResource with parameter {'hModule': '76021761', 'hResInfo': '76023056'}\" (UID: 00000000-00003192)\n \".exe\" called \"LoadResource with parameter \" (UID: 00000000-00003192)\n \".exe\" called \"LoadResource with parameter {'hModule': '76021761', 'hResInfo': '76023024'}\" (UID: 00000000-00003192)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")\n Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")\n Found reference to API \"RegisterWaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")\n Found reference to API \"CreateTimerQueueTimer\" (Indicator: \"CreateTimerQueueTimer\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003192.00000000.78290.00332000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003192.00000000.78290.029C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$27","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00003192.00000000.78290.029C0000.00000004.mdmp\n Observed string: \":\\windows\\system32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00003192.00000000.78290.029C0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains the ability to modify system service (API string)","description":"Found reference to API \"ChangeServiceConfigW\" (Indicator: \"ChangeServiceConfig\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"TransformFinalBlock\" in \"6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file resource with suspicious entropy","description":"6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin has big resource with name: \"SpaceTeam\" size: \"206352\" and abnormal entropy:\"7.99728898732\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"$28","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00003192.00000000.78290.04900000.00000004.mdmp, 00000000-00003192.00000000.78290.05900000.00000004.mdmp, 00000000-00003192.00000000.78290.07160000.00000004.mdmp\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/decrypt data using TripleDES","description":"Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-486","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00003192.00000000.78290.029C0000.00000004.mdmp\")\n Found string \"Uses RsaCryptoServiceProvider to encrypt and decrypt\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00003192.00000000.78290.04900000.00000004.mdmp\")\n Found string \"Uses RsaCryptoServiceProvider to encrypt and decrypt\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00004960.00000000.79000.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp\")\n Found string \"description=\"Uses RsaCryptoServiceProvider to encrypt and decrypt\"\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00004960.00000000.79000.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.RC2CryptoServiceProvider\" and TypeReference \".ctor\" in \"6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin\"\n Observed namespace \"System.Security.Cryptography.DESCryptoServiceProvider\" and TypeReference \".ctor\" in \"6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric decryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"MSIE\" in header \"GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive\"\n Contains base64 string in header \"CLR1\" in header \"GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive\"\n Contains base64 string in header \"3705\" in header \"GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive\"\n Contains base64 string in header \"Host\" in header \"GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive\"\n Contains base64 string in header \"Keep\" in header \"GET / HTTP/1.1User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)Host: checkip.dyndns.orgConnection: Keep-Alive\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.518206075534615","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\".exe\" called \"IsWow64Process\" with parameter \"3192\" - (UID: 00000000-00003192)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003192)\n \".exe\" called \"RtlGetNtProductType\" (UID: 00000000-00003192)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\".exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f023000002000000006f78795c62696e00504154484558543d2e434f4d3b2e4558453b2e4241543b2e434d443b2e5642533b2e5642453b2e4a533b2e4a53453b2e5753463b2e5753483b2e4d53430050524f434553534f525f4152434849544543545552453d7838360050524f434553534f525f4152434849544557363433323d414d4436340050 (UID: 00000000-00003192)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\".exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00003192)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\".exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00003192)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00003192.00000000.78290.6EB91000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003192.00000000.78290.6EB91000.00000020.mdmp, 00000000-00003192.00000000.78290.6EC31000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"Set Focus\" (Indicator: \"set \"; File: \"6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")\n Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003192.00000000.78290.6EB91000.00000020.mdmp, 00000000-00003192.00000000.78290.6EC31000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetWindowText\" (Indicator: \"GetWindowText\"; Source: \"00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp\")\n Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET POLICY External IP Lookup - checkip.dyndns.org\" (SID: 2021378, Rev: 5, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"\n Detected alert \"ET INFO 404/Snake/Matiex Keylogger Style External IP Check\" (SID: 2039190, Rev: 3, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"\n Detected alert \"ET INFO External IP Lookup Domain in DNS Query (checkip .dyndns .org)\" (SID: 2043238, Rev: 1, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\".exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00003192)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\".exe\" called \"CreateProcessA\" with parameter \"C:\\6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.exe\" - (UID: 00000000-00003192)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$30","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Can loads assembly that contains the code that is currently executing [Dotnet]","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00003192.00000000.78290.05900000.00000004.mdmp, 00000000-00003192.00000000.78290.07160000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"checkip.dyndns.org\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"193.122.6.168:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Contains NTDLL native APIs","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-604","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$32","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003192.00000000.78290.05900000.00000004.mdmp, 00000000-00003192.00000000.78290.07160000.00000004.mdmp\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")\n Found reference to API \"CreateDirectory\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00003192.00000000.78290.05900000.00000004.mdmp, 00000000-00003192.00000000.78290.07160000.00000004.mdmp\")\n Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys","description":"VisualUIAVerify.Win32.UnsafeNativeMethods::UnregisterHotKey(System.IntPtr,System.Int32) at 86501dabe8c2a09915b906659d0902b8-600007a-MainWindow~UnregisterHotKeys\n VisualUIAVerify.Win32.UnsafeNativeMethods::RegisterHotKey(System.IntPtr,System.Int32,System.UInt32,System.UInt32) at 86501dabe8c2a09915b906659d0902b8-6000079-MainWindow~RegisterHotKeys\n VisualUIAVerify.Forms.MainWindow::RegisterHotKeys() at 86501dabe8c2a09915b906659d0902b8-6000072-ctor\n VisualUIAVerify.Forms.MainWindow::UnregisterHotKeys() at 86501dabe8c2a09915b906659d0902b8-6000076-MainWindow~OnClosed","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1547.009","relevance":5,"id":"stream-15","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1547.009","relevance":1,"id":"string-545","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")\n Found reference to API \"CreateThreadpool\" (Indicator: \"CreateThread\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolIo\" (Indicator: \"CreateThread\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003192.00000000.78290.00332000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp, 00000000-00003192.00000000.78290.6EC45000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00003192.00000000.78290.00332000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00004960.00000000.79000.00400000.00000040.mdmp, 00000000-00004960.00000001.80921.00400000.00000040.mdmp, 00000000-00004960.00000002.82840.00400000.00000040.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00004960.00000000.79000.00D32000.00000002.mdmp, 00000000-00004960.00000001.80921.00D32000.00000002.mdmp, 00000000-00004960.00000002.82840.00D32000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$35","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Contains the ability to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatus\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00003192.00000000.78290.6EC21000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"Local\\SM0:3192:168:WilStaging_02\"\n \"SM0:3192:168:WilStaging_02\"\n \"SM0:3192:64:WilError_01\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Dotnet source code contains suspicious native API","description":"Observed API \"NtOpenProcessToken\" in \"6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$36","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$37","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)\" (Indicator: \"mozilla/4.0 (\"; Source: \"00000000-00004960.00000000.79000.05070000.00000004.mdmp, 00000000-00004960.00000001.80921.05070000.00000004.mdmp, 00000000-00004960.00000002.82840.05070000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"saleseuropower1@yandex.com\" (Indicator: \"yandex.com\")\n \"p>Source Code is on GitHub, Licensed under MIT License

\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET / HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.2; .NET CLR1.0.3705;)\nHost: checkip.dyndns.org\nConnection: Keep-Alive\" Response ==> HTTP/1.1 200 OK\nDate: Sat\n 17 Jun 2023 06:47:23 GMT\nContent-Type: text/html\nContent-Length: 106\nConnection: keep-alive\nCache-Control: no-cache\nPragma: no-cache with response body ==>3C68746D6C3E3C686561643E3C7469746C653E43757272656E7420495020436865636B3C2F7469746C653E3C2F686561643E3C626F64793E43757272656E7420.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$38","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 70010000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 6EC80000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74080000\n \".exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 71F80000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\".exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 714F0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74170000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin\" was detected as \".NET\" and name: \"Library\"\n \"6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$39","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\".exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"6b8bec10fc45b9cafc5f9fe08bd936f89a30e2b4107eeed1616d2c2b0d38414d.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3a","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \".exe\" (UID: 00000000-00007100) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \".exe\" (UID: 00000000-00007100) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"checkip.dyndns.org\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \".exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"648d559a661487ced30dc6bc"}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"Found string \"\" (Indicator: \"text/javascript\"; Source: \"00000000-00003192.00000000.78290.05900000.00000004.mdmp, 00000000-00003192.00000000.78290.07160000.00000004.mdmp\")\n Found string \"\" (Indicator: \"text/javascript\"; Source: \"00000000-00003192.00000000.78290.05900000.00000004.mdmp, 00000000-00003192.00000000.78290.07160000.00000004.mdmp\")\n Found string \"