26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 71:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a1,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 853fc7d70995… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 853fc7d70995…. Malware family: Trojan.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 13 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6"],"about":{"@type":"SoftwareApplication","name":"23178fd674e0857fd28c3f1062e84348.exe","applicationCategory":["peexe","executable"],"identifier":"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":12,"total":27},"behavioralIndicators":{"malicious":13,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T25c4,Found reference to API (Indicator: "DosDateTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "DeleteFileA"; Source: "sample.bin"), Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "sample.bin"), Found reference to API (Indicator: "MulDiv"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "SetForegroundWindow"; Source: "sample.bin"), Found reference to API (Indicator: "SeShutdownPrivilege"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "sample.bin"), Found reference to API (Indicator: "GetExitCodeProcess"; Source: "sample.bin"), Found reference to API (Indicator: "FreeSid"; Source: "sample.bin"), Found reference to API (Indicator: "SetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDriveTypeA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryA"; Source: "sample.bin"), Found reference to API (Indicator: "EqualSid"; Source: "sample.bin"), Found reference to API (Indicator: "CreateThread"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleHandleW"; Source: "sample.bin"), Found reference to API (Indicator: "DecryptFileA"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcessId"; Source: "sample.bin"), Found reference to API (Indicator: "RegSetValueExA"; Source: "sample.bin"), Found reference to API (Indicator: "FormatMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetStartupInfoW"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileAttributesA"; Source: "sample.bin"), Found reference to API (Indicator: "RegOpenKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDesktopWindow"; Source: "sample.bin"), Found reference to API (Indicator: "CharNextA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowPos"; Source: "sample.bin"), Found reference to API (Indicator: "ShowWindow"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemInfo"; Source: "sample.bin"), Found reference to API (Indicator: "SendMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "VerQueryValueA"; Source: "sample.bin"), Found reference to API (Indicator: "DispatchMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "sample.bin"), Found reference to API (Indicator: "FindFirstFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GetProcAddress"; Source: "sample.bin"), Found reference to API (Indicator: "CreateMutexA"; Source: "sample.bin"), Found reference to API (Indicator: "CreateFileA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CheckTokenMembership"; Source: "sample.bin"), Found reference to API (Indicator: "SetFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "RegCloseKey"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempPathA"; Source: "sample.bin"), Found reference to API (Indicator: "GetTokenInformation"; Source: "sample.bin"), Found reference to API (Indicator: "SizeofResource"; Source: "sample.bin"), Found reference to API (Indicator: "ResetEvent"; Source: "sample.bin"), Found reference to API (Indicator: "RemoveDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalLock"; Source: "sample.bin"), Found reference to API (Indicator: "FindClose"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFileTimeToFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "IsDBCSLeadByte"; Source: "sample.bin"), Found reference to API (Indicator: "GetTickCount"; Source: "sample.bin"), Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDC"; Source: "sample.bin"), Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "sample.bin"), Found reference to API (Indicator: "SetFilePointer"; Source: "sample.bin"), Found reference to API (Indicator: "GetShortPathNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateThread"; Source: "sample.bin"), Found reference to API (Indicator: "FreeResource"; Source: "sample.bin"), Found reference to API (Indicator: "lstrcmpA"; Source: "sample.bin"), Found reference to API (Indicator: "ExitProcess"; Source: "sample.bin"), Found reference to API (Indicator: "EnumResourceLanguagesA"; Source: "sample.bin"), Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVolumeInformationA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentThreadId"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBoxA"; Source: "sample.bin"), Found reference to API (Indicator: "SHBrowseForFolder"; Source: "sample.bin"), Found reference to API (Indicator: "GetModuleFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetCurrentProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CharUpperA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalFree"; Source: "sample.bin"), Found reference to API (Indicator: "LoadLibraryExA"; Source: "sample.bin"), Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "sample.bin"), Found reference to API (Indicator: "RegDeleteValueA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowRect"; Source: "sample.bin"), Found reference to API (Indicator: "CharPrevA"; Source: "sample.bin"), Found reference to API (Indicator: "GetDeviceCaps"; Source: "sample.bin"), Found reference to API (Indicator: "ReleaseDC"; Source: "sample.bin"), Found reference to API (Indicator: "HeapSetInformation"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowTextA"; Source: "sample.bin"), Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "sample.bin"), Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "sample.bin"), Found reference to API (Indicator: "EnableWindow"; Source: "sample.bin"), Found reference to API (Indicator: "PeekMessageA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersionExA"; Source: "sample.bin"), Found reference to API (Indicator: "LocalAlloc"; Source: "sample.bin"), Found reference to API (Indicator: "CreateEventA"; Source: "sample.bin"), Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "sample.bin"), Found reference to API (Indicator: "GlobalUnlock"; Source: "sample.bin"), Found reference to API (Indicator: "RegQueryInfoKeyA"; Source: "sample.bin"), Found reference to API (Indicator: "CompareStringA"; Source: "sample.bin"), Found reference to API (Indicator: "WriteFile"; Source: "sample.bin"), Found reference to API (Indicator: "Sleep"; Source: "sample.bin"), Found reference to API (Indicator: "LoadStringA"; Source: "sample.bin"), Found reference to API (Indicator: "LoadResource"; Source: "sample.bin"), Found reference to API (Indicator: "TerminateProcess"; Source: "sample.bin"), Found reference to API (Indicator: "CreateProcessA"; Source: "sample.bin"), Found reference to API (Indicator: "FreeLibrary"; Source: "sample.bin"), Found reference to API (Indicator: "SHGetPathFromIDList"; Source: "sample.bin"), Found reference to API (Indicator: "RegCreateKeyExA"; Source: "sample.bin"), Found reference to API (Indicator: "MessageBeep"; Source: "sample.bin"), Found reference to API (Indicator: "FindNextFileA"; Source: "sample.bin"), Found reference to API (Indicator: "SetWindowLongA"; Source: "sample.bin"), Found reference to API (Indicator: "ReadFile"; Source: "sample.bin"), Found reference to API (Indicator: "CallWindowProcA"; Source: "sample.bin"), Found reference to API (Indicator: "OpenProcessToken"; Source: "sample.bin"), Found reference to API (Indicator: "ExitWindowsEx"; Source: "sample.bin"), Found reference to API (Indicator: "GetTempFileNameA"; Source: "sample.bin"), Found reference to API (Indicator: "GetVersion"; Source: "sample.bin"), Found reference to API (Indicator: "GetLastError"; Source: "sample.bin"), Found reference to API (Indicator: "LockResource"; Source: "sample.bin"), Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "sample.bin"), Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "sample.bin"), Found reference to API (Indicator: "GetSystemMetrics"; Source: "sample.bin"), Found reference to API (Indicator: "WaitForSingleObject"; Source: "sample.bin"), Found reference to API (Indicator: "CloseHandle"; Source: "sample.bin"), Found reference to API (Indicator: "FindResourceA"; Source: "sample.bin")28:T490,"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" called "FindResourceA" with parameter "12260048" - (UID: 00000000-00004372) "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" called "FindResourceA" with parameter "12260088" - (UID: 00000000-00004372) "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" called "FindResourceA" with parameter "12260104" - (UID: 00000000-00004372) "sk2Qt47.exe" called "FindResourceA" with parameter "11408204" - (UID: 00000000-00003464) "sk2Qt47.exe" called "FindResourceA" with parameter "1963488" - (UID: 00000000-00003464) "sk2Qt47.exe" called "FindResourceA" with parameter "11408072" - (UID: 00000000-00003464) "sk2Qt47.exe" called "FindResourceA" with parameter "11408080" - (UID: 00000000-00003464) "sk2Qt47.exe" called "FindResourceA" with parameter "11408108" - (UID: 00000000-00003464) "sk2Qt47.exe" called "FindResourceA" with parameter "11408120" - (UID: 00000000-00003464) "sk2Qt47.exe" called "FindResourceA" with parameter "11408136" - (UID: 00000000-00003464) "ck0rG18.exe" called "FindResourceA" with parameter "2429648" - (UID: 00000000-00004112)29:T915,"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12306544'}" (UID: 00000000-00004372) "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12306496'}" (UID: 00000000-00004372) "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '12306448'}" (UID: 00000000-00004372) "sk2Qt47.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11454432'}" (UID: 00000000-00003464) "sk2Qt47.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11454544'}" (UID: 00000000-00003464) "sk2Qt47.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11454576'}" (UID: 00000000-00003464) "sk2Qt47.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11454560'}" (UID: 00000000-00003464) "sk2Qt47.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11454528'}" (UID: 00000000-00003464) "sk2Qt47.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '11454480'}" (UID: 00000000-00003464) "ck0rG18.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2476144'}" (UID: 00000000-00004112) "ck0rG18.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2476096'}" (UID: 00000000-00004112) "ck0rG18.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '2476048'}" (UID: 00000000-00004112) "rq7SB75.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1296496'}" (UID: 00000000-00003480) "rq7SB75.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1296448'}" (UID: 00000000-00003480) "rq7SB75.exe" called "LoadResource with parameter {'hModule': '0', 'hResInfo': '1296400'}" (UID: 00000000-00003480) "AppLaunch.exe" called "LoadResource with parameter {'hModule': '1578958848', 'hResInfo': '1579999608'}" (UID: 00000000-00003544) "AppLaunch.exe" called "LoadResource with parameter {'hModule': '1578958848', 'hResInfo': '1579999592'}" (UID: 00000000-00003544) "4Ut221ym.exe" called "LoadResource with parameter {'hModule': '1871446016', 'hResInfo': '1871622664'}" (UID: 00000000-00000848)2a:T5af,Found reference to API "IOpenServiceManager" (Indicator: "OpenService"; Source: "00000000-00000848.00000001.84524.72571000.00000020.mdmp") Found reference to API "IOpenServiceActivity" (Indicator: "OpenService"; Source: "00000000-00000848.00000001.84524.72571000.00000020.mdmp") Found reference to API "IOpenServiceActivityManager" (Indicator: "OpenService"; Source: "00000000-00000848.00000001.84524.72571000.00000020.mdmp") Found reference to API "IOpenServiceActivityOutputContext" (Indicator: "OpenService"; Source: "00000000-00000848.00000001.84524.72571000.00000020.mdmp") Found reference to API "IOpenServiceActivityInput" (Indicator: "OpenService"; Source: "00000000-00000848.00000001.84524.72571000.00000020.mdmp") Found reference to API "IOpenService" (Indicator: "OpenService"; Source: "00000000-00000848.00000001.84524.72571000.00000020.mdmp") Found reference to API "IEnumOpenServiceActivity" (Indicator: "OpenService"; Source: "00000000-00000848.00000001.84524.72571000.00000020.mdmp") Found reference to API "IOpenServiceActivityCategory" (Indicator: "OpenService"; Source: "00000000-00000848.00000001.84524.72571000.00000020.mdmp") Found reference to API "IEnumOpenServiceActivityCategory" (Indicator: "OpenService"; Source: "00000000-00000848.00000001.84524.72571000.00000020.mdmp") Found reference to API "IOpenServiceManagerInternal" (Indicator: "OpenService"; Source: "00000000-00000848.00000001.84524.72571000.00000020.mdmp")2b:T4ad,Found reference to "AesGcm256" (Indicator: "Aes"; File: "00003544.00000DD8.675446.00402000.wprm") Found reference to "AesGcm256" (Indicator: "AesGcm"; File: "00003544.00000DD8.675446.00402000.wprm") Found reference to "AesFastEngine" (Indicator: "Aes"; File: "00003544.00000DD8.675446.00402000.wprm") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "00003544.00000DD8.675446.00402000.wprm") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "00003544.00000DD8.675446.00402000.wprm") Found reference to "AesGcm256" (Indicator: "Aes"; Source: "00000000-00000384.00000000.81924.0110A000.00000004.mdmp") Found reference to "AesGcm256" (Indicator: "AesGcm"; Source: "00000000-00000384.00000000.81924.0110A000.00000004.mdmp") Found reference to "AesFastEngine" (Indicator: "Aes"; Source: "00000000-00000384.00000000.81924.0110A000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00000384.00000000.81924.0110A000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00000384.00000000.81924.0110A000.00000004.mdmp")2c:T637,"4Ut221ym.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCSERVER32") "4Ut221ym.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCSERVER32") "4Ut221ym.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCSERVER32") "4Ut221ym.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCSERVER32") "4Ut221ym.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCHANDLER32") "4Ut221ym.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCHANDLER32") "4Ut221ym.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCHANDLER") "4Ut221ym.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\INPROCHANDLER") "4Ut221ym.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "4Ut221ym.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "4Ut221ym.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "4Ut221ym.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\SHELL\REGISTEREDAPPLICATIONS\URLASSOCIATIONS\HTTPS\OPENWITHPROGIDS") "4Ut221ym.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\SHELL\ASSOCIATIONS\URLASSOCIATIONS\HTTPS")2d:T474,SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004112-30330-7-00256F40 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004112-30330-10-00256CF0 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002040-31486-13-00D3568F SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002040-31486-93-00D396E3 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002040-31486-519-00D35992 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002040-31486-1213-00D35AF4 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00000384-41559-13-010E568F SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00000384-41559-93-010E96E3 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00000384-41559-519-010E5992 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00000384-41559-1213-010E5AF4 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005084-56128-13-00EA568F SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005084-56128-93-00EA96E3 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005084-56128-519-00EA5992 SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00005084-56128-1213-00EA5AF42e:T131e,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004112-30330-15-00251F90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004112-30330-15-00251F90 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004112-30330-16-002544B9 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004112-30330-16-002544B9 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004112-30330-22-0025681F Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004112-30330-22-0025681F Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004112-30330-26-002524E0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004112-30330-26-002524E0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004112-30330-29-002552B6 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004112-30330-29-002552B6 Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004112-30330-31-00252390 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004112-30330-31-00252390 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004112-30330-33-00252F1D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004112-30330-33-00252F1D Assembly shows XOR instruction xor eax esp in Stream UID: 00000000-00004112-30330-36-00253BA2 Assembly shows XOR instruction xor ecx esp in Stream UID: 00000000-00004112-30330-36-00253BA2 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004112-30330-37-00253FEF Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004112-30330-37-00253FEF Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004112-30330-40-00252267 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004112-30330-40-00252267 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004112-30330-41-00256495 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004112-30330-41-00256495 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004112-30330-42-0025202A Assembly shows XOR instruction xor eax 01h in Stream UID: 00000000-00004112-30330-42-0025202A Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004112-30330-42-0025202A Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004112-30330-43-00251AE8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004112-30330-43-00251AE8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004112-30330-44-00252AAC Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004112-30330-44-00252AAC Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004112-30330-52-00254EFD Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004112-30330-52-00254EFD Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004112-30330-57-00256298 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004112-30330-57-00256298 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004112-30330-59-0025621E Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004112-30330-59-0025621E Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004112-30330-60-0025597D Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004112-30330-60-0025597D Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004112-30330-62-002555A0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004112-30330-62-002555A0 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004112-30330-63-00255467 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004112-30330-63-00255467 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004112-30330-65-002553A1 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004112-30330-65-002553A1 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004112-30330-66-00252630 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004112-30330-66-00252630 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004112-30330-71-00252CAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004112-30330-71-00252CAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004112-30330-72-002518A3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004112-30330-72-002518A3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00004112-30330-73-002517EE Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00004112-30330-73-002517EE2f:T507a,Contains base64 string in header "2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "2FUsCEHe9DWzbNvka6iEPxPBY0w0" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "User" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "ocsp" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "goog" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/oBFYYahzgVI" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/75r4ZyA3vA0" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/9UVbN0w5E6Y" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "digicert" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base64 string in header "Keep" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/gsr1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/we1/pl4XiTjSDSk" in header "GET /we1/pl4XiTjSDSk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we1/pl4XiTjSDSk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we1/pl4XiTjSDSk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we1/pl4XiTjSDSk.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/we1/G0k" in header "GET /we1/G0k-BqpOX8k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we1/G0k-BqpOX8k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we1/G0k-BqpOX8k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we1/G0k-BqpOX8k.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we1/x6Eg-8TSwUw.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we1/x6Eg-8TSwUw.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we1/x6Eg-8TSwUw.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /rootg2.cer HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crt.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /rootg2.cer HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crt.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /rootg2.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /rootg2.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base64 string in header "/rootca1" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "Keep" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "User" in header "GET /rootca1.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.rootca1.amazontrust.com" Contains base64 string in header "/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "2BsKuKwH5CO65xMY" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "User" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base64 string in header "Keep" in header "GET /r2m04.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.r2m04.amazontrust.com" Contains base64 string in header "User" in header "GET /r2m04.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: crl.r2m04.amazontrust.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com" Contains base64 string in header "/we2/yK5nPhtHKQs" in header "GET /we2/yK5nPhtHKQs.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we2/yK5nPhtHKQs.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we2/yK5nPhtHKQs.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we2/yK5nPhtHKQs.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/oQ6nyr8F0m0" in header "GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/oBFYYahzgVI" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 02 Sep 2026 17:50:26 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 02 Sep 2026 17:50:26 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 02 Sep 2026 17:50:26 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 02 Sep 2026 17:50:26 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/oBFYYahzgVI.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 02 Sep 2026 17:50:26 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/75r4ZyA3vA0" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 02 Sep 2026 20:45:44 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 02 Sep 2026 20:45:44 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 02 Sep 2026 20:45:44 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 02 Sep 2026 20:45:44 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 02 Sep 2026 20:45:44 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/wr2/9UVbN0w5E6Y" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 02 Sep 2026 19:20:16 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 02 Sep 2026 19:20:16 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 02 Sep 2026 19:20:16 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 02 Sep 2026 19:20:16 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Wed, 02 Sep 2026 19:20:16 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 31 Aug 2026 08:08:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Modified" in header "GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 31 Aug 2026 08:08:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "2026" in header "GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 31 Aug 2026 08:08:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/gsr1.crl HTTP/1.1Cache-Control: max-age = 3000Connection: Keep-AliveAccept: */*If-Modified-Since: Mon, 31 Aug 2026 08:08:00 GMTUser-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog"30:T46b,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Decrypted SSL network traffic Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to decode base64 data Matched sigs: Contains reference to crypto DLLs Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Contains XOR operation loops [Stream disassembly]31:T6e7a,Found XOR loop in file "1Ta10aM7.exe" at offset 16372; code bytes = 30d0 Found XOR loop in file "1Ta10aM7.exe" at offset 16389; code bytes = 30d0 Found XOR loop in file "1Ta10aM7.exe" at offset 16406; code bytes = 30d0 Found XOR loop in file "1Ta10aM7.exe" at offset 34753; code bytes = 30d0 Found XOR loop in file "1Ta10aM7.exe" at offset 50206; code bytes = 30d0 Found XOR loop in file "1Ta10aM7.exe" at offset 62081; code bytes = 30d0 Found XOR loop in file "1Ta10aM7.exe" at offset 1182805; code bytes = 30d0 Found XOR loop in file "1Ta10aM7.exe" at offset 1183213; code bytes = 30d0 Found XOR loop in file "1Ta10aM7.exe" at offset 1186125; code bytes = 30d0 Found XOR loop in file "1Ta10aM7.exe" at offset 1187773; code bytes = 30d0 Found XOR loop in file "1Ta10aM7.exe" at offset 1188423; code bytes = 30d0 Found XOR loop in file "1Ta10aM7.exe" at offset 1718285; code bytes = 30d0 Found XOR loop in file "1Ta10aM7.exe" at offset 1718719; code bytes = 30d0 Found XOR loop in file "1Ta10aM7.exe" at offset 5981; code bytes = 33c1 Found XOR loop in file "1Ta10aM7.exe" at offset 6092; code bytes = 33c1 Found XOR loop in file "1Ta10aM7.exe" at offset 19669; code bytes = 33c1 Found XOR loop in file "1Ta10aM7.exe" at offset 21051; code bytes = 33c1 Found XOR loop in file "1Ta10aM7.exe" at offset 1713365; code bytes = 33c1 Found XOR loop in file "1Ta10aM7.exe" at offset 1714953; code bytes = 33c1 Found XOR loop in file "1Ta10aM7.exe" at offset 16033; code bytes = 8030 Found XOR loop in file "1Ta10aM7.exe" at offset 138008; code bytes = 8030 Found XOR loop in file "1Ta10aM7.exe" at offset 142668; code bytes = 8030 Found XOR loop in file "1Ta10aM7.exe" at offset 155018; code bytes = 8030 Found XOR loop in file "1Ta10aM7.exe" at offset 1714310; code bytes = 8030 Found XOR loop in file "1Ta10aM7.exe" at offset 1716196; code bytes = 8030 Found XOR loop in file "1Ta10aM7.exe" at offset 1722019; code bytes = 8030 Found XOR loop in file "1Ta10aM7.exe" at offset 1723235; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 342460; code bytes = 30d0 Found XOR loop in file "sk2Qt47.exe" at offset 379601; code bytes = 30d0 Found XOR loop in file "sk2Qt47.exe" at offset 400158; code bytes = 30d0 Found XOR loop in file "sk2Qt47.exe" at offset 408551; code bytes = 30d0 Found XOR loop in file "sk2Qt47.exe" at offset 521371; code bytes = 30d0 Found XOR loop in file "sk2Qt47.exe" at offset 529014; code bytes = 30d0 Found XOR loop in file "sk2Qt47.exe" at offset 541290; code bytes = 30d0 Found XOR loop in file "sk2Qt47.exe" at offset 594136; code bytes = 30d0 Found XOR loop in file "sk2Qt47.exe" at offset 776627; code bytes = 30d0 Found XOR loop in file "sk2Qt47.exe" at offset 814187; code bytes = 30d0 Found XOR loop in file "sk2Qt47.exe" at offset 880186; code bytes = 30d0 Found XOR loop in file "sk2Qt47.exe" at offset 893719; code bytes = 30d0 Found XOR loop in file "sk2Qt47.exe" at offset 897426; code bytes = 30d0 Found XOR loop in file "sk2Qt47.exe" at offset 950097; code bytes = 30d0 Found XOR loop in file "sk2Qt47.exe" at offset 1008708; code bytes = 30d0 Found XOR loop in file "sk2Qt47.exe" at offset 1037688; code bytes = 30d0 Found XOR loop in file "sk2Qt47.exe" at offset 1080265; code bytes = 30d0 Found XOR loop in file "sk2Qt47.exe" at offset 1207040; code bytes = 30d0 Found XOR loop in file "sk2Qt47.exe" at offset 1255206; code bytes = 30d0 Found XOR loop in file "sk2Qt47.exe" at offset 1298750; code bytes = 30d0 Found XOR loop in file "sk2Qt47.exe" at offset 1535335; code bytes = 30d0 Found XOR loop in file "sk2Qt47.exe" at offset 1546670; code bytes = 30d0 Found XOR loop in file "sk2Qt47.exe" at offset 1585749; code bytes = 30d0 Found XOR loop in file "sk2Qt47.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "sk2Qt47.exe" at offset 226549; code bytes = 33c1 Found XOR loop in file "sk2Qt47.exe" at offset 238709; code bytes = 33c1 Found XOR loop in file "sk2Qt47.exe" at offset 277091; code bytes = 33c1 Found XOR loop in file "sk2Qt47.exe" at offset 371208; code bytes = 33c1 Found XOR loop in file "sk2Qt47.exe" at offset 386395; code bytes = 33c1 Found XOR loop in file "sk2Qt47.exe" at offset 546040; code bytes = 33c1 Found XOR loop in file "sk2Qt47.exe" at offset 628153; code bytes = 33c1 Found XOR loop in file "sk2Qt47.exe" at offset 667849; code bytes = 33c1 Found XOR loop in file "sk2Qt47.exe" at offset 685862; code bytes = 33c1 Found XOR loop in file "sk2Qt47.exe" at offset 697742; code bytes = 33c1 Found XOR loop in file "sk2Qt47.exe" at offset 775939; code bytes = 33c1 Found XOR loop in file "sk2Qt47.exe" at offset 1042997; code bytes = 33c1 Found XOR loop in file "sk2Qt47.exe" at offset 1102373; code bytes = 33c1 Found XOR loop in file "sk2Qt47.exe" at offset 1233417; code bytes = 33c1 Found XOR loop in file "sk2Qt47.exe" at offset 1297061; code bytes = 33c1 Found XOR loop in file "sk2Qt47.exe" at offset 1438671; code bytes = 33c1 Found XOR loop in file "sk2Qt47.exe" at offset 1477161; code bytes = 33c1 Found XOR loop in file "sk2Qt47.exe" at offset 1521953; code bytes = 33c1 Found XOR loop in file "sk2Qt47.exe" at offset 1527642; code bytes = 33c1 Found XOR loop in file "sk2Qt47.exe" at offset 1604537; code bytes = 33c1 Found XOR loop in file "sk2Qt47.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 213527; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 310425; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 344122; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 351816; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 406110; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 482211; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 503905; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 514862; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 567118; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 575257; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 673540; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 693969; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 715100; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 743463; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 766543; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 811027; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 892714; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 922588; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 1005248; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 1130953; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 1145075; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 1328105; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 1422235; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 1486042; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 1548242; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 1586692; code bytes = 8030 Found XOR loop in file "sk2Qt47.exe" at offset 1592559; code bytes = 8030 Found XOR loop in file "ck0rG18.exe" at offset 246925; code bytes = 30d0 Found XOR loop in file "ck0rG18.exe" at offset 284042; code bytes = 30d0 Found XOR loop in file "ck0rG18.exe" at offset 304591; code bytes = 30d0 Found XOR loop in file "ck0rG18.exe" at offset 312984; code bytes = 30d0 Found XOR loop in file "ck0rG18.exe" at offset 425746; code bytes = 30d0 Found XOR loop in file "ck0rG18.exe" at offset 433381; code bytes = 30d0 Found XOR loop in file "ck0rG18.exe" at offset 445657; code bytes = 30d0 Found XOR loop in file "ck0rG18.exe" at offset 498470; code bytes = 30d0 Found XOR loop in file "ck0rG18.exe" at offset 680873; code bytes = 30d0 Found XOR loop in file "ck0rG18.exe" at offset 718425; code bytes = 30d0 Found XOR loop in file "ck0rG18.exe" at offset 784392; code bytes = 30d0 Found XOR loop in file "ck0rG18.exe" at offset 797917; code bytes = 30d0 Found XOR loop in file "ck0rG18.exe" at offset 801608; code bytes = 30d0 Found XOR loop in file "ck0rG18.exe" at offset 854263; code bytes = 30d0 Found XOR loop in file "ck0rG18.exe" at offset 912850; code bytes = 30d0 Found XOR loop in file "ck0rG18.exe" at offset 941805; code bytes = 30d0 Found XOR loop in file "ck0rG18.exe" at offset 984366; code bytes = 30d0 Found XOR loop in file "ck0rG18.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "ck0rG18.exe" at offset 143215; code bytes = 33c1 Found XOR loop in file "ck0rG18.exe" at offset 181589; code bytes = 33c1 Found XOR loop in file "ck0rG18.exe" at offset 275649; code bytes = 33c1 Found XOR loop in file "ck0rG18.exe" at offset 290836; code bytes = 33c1 Found XOR loop in file "ck0rG18.exe" at offset 450407; code bytes = 33c1 Found XOR loop in file "ck0rG18.exe" at offset 532479; code bytes = 33c1 Found XOR loop in file "ck0rG18.exe" at offset 572151; code bytes = 33c1 Found XOR loop in file "ck0rG18.exe" at offset 590156; code bytes = 33c1 Found XOR loop in file "ck0rG18.exe" at offset 602036; code bytes = 33c1 Found XOR loop in file "ck0rG18.exe" at offset 680185; code bytes = 33c1 Found XOR loop in file "ck0rG18.exe" at offset 947114; code bytes = 33c1 Found XOR loop in file "ck0rG18.exe" at offset 1006457; code bytes = 33c1 Found XOR loop in file "ck0rG18.exe" at offset 1114553; code bytes = 33c1 Found XOR loop in file "ck0rG18.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "ck0rG18.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "ck0rG18.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "ck0rG18.exe" at offset 214898; code bytes = 8030 Found XOR loop in file "ck0rG18.exe" at offset 248587; code bytes = 8030 Found XOR loop in file "ck0rG18.exe" at offset 256281; code bytes = 8030 Found XOR loop in file "ck0rG18.exe" at offset 310543; code bytes = 8030 Found XOR loop in file "ck0rG18.exe" at offset 386611; code bytes = 8030 Found XOR loop in file "ck0rG18.exe" at offset 408280; code bytes = 8030 Found XOR loop in file "ck0rG18.exe" at offset 419237; code bytes = 8030 Found XOR loop in file "ck0rG18.exe" at offset 471460; code bytes = 8030 Found XOR loop in file "ck0rG18.exe" at offset 479599; code bytes = 8030 Found XOR loop in file "ck0rG18.exe" at offset 577842; code bytes = 8030 Found XOR loop in file "ck0rG18.exe" at offset 598263; code bytes = 8030 Found XOR loop in file "ck0rG18.exe" at offset 619378; code bytes = 8030 Found XOR loop in file "ck0rG18.exe" at offset 647733; code bytes = 8030 Found XOR loop in file "ck0rG18.exe" at offset 670789; code bytes = 8030 Found XOR loop in file "ck0rG18.exe" at offset 715265; code bytes = 8030 Found XOR loop in file "ck0rG18.exe" at offset 796912; code bytes = 8030 Found XOR loop in file "ck0rG18.exe" at offset 826762; code bytes = 8030 Found XOR loop in file "ck0rG18.exe" at offset 909390; code bytes = 8030 Found XOR loop in file "ck0rG18.exe" at offset 1035029; code bytes = 8030 Found XOR loop in file "ck0rG18.exe" at offset 1049143; code bytes = 8030 Found XOR loop in file "rq7SB75.exe" at offset 171043; code bytes = 30d0 Found XOR loop in file "rq7SB75.exe" at offset 217905; code bytes = 30d0 Found XOR loop in file "rq7SB75.exe" at offset 330533; code bytes = 30d0 Found XOR loop in file "rq7SB75.exe" at offset 338168; code bytes = 30d0 Found XOR loop in file "rq7SB75.exe" at offset 374671; code bytes = 30d0 Found XOR loop in file "rq7SB75.exe" at offset 585618; code bytes = 30d0 Found XOR loop in file "rq7SB75.exe" at offset 623138; code bytes = 30d0 Found XOR loop in file "rq7SB75.exe" at offset 689072; code bytes = 30d0 Found XOR loop in file "rq7SB75.exe" at offset 702597; code bytes = 30d0 Found XOR loop in file "rq7SB75.exe" at offset 706288; code bytes = 30d0 Found XOR loop in file "rq7SB75.exe" at offset 758910; code bytes = 30d0 Found XOR loop in file "rq7SB75.exe" at offset 817472; code bytes = 30d0 Found XOR loop in file "rq7SB75.exe" at offset 846419; code bytes = 30d0 Found XOR loop in file "rq7SB75.exe" at offset 888948; code bytes = 30d0 Found XOR loop in file "rq7SB75.exe" at offset 26031; code bytes = 33c1 Found XOR loop in file "rq7SB75.exe" at offset 395641; code bytes = 33c1 Found XOR loop in file "rq7SB75.exe" at offset 437289; code bytes = 33c1 Found XOR loop in file "rq7SB75.exe" at offset 476937; code bytes = 33c1 Found XOR loop in file "rq7SB75.exe" at offset 494934; code bytes = 33c1 Found XOR loop in file "rq7SB75.exe" at offset 506814; code bytes = 33c1 Found XOR loop in file "rq7SB75.exe" at offset 584930; code bytes = 33c1 Found XOR loop in file "rq7SB75.exe" at offset 851728; code bytes = 33c1 Found XOR loop in file "rq7SB75.exe" at offset 911039; code bytes = 33c1 Found XOR loop in file "rq7SB75.exe" at offset 976735; code bytes = 33c1 Found XOR loop in file "rq7SB75.exe" at offset 988089; code bytes = 33c1 Found XOR loop in file "rq7SB75.exe" at offset 90891; code bytes = 8030 Found XOR loop in file "rq7SB75.exe" at offset 102399; code bytes = 8030 Found XOR loop in file "rq7SB75.exe" at offset 103104; code bytes = 8030 Found XOR loop in file "rq7SB75.exe" at offset 150954; code bytes = 8030 Found XOR loop in file "rq7SB75.exe" at offset 230648; code bytes = 8030 Found XOR loop in file "rq7SB75.exe" at offset 251084; code bytes = 8030 Found XOR loop in file "rq7SB75.exe" at offset 270874; code bytes = 8030 Found XOR loop in file "rq7SB75.exe" at offset 291414; code bytes = 8030 Found XOR loop in file "rq7SB75.exe" at offset 313075; code bytes = 8030 Found XOR loop in file "rq7SB75.exe" at offset 324032; code bytes = 8030 Found XOR loop in file "rq7SB75.exe" at offset 482628; code bytes = 8030 Found XOR loop in file "rq7SB75.exe" at offset 503041; code bytes = 8030 Found XOR loop in file "rq7SB75.exe" at offset 524156; code bytes = 8030 Found XOR loop in file "rq7SB75.exe" at offset 552486; code bytes = 8030 Found XOR loop in file "rq7SB75.exe" at offset 575534; code bytes = 8030 Found XOR loop in file "rq7SB75.exe" at offset 619986; code bytes = 8030 Found XOR loop in file "rq7SB75.exe" at offset 701592; code bytes = 8030 Found XOR loop in file "rq7SB75.exe" at offset 731434; code bytes = 8030 Found XOR loop in file "rq7SB75.exe" at offset 814012; code bytes = 8030 Found XOR loop in file "rq7SB75.exe" at offset 938418; code bytes = 8030 Found XOR loop in file "rq7SB75.exe" at offset 958708; code bytes = 8030 Found XOR loop in file "rq7SB75.exe" at offset 972793; code bytes = 8030 Found XOR loop in file "4Ut221ym.exe" at offset 72323; code bytes = 30d0 Found XOR loop in file "4Ut221ym.exe" at offset 122082; code bytes = 30d0 Found XOR loop in file "4Ut221ym.exe" at offset 376916; code bytes = 30d0 Found XOR loop in file "4Ut221ym.exe" at offset 376937; code bytes = 30d0 Found XOR loop in file "4Ut221ym.exe" at offset 691258; code bytes = 30d0 Found XOR loop in file "4Ut221ym.exe" at offset 887915; code bytes = 30d0 Found XOR loop in file "4Ut221ym.exe" at offset 888929; code bytes = 30d0 Found XOR loop in file "4Ut221ym.exe" at offset 891921; code bytes = 30d0 Found XOR loop in file "4Ut221ym.exe" at offset 900833; code bytes = 30d0 Found XOR loop in file "4Ut221ym.exe" at offset 913601; code bytes = 30d0 Found XOR loop in file "4Ut221ym.exe" at offset 130790; code bytes = 33c1 Found XOR loop in file "4Ut221ym.exe" at offset 140043; code bytes = 33c1 Found XOR loop in file "4Ut221ym.exe" at offset 140172; code bytes = 33c1 Found XOR loop in file "4Ut221ym.exe" at offset 351053; code bytes = 33c1 Found XOR loop in file "4Ut221ym.exe" at offset 463773; code bytes = 33c1 Found XOR loop in file "4Ut221ym.exe" at offset 463848; code bytes = 33c1 Found XOR loop in file "4Ut221ym.exe" at offset 597022; code bytes = 33c1 Found XOR loop in file "4Ut221ym.exe" at offset 701978; code bytes = 33c1 Found XOR loop in file "4Ut221ym.exe" at offset 709317; code bytes = 33c1 Found XOR loop in file "4Ut221ym.exe" at offset 709765; code bytes = 33c1 Found XOR loop in file "4Ut221ym.exe" at offset 710341; code bytes = 33c1 Found XOR loop in file "4Ut221ym.exe" at offset 710789; code bytes = 33c1 Found XOR loop in file "4Ut221ym.exe" at offset 895349; code bytes = 33c1 Found XOR loop in file "4Ut221ym.exe" at offset 905289; code bytes = 33c1 Found XOR loop in file "4Ut221ym.exe" at offset 1330; code bytes = 8030 Found XOR loop in file "4Ut221ym.exe" at offset 1959; code bytes = 8030 Found XOR loop in file "4Ut221ym.exe" at offset 232120; code bytes = 8030 Found XOR loop in file "4Ut221ym.exe" at offset 356589; code bytes = 8030 Found XOR loop in file "4Ut221ym.exe" at offset 674772; code bytes = 8030 Found XOR loop in file "4Ut221ym.exe" at offset 687130; code bytes = 8030 Found XOR loop in file "4Ut221ym.exe" at offset 887876; code bytes = 8030 Found XOR loop in file "4Ut221ym.exe" at offset 890824; code bytes = 8030 Found XOR loop in file "4Ut221ym.exe" at offset 894056; code bytes = 8030 Found XOR loop in file "4Ut221ym.exe" at offset 913562; code bytes = 8030 Found XOR loop in file "2Dc2225.exe" at offset 16372; code bytes = 30d0 Found XOR loop in file "2Dc2225.exe" at offset 16389; code bytes = 30d0 Found XOR loop in file "2Dc2225.exe" at offset 16406; code bytes = 30d0 Found XOR loop in file "2Dc2225.exe" at offset 34753; code bytes = 30d0 Found XOR loop in file "2Dc2225.exe" at offset 50206; code bytes = 30d0 Found XOR loop in file "2Dc2225.exe" at offset 62081; code bytes = 30d0 Found XOR loop in file "2Dc2225.exe" at offset 403469; code bytes = 30d0 Found XOR loop in file "2Dc2225.exe" at offset 403903; code bytes = 30d0 Found XOR loop in file "2Dc2225.exe" at offset 5981; code bytes = 33c1 Found XOR loop in file "2Dc2225.exe" at offset 6092; code bytes = 33c1 Found XOR loop in file "2Dc2225.exe" at offset 19669; code bytes = 33c1 Found XOR loop in file "2Dc2225.exe" at offset 21051; code bytes = 33c1 Found XOR loop in file "2Dc2225.exe" at offset 398549; code bytes = 33c1 Found XOR loop in file "2Dc2225.exe" at offset 400137; code bytes = 33c1 Found XOR loop in file "2Dc2225.exe" at offset 16033; code bytes = 8030 Found XOR loop in file "2Dc2225.exe" at offset 138008; code bytes = 8030 Found XOR loop in file "2Dc2225.exe" at offset 142668; code bytes = 8030 Found XOR loop in file "2Dc2225.exe" at offset 155018; code bytes = 8030 Found XOR loop in file "2Dc2225.exe" at offset 399494; code bytes = 8030 Found XOR loop in file "2Dc2225.exe" at offset 401380; code bytes = 8030 Found XOR loop in file "2Dc2225.exe" at offset 407203; code bytes = 8030 Found XOR loop in file "2Dc2225.exe" at offset 408419; code bytes = 8030 Found XOR loop in file "5sD6MZ0.exe" at offset 16372; code bytes = 30d0 Found XOR loop in file "5sD6MZ0.exe" at offset 16389; code bytes = 30d0 Found XOR loop in file "5sD6MZ0.exe" at offset 16406; code bytes = 30d0 Found XOR loop in file "5sD6MZ0.exe" at offset 34753; code bytes = 30d0 Found XOR loop in file "5sD6MZ0.exe" at offset 50206; code bytes = 30d0 Found XOR loop in file "5sD6MZ0.exe" at offset 62081; code bytes = 30d0 Found XOR loop in file "5sD6MZ0.exe" at offset 174677; code bytes = 30d0 Found XOR loop in file "5sD6MZ0.exe" at offset 183951; code bytes = 30d0 Found XOR loop in file "5sD6MZ0.exe" at offset 191439; code bytes = 30d0 Found XOR loop in file "5sD6MZ0.exe" at offset 194262; code bytes = 30d0 Found XOR loop in file "5sD6MZ0.exe" at offset 216589; code bytes = 30d0 Found XOR loop in file "5sD6MZ0.exe" at offset 217023; code bytes = 30d0 Found XOR loop in file "5sD6MZ0.exe" at offset 5981; code bytes = 33c1 Found XOR loop in file "5sD6MZ0.exe" at offset 6092; code bytes = 33c1 Found XOR loop in file "5sD6MZ0.exe" at offset 19669; code bytes = 33c1 Found XOR loop in file "5sD6MZ0.exe" at offset 21051; code bytes = 33c1 Found XOR loop in file "5sD6MZ0.exe" at offset 185066; code bytes = 33c1 Found XOR loop in file "5sD6MZ0.exe" at offset 211669; code bytes = 33c1 Found XOR loop in file "5sD6MZ0.exe" at offset 213257; code bytes = 33c1 Found XOR loop in file "5sD6MZ0.exe" at offset 16033; code bytes = 8030 Found XOR loop in file "5sD6MZ0.exe" at offset 138008; code bytes = 8030 Found XOR loop in file "5sD6MZ0.exe" at offset 142668; code bytes = 8030 Found XOR loop in file "5sD6MZ0.exe" at offset 155018; code bytes = 8030 Found XOR loop in file "5sD6MZ0.exe" at offset 198676; code bytes = 8030 Found XOR loop in file "5sD6MZ0.exe" at offset 212614; code bytes = 8030 Found XOR loop in file "5sD6MZ0.exe" at offset 214500; code bytes = 8030 Found XOR loop in file "5sD6MZ0.exe" at offset 220323; code bytes = 8030 Found XOR loop in file "5sD6MZ0.exe" at offset 221539; code bytes = 8030 Found XOR loop in file "FANBooster131.exe" at offset 86019; code bytes = 30d0 Found XOR loop in file "3vO15kf.exe" at offset 1293; code bytes = 30d0 Found XOR loop in file "3vO15kf.exe" at offset 1173; code bytes = 8030 Found XOR loop in file "3vO15kf.exe" at offset 24690; code bytes = 8030 Found XOR loop in file "OfficeTrackerNMP131.exe" at offset 86019; code bytes = 30d0 Found XOR loop in file "MaxLoonaFest131.exe" at offset 86019; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 165676; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 168000; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 288507; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 438375; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 475524; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 496089; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 504498; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 617359; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 625010; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 637303; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 690165; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 872747; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 910332; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 976363; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 989904; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 993611; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1046307; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1104951; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1133939; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1176540; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1303380; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1351562; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1395131; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1631837; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1643180; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1682267; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1755254; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 26031; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 223391; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 230509; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 252539; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 322399; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 334567; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 372973; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 467131; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 482318; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 642053; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 724207; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 763928; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 781941; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 793829; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 872059; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1139248; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1198656; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1329765; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1393442; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1535117; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1573639; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1618455; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1624144; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1703644; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1713265; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1733559; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1785907; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1825209; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 90891; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 102399; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 103104; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 144046; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 203845; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 214902; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 264905; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 309377; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 406315; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 440037; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 447731; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 502057; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 578191; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 599893; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 610850; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 663139; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 671278; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 769619; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 790056; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 811187; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 839575; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 862663; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 907172; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 988899; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1018781; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1101491; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1227261; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1241383; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1424511; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1518681; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1582520; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1644752; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1683226; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1689093; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1752551; code bytes = 803032:T425,file/memory contains long string with (Indicator: "youtube.com"; File: "supported_browsers_1_.htm") file/memory contains long string with (Indicator: "youtube.com"; File: "EKZM8SMB.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "31XN25R7.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "1166XN53.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "908MRENR.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "249P27QL.txt") file/memory contains long string with (Indicator: "youtube.com"; File: "QX6WCDG2.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube.com"; File: "CJANLBKS.txt") Found string "accounts.youtube.com" (Indicator: "youtube.com"; File: "PCAP") Found string "www.paypal.com" (Indicator: "paypal.com"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube.com"; File: "PCAP") file/memory contains long string with (Indicator: "youtube.com"; File: "SSL")33:T60d,file/memory contains long string with (Indicator: "GetCommandLine"; File: "5sD6MZ0.exe") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "00004036.00000FC4.489261.00537000.wprm") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "00004036.00000FC4.489261.00537000.wprm") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "00003544.00000DD8.675446.00402000.wprm") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00000384.00000000.81924.0110A000.00000004.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000384.00000000.81930.010FD000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000384.00000000.81930.010FD000.00000002.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002040.00000000.81585.00D4D000.00000002.mdmp, 00000000-00002040.00000000.81585.00D5A000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002040.00000000.81585.00D4D000.00000002.mdmp, 00000000-00002040.00000000.81585.00D5A000.00000004.mdmp")34:Tcd0,Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; File: "00000000-00002040.00000000.81585.00D31000.00000020.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; File: "00000000-00002040.00000000.81585.00D31000.00000020.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; File: "00000000-00002040.00000000.81585.00D31000.00000020.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "00004036.00000FC4.489261.00537000.wprm") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "00004036.00000FC4.489261.00537000.wprm") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "00004036.00000FC4.489261.00537000.wprm") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "00004036.00000FC4.489261.00537000.wprm") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00000384.00000000.81930.010FD000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00000384.00000000.81930.010FD000.00000002.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00000384.00000000.81930.010FD000.00000002.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00000384.00000000.81930.010FD000.00000002.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00000384.00000000.81930.010FD000.00000002.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00000384.00000000.81930.010FD000.00000002.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00000848.00000000.82599.725B0000.00000002.mdmp") Found reference to API "EnumSystemLocalesEx" (Indicator: "EnumSystemLocales"; Source: "00000000-00002040.00000000.81585.00D4D000.00000002.mdmp, 00000000-00002040.00000000.81585.00D5A000.00000004.mdmp") Found reference to API "GetLocaleInfoEx" (Indicator: "GetLocaleInfo"; Source: "00000000-00002040.00000000.81585.00D4D000.00000002.mdmp, 00000000-00002040.00000000.81585.00D5A000.00000004.mdmp") Found reference to API "GetUserDefaultLocaleName" (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00002040.00000000.81585.00D4D000.00000002.mdmp, 00000000-00002040.00000000.81585.00D5A000.00000004.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00002040.00000000.81585.00D4D000.00000002.mdmp, 00000000-00002040.00000000.81585.00D5A000.00000004.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002040.00000000.81585.00D4D000.00000002.mdmp, 00000000-00002040.00000000.81585.00D5A000.00000004.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00002040.00000000.81585.00D4D000.00000002.mdmp, 00000000-00002040.00000000.81585.00D5A000.00000004.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00002040.00000000.81585.00D5A000.00000004.mdmp")35:T7cc,Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; File: "00000000-00002040.00000000.81585.00D31000.00000020.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; File: "00000000-00002040.00000000.81585.00D31000.00000020.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; File: "00004036.00000FC4.489261.00537000.wprm") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; File: "00004036.00000FC4.489261.00537000.wprm") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00000384.00000000.81930.010FD000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00000384.00000000.81930.010FD000.00000002.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "GetDateFormatEx" (Indicator: "GetDateFormat"; Source: "00000000-00002040.00000000.81585.00D4D000.00000002.mdmp, 00000000-00002040.00000000.81585.00D5A000.00000004.mdmp") Found reference to API "GetTimeFormatEx" (Indicator: "GetTimeFormat"; Source: "00000000-00002040.00000000.81585.00D4D000.00000002.mdmp, 00000000-00002040.00000000.81585.00D5A000.00000004.mdmp") Found reference to API "GetDateFormatW" (Indicator: "GetDateFormat"; Source: "00000000-00002040.00000000.81585.00D5A000.00000004.mdmp") Found reference to API "GetTimeFormatW" (Indicator: "GetTimeFormat"; Source: "00000000-00002040.00000000.81585.00D5A000.00000004.mdmp")36:T344e,"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004372) "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004372) "sk2Qt47.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003464) "sk2Qt47.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003464) "ck0rG18.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004112) "ck0rG18.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004112) "rq7SB75.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003480) "1Ta10aM7.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002040) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004036) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000001df9afd75cd115005cd115001e7507680000000030ed660094d815005801000000000000000000000000000038d615005ecb5d755801000000000000005d5b7594d815000e5d5b752cd41500dcaa5f75010000000000000072000000ffffffffffffffffb4d11500780200000000000025000000b4d115007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d0041003600420042003200310036008d5b4fd40cd215006d821777cced660004010000 (UID: 00000000-00004036) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000760034002e0030002e00330030003300310039005c004100700070004c00610075006e00630068002e00650078006500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2b017736650f77d8eb6276ac015e0000005e0000000000000000000300ed00bf010000000000000000000000000000000000000400e800bf010000000000000000000000705e000000000020000000000000000000000030726500f06c5e00106e5e00406f6600b8715e0000000000a8bc15000000000028be1500 (UID: 00000000-00004036) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000680001000000ffffffff020000000800000058f5660058f5660053f5660000000000020000002898650000000000010000080000000058f5150095e1fd7632ca1b00fefffffff4d015003f0889760200000028986500000000000100001888fb8876e4d01500c81c5f75bad2150095fb887618d2150028986500000000000000000000000000a0d1150000005e007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600215b4fd460d115006d821777cced660004010000 (UID: 00000000-00004036) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360039404fd478ca15006d821777fc89680004010000 (UID: 00000000-00004036) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000c4005e00d02f5e00be44000010c4150067e5fe7600005e00f09968000000000000005e0000000000f0996800000000006844002c00000000a89c6800c4005e00108e6800003b000000005e0000000000f099680000005e0090956800000000003400013500005e00b08d6800000000001500001558636500108e680098956800b0916800a800000000005e007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d004100360042004200320031003600f54e4fd4b4c415006d82177754a0680004010000 (UID: 00000000-00004036) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000150098cf9175a0335d75fe575d75054000804cde15000000000043003a005c00550073006500720073005c0048004100500055004200570053000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360011344fd490be15006d821777ec93690004010000 (UID: 00000000-00004036) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000006900f83b0000ff07000000005e00000000007f070000c4005e00d02f5e009966000000be150067e5fe7600005e00189b69000000000000005e0000000000189b6900000000004566002380000000c09d6900c4005e0050db6800003b000000005e0000000000189b6900a01d000000005e0010986900f83b0000ff07000000005e00000000007f070000c4005e007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360011344fd490be15006d8217770c96690004010000 (UID: 00000000-00004036) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000006900f83b0000ff07000000005e00000000007f070000c4005e00d02f5e005566000000be150067e5fe7600005e00389d69000000000000005e0000000000389d6900000000000166006780000000e09f6900c4005e0070ce6800003b000000005e0000000000389d6900a01d000000005e00309a6900f83b0000ff07000000005e00000000007f070000c4005e007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360011344fd490be15006d821777b497690004010000 (UID: 00000000-00004036) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000006900f83b0000ff07000000005e00000000007f070000c4005e00d02f5e002066000000be150067e5fe7600005e00e09e69000000000000005e0000000000e09e690000000000cc6500a98000000088a16900c4005e0008db6800003b000000005e0000000000e09e6900a01d000000005e00d89b6900f83b0000ff07000000005e00000000007f070000c4005e007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360011344fd490be15006d821777e498690004010000 (UID: 00000000-00004036) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000006900f83b0000ff07000000005e00000000007f070000c4005e00d02f5e00fa65000000be150067e5fe7600005e0010a069000000000000005e000000000010a0690000000000a66500c380000000b8a26900c4005e0008db6800003b000000005e000000000010a06900a01d000000005e00089d6900f83b0000ff07000000005e00000000007f070000c4005e007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360011344fd490be15006d821777149a690004010000 (UID: 00000000-00004036) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000006900f83b0000ff07000000005e00000000007f070000c4005e00d02f5e00d465000000be150067e5fe7600005e0040a169000000000000005e000000000040a1690000000000806500e580000000e8a36900c4005e0008db6800003b000000005e000000000040a16900a01d000000005e00389e6900f83b0000ff07000000005e00000000007f070000c4005e007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360011344fd490be15006d8217773c9b690004010000 (UID: 00000000-00004036) "AppLaunch.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000006900f83b0000ff07000000005e00000000007f070000c4005e00d02f5e00af65000000be150067e5fe7600005e0068a269000000000000005e000000000068a26900000000005b65003e8000000010a56900c4005e0008db6800003b000000005e000000000068a26900a01d000000005e00609f6900f83b0000ff07000000005e00000000007f070000c4005e007b00370035003800340037003100370037002d0046003000370037002d0034003100370031002d0042004400320043002d00410036004200420032003100360011344fd490be15006d8217776c9c690004010000 (UID: 00000000-00004036)37:T5e1,"AppLaunch.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb6276406f660000f0fd7f9a5c027700e0fd7fecbd150044f0fd7f00000000400000003f0000002700000000f0fd7fe0bd1500c15c0277608209772700000000f0fd7f9a5c027700e0fd7f04be1500578901778083097713170075d8eb6276 (UID: 00000000-00004036) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006c65436f6e74726f6c7353656374696f6e2c2053797374656d2e5765622e4d6f62696c652c2056657273696f6e3d342e302e302e302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d6230336635663766313164353061336122202f3e0d0a20202020 (UID: 00000000-00003544) "AppLaunch.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100000000000000000000000000000000000000000000000000000000000000000000b2f40177490724774cea3e0000007271000072710000000000000000f0000000f000727100000000b8e93e00000000004ceb3e0000000000010000001cea3e0040f50177000000000000000008ea3e00 (UID: 00000000-00003544) "4Ut221ym.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00000848)38:T6ef,GetUserDefaultLCID@KERNEL32.DLL at 00000000-00002040-31486-305-00D40144 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00002040-31486-312-00D3FB9F GetLocaleInfoW@KERNEL32.DLL at 00000000-00002040-31486-325-00D40105 GetUserDefaultLCID@KERNEL32.DLL at 00000000-00002040-31486-363-00D499E1 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00002040-31486-364-00D4931F EnumSystemLocalesW@KERNEL32.DLL at 00000000-00002040-31486-365-00D49405 GetLocaleInfoW@KERNEL32.DLL at 00000000-00002040-31486-367-00D4980C EnumSystemLocalesW@KERNEL32.DLL at 00000000-00002040-31486-368-00D4936A GetLocaleInfoW@KERNEL32.DLL at 00000000-00002040-31486-814-00D4927A GetLocaleInfoW@KERNEL32.DLL at 00000000-00002040-31486-817-00D49492 GetLocaleInfoW@KERNEL32.DLL at 00000000-00002040-31486-818-00D49912 GetLocaleInfoW@KERNEL32.DLL at 00000000-00002040-31486-819-00D496E5 GetUserDefaultLCID@KERNEL32.DLL at 00000000-00000384-41559-305-010F0144 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00000384-41559-312-010EFB9F GetLocaleInfoW@KERNEL32.DLL at 00000000-00000384-41559-325-010F0105 GetUserDefaultLCID@KERNEL32.DLL at 00000000-00000384-41559-363-010F99E1 EnumSystemLocalesW@KERNEL32.DLL at 00000000-00000384-41559-364-010F931F EnumSystemLocalesW@KERNEL32.DLL at 00000000-00000384-41559-365-010F9405 GetLocaleInfoW@KERNEL32.DLL at 00000000-00000384-41559-367-010F980C EnumSystemLocalesW@KERNEL32.DLL at 00000000-00000384-41559-368-010F936A GetLocaleInfoW@KERNEL32.DLL at 00000000-00000384-41559-814-010F927A GetLocaleInfoW@KERNEL32.DLL at 00000000-00000384-41559-817-010F9492 GetLocaleInfoW@KERNEL32.DLL at 00000000-00000384-41559-818-010F9912 GetLocaleInfoW@KERNEL32.DLL at 00000000-00000384-41559-819-010F96E5 GetUserDefaultLCID@KERNEL32.DLL at 00000000-00005084-56128-305-00EB014439:T81f,"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "sk2Qt47.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "sk2Qt47.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "ck0rG18.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "ck0rG18.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "rq7SB75.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "rq7SB75.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "1Ta10aM7.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "1Ta10aM7.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "2Dc2225.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "2Dc2225.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "3vO15kf.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4Ut221ym.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "4Ut221ym.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "5sD6MZ0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "5sD6MZ0.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")3a:T9c3,Found reference to API "GetWindowText" (Indicator: "GetWindowText"; File: "00003544.00000DD8.675446.00402000.wprm") Found reference to API "FindWindow" (Indicator: "FindWindow"; File: "00003544.00000DD8.675446.00402000.wprm") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "GetWindowText" (Indicator: "GetWindowText"; Source: "00000000-00000384.00000000.81924.0110A000.00000004.mdmp") Found reference to API "FindWindow" (Indicator: "FindWindow"; Source: "00000000-00000384.00000000.81924.0110A000.00000004.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "FindWindowW" (Indicator: "FindWindow"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp, 00000000-00000848.00000001.84524.72571000.00000020.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp")3b:T5c1,"AppLaunch.exe" queries volume information of an entire harddrive"C:\" at 00000000-00004036-0000010C-1229120 "AppLaunch.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\FANBooster131\FANBooster131.exe" at 00000000-00004036-0000010C-1368171 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe" at 00000000-00003544-0000010C-866683 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00003544-0000010C-2685015 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll" at 00000000-00003544-0000010C-2689724 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00003544-0000010C-3191479 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Internals.dll" at 00000000-00003544-0000010C-3195037 "AppLaunch.exe" queries volume information of "C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll" at 00000000-00003544-0000010C-35344943c:T5db,"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\sk2Qt47.exe" - (UID: 00000000-00004372) "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" called "CreateProcessA" with parameter "%TEMP%\IXP000.TMP\5sD6MZ0.exe" - (UID: 00000000-00004372) "sk2Qt47.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\ck0rG18.exe" - (UID: 00000000-00003464) "sk2Qt47.exe" called "CreateProcessA" with parameter "%TEMP%\IXP001.TMP\4Ut221ym.exe" - (UID: 00000000-00003464) "ck0rG18.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\rq7SB75.exe" - (UID: 00000000-00004112) "ck0rG18.exe" called "CreateProcessA" with parameter "%TEMP%\IXP002.TMP\3vO15kf.exe" - (UID: 00000000-00004112) "rq7SB75.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\1Ta10aM7.exe" - (UID: 00000000-00003480) "rq7SB75.exe" called "CreateProcessA" with parameter "%TEMP%\IXP003.TMP\2Dc2225.exe" - (UID: 00000000-00003480) "AppLaunch.exe" called "CreateProcessA" with parameter "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST" - (UID: 00000000-00004036) "AppLaunch.exe" called "CreateProcessA" with parameter "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST" - (UID: 00000000-00004036)3d:T36a1,"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00004372) "sk2Qt47.exe" called "LoadLibrary" with a parameter feclient.dll (UID: 00000000-00003464) "sk2Qt47.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003464) "ck0rG18.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00004112) "rq7SB75.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advpack.dll (UID: 00000000-00003480) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004036) "AppLaunch.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00004036) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004036) "AppLaunch.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004036) "AppLaunch.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00004036) "AppLaunch.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004036) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\shdocvw.dll (UID: 00000000-00004036) "AppLaunch.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00004036) "AppLaunch.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004036) "AppLaunch.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004036) "AppLaunch.exe" called "LoadLibrary" with a parameter ntshrui.dll (UID: 00000000-00004036) "AppLaunch.exe" called "LoadLibrary" with a parameter srvcli.dll (UID: 00000000-00004036) "AppLaunch.exe" called "LoadLibrary" with a parameter cscapi.dll (UID: 00000000-00004036) "AppLaunch.exe" called "LoadLibrary" with a parameter slc.dll (UID: 00000000-00004036) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004036) "AppLaunch.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00004036) "AppLaunch.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00004036) "AppLaunch.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00004036) "AppLaunch.exe" called "LoadLibrary" with a parameter WININET.DLL (UID: 00000000-00004036) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00004068) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00004068) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\schtasks.exe (UID: 00000000-00004128) "schtasks.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004128) "schtasks.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00004128) "schtasks.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00004128) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter imm32.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\252cc7b0fae8cfe083bdc149957c0c54\PresentationFramework.ni.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter ucrtbase_clr0400.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter dwrite.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\wpfgfx_v0400.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\WPF\PresentationNative_v0400.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel\v4.0_4.0.0.0__b77a5c561934e089\System.ServiceModel.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\c2ef5bc545b98a289f02d0b3eddbe280\System.IdentityModel.ni.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\dc67dcb4b2fb4a3853d458cab08561f0\SMDiagnostics.ni.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.ServiceModel.Internals\v4.0_4.0.0.0__31bf3856ad364e35\System.ServiceModel.Intern (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Transactions\3d760b4a3260a41ef84a3fd866780980\System.Transactions.ni.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003544) "AppLaunch.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\diasymreader.dll (UID: 00000000-00003544) "4Ut221ym.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000848) "4Ut221ym.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00000848) "4Ut221ym.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00000848) "4Ut221ym.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00000848) "4Ut221ym.exe" called "LoadLibrary" with a parameter %WINDIR%\System32\ieframe.dll (UID: 00000000-00000848) "4Ut221ym.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000848) "4Ut221ym.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00000848) "4Ut221ym.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00000848) "4Ut221ym.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00000848) "4Ut221ym.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00000848) "4Ut221ym.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\Internet Explorer\ieproxy.dll (UID: 00000000-00000848) "4Ut221ym.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00000848) "4Ut221ym.exe" called "LoadLibrary" with a parameter iertutil.dll (UID: 00000000-00000848) "4Ut221ym.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00000848) "4Ut221ym.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00000848) "4Ut221ym.exe" called "LoadLibrary" with a parameter ext-ms-win-kernel32-package-current-l1-1-0 (UID: 00000000-00000848)3e:Ta344,"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004372) "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004372) "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004372) "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004372) "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00004372) "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004372) "sk2Qt47.exe" called "GetProcAddress" with a parameter DecryptFileA (UID: 00000000-00003464) "sk2Qt47.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003464) "sk2Qt47.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003464) "sk2Qt47.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003464) "sk2Qt47.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003464) "sk2Qt47.exe" called "GetProcAddress" with a parameter FeClientInitialize (UID: 00000000-00003464) "sk2Qt47.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003464) "sk2Qt47.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003464) "ck0rG18.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004112) "ck0rG18.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004112) "ck0rG18.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004112) "ck0rG18.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004112) "ck0rG18.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00004112) "ck0rG18.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00004112) "rq7SB75.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003480) "rq7SB75.exe" called "GetProcAddress" with a parameter DelNodeRunDLL32 (UID: 00000000-00003480) "rq7SB75.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003480) "1Ta10aM7.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002040) "1Ta10aM7.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00002040) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemWow64DirectoryW (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSecurityDescriptor (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter SetEntriesInAclW (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter GetMartaExtensionInterface (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSecurityDescriptorDacl (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter IsTextUnicode (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueW (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadBSTR (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateLinkInfoW (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter IsCharAlphaW (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter CharPrevW (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNetResourceFromLocalPathW (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter NetShareEnum (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter CscNetApiGetInterface (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter SLGetWindowsInformationDWORD (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter PathRemoveFileSpecW (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter CharNextW (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter DestroyLinkInfo (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter O/ (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter O (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter ?/ (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter ? (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter WSPStartup (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHOpenSocket (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHOpenSocket2 (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHJoinLeaf (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHNotify (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetSocketInformation (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHSetSocketInformation (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetSockaddrType (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetWildcardSockaddr (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHGetBroadcastSockaddr (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHAddressToString (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHStringToAddress (UID: 00000000-00004036) "AppLaunch.exe" called "GetProcAddress" with a parameter WSHIoctl (UID: 00000000-00004036) "schtasks.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00004068) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00004068) "schtasks.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00004128) "schtasks.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00004128) "schtasks.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00004128) "schtasks.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00004128) "2Dc2225.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000384) "2Dc2225.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000384) "2Dc2225.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000384) "2Dc2225.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000384) "2Dc2225.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00000384) "AppLaunch.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter _CorExeMain (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter ThemeInitApiHook (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter IsProcessDPIAware (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemed (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter IsAppThemedW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtx (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateActCtxA (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessage (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterWindowMessageW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter SortGetHandle (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter SortCloseHandle (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter StringFromGUID2 (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter BCryptGetFipsAlgorithmMode (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetDefaultProviderW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CPAcquireContext (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CPReleaseContext (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenKey (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDeriveKey (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyKey (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetKeyParam (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetKeyParam (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CPExportKey (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CPImportKey (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CPEncrypt (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDecrypt (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CPCreateHash (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashData (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CPHashSessionKey (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDestroyHash (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSignHash (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CPVerifySignature (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGenRandom (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetUserKey (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetProvParam (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetProvParam (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CPSetHashParam (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CPGetHashParam (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateKey (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CPDuplicateHash (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandle (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmCreateContext (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmDestroyContext (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmNotifyIME (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmAssociateContext (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmReleaseContext (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetContext (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringA (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringA (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmGetCompositionStringW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCompositionStringW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter ImmSetCandidateWindow (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter AdjustWindowRectEx (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentActCtx (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter DefWindowProcW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetStockObject (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClass (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter RegisterClassW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowEx (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLong (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter SetWindowLongW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLong (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowLongW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProc (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CallWindowProcW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetParent (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptExportKey (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptCreateHash (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptHashData (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptGetHashParam (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyHash (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter _calloc_base (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSListHead (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter PathAppendW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter DWriteCreateFactory (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter PathCombineW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GdiEntry13 (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003544) "AppLaunch.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003544) "3vO15kf.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003940) "3vO15kf.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003940) "4Ut221ym.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter SHGetInstanceExplorer (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter OleInitialize (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter CreateBindCtx (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter EventEnabled (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter PSPropertyBag_WriteDWORD (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter CoGetApartmentType (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter CoRegisterInitializeSpy (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadDWORD (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadGUID (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter RegEnumKeyW (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter ApphelpCheckShellObject (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter CLSIDFromOle1Class (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter GetCatalogObject (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter GetCatalogObject2 (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter AcquireSRWLockShared (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter ReleaseSRWLockShared (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter DllGetClassObject (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter IsValidURL (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter CoTaskMemRealloc (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter PSPropertyBag_ReadStrAlloc (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter CoAllowSetForegroundWindow (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter FindWindowExW (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_Size_ExW (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter CM_Get_Device_Interface_List_ExW (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter RtlDllShutdownInProgress (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter OleUninitialize (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter CoRevokeInitializeSpy (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter NdrOleInitializeExtension (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter CoGetMarshalSizeMax (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter CoMarshalInterface (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter CoUnmarshalInterface (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter CoGetPSClsid (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter CoReleaseMarshalData (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter DcomChannelSetHResult (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter SendMessageTimeoutW (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter AllowSetForegroundWindow (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter PostMessageW (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter CloseThemeData (UID: 00000000-00000848) "4Ut221ym.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00000848) "5sD6MZ0.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005084) "5sD6MZ0.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005084) "AppLaunch.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005108) "AppLaunch.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00005108)3f:T1648,"CREATE TABLE sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)" (Source: 32253-1054-004D6790, Indicator: "create table sqlite_master( type text, name text, tbl_name text, rootpage integer, sql text)"), "SELECT name rootpage sql FROM '%q'.%s" (Source: 32253-1054-004D6790, Indicator: "select name rootpage sql from '%q'.%s"), "SELECT name rootpage sql FROM '%q'.%s WHERE %s" (Source: 32253-1099-004C2E90, Indicator: "select name rootpage sql from '%q'.%s where %s"), "UPDATE %Q.%s SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 32253-1249-004CF4F0, Indicator: "update %q.%s set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "CREATE TABLE" (Source: 32253-1255-004CF340, Indicator: "create table"), "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 32253-1438-004CFB70, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 32253-1451-004CF800, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'"), "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 32253-1451-004CF800, Indicator: "delete from %q.sqlite_stat1 where tbl=%q"), "DELETE FROM %Q.%s WHERE name=%Q" (Source: 32253-1497-004D0320, Indicator: "delete from %q.%s where name=%q"), "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 32253-1497-004D0320, Indicator: "delete from %q.sqlite_stat1 where idx=%q"), "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q) tbl_name = %Q name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='" (Source: 32253-1523-004CD2C0, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='") "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 32253-1525-004CD570, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "UPDATE %Q.%s SET type='table' name=%Q tbl_name=%Q rootpage=0 sql=%Q WHERE rowid=#%d" (Source: 32253-1528-004DC570, Indicator: "update %q.%s set type='table' name=%q tbl_name=%q rootpage=0 sql=%q where rowid=#%d"), "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q) tbl_name = %Q name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');" (Source: 00004036.00000FC4.489261.00537000.wprm, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='table' or type='index' or type='trigger');"), "CREATE TABLE sqlite_master(" (Source: 00000000-00002040.00000000.81585.00D5A000.00000004.mdmp, Indicator: "create table sqlite_master(") "CREATE TABLE" (Source: 00000000-00002040.00000000.81585.00D5A000.00000004.mdmp, Indicator: "create table") "SELECT name, rootpage, sql FROM '%q'.%s WHERE %s" (Source: 00000000-00002040.00000000.81585.00D5A000.00000004.mdmp, Indicator: "select name, rootpage, sql from '%q'.%s where %s") "UPDATE %Q.%s SET sql = sqlite_rename_table(sql, %Q), tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' || %Q || substr(name,%d+18) ELSE name END WHERE tbl_name=%Q AND (type='table' OR type='index' OR type='trigger');" (Source: 00000000-00002040.00000000.81585.00D5A000.00000004.mdmp, Indicator: "update %q.%s set sql = sqlite_rename_table(sql, %q) tbl_name = %q name = case when type='table' then %q when name like 'sqlite_autoindex%%' and type='index' then 'sqlite_autoindex_' || %q || substr(name,%d+18) else name end where tbl_name=%q and (type='table' or type='index' or type='trigger');"), "UPDATE "%w".%s SET sql = substr(sql,1,%d) || ', ' || %Q || substr(sql,%d) WHERE type = 'table' AND name = %Q" (Source: 00000000-00002040.00000000.81585.00D5A000.00000004.mdmp, Indicator: "update "%w".%s set sql = substr(sql,1,%d) || ', ' || %q || substr(sql,%d) where type = 'table' and name = %q"), "UPDATE %Q.%s SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 00000000-00002040.00000000.81585.00D5A000.00000004.mdmp, Indicator: "update %q.%s set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "DELETE FROM %Q.%s WHERE tbl_name=%Q and type!='trigger'" (Source: 00000000-00002040.00000000.81585.00D5A000.00000004.mdmp, Indicator: "delete from %q.%s where tbl_name=%q and type!='trigger'"), "DELETE FROM %Q.sqlite_stat1 WHERE tbl=%Q" (Source: 00000000-00002040.00000000.81585.00D5A000.00000004.mdmp, Indicator: "delete from %q.sqlite_stat1 where tbl=%q"), "INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);" (Source: 00000000-00002040.00000000.81585.00D5A000.00000004.mdmp, Indicator: "insert into %q.%s values('index',%q,%q,#%d,%q);"), "DELETE FROM %Q.%s WHERE name=%Q" (Source: 00000000-00002040.00000000.81585.00D5A000.00000004.mdmp, Indicator: "delete from %q.%s where name=%q"), "DELETE FROM %Q.sqlite_stat1 WHERE idx=%Q" (Source: 00000000-00002040.00000000.81585.00D5A000.00000004.mdmp, Indicator: "delete from %q.sqlite_stat1 where idx=%q")40:T4a2,Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; File: "00004036.00000FC4.489261.00537000.wprm") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; File: "00004036.00000FC4.489261.00537000.wprm") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000384.00000000.81930.010FD000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000384.00000000.81930.010FD000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00002040.00000000.81585.00D4D000.00000002.mdmp, 00000000-00002040.00000000.81585.00D5A000.00000004.mdmp") Found reference to API "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002040.00000000.81585.00D4D000.00000002.mdmp, 00000000-00002040.00000000.81585.00D5A000.00000004.mdmp")41:T840,Process AppLaunch.exe created mutex with name "\Sessions\1\BaseNamedObjects\Global\CLR_PerfMon_WrapMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_c68_IESQMMUTEX_0_519" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\UpdatingNewTabPageData" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\!BrowserEmulation!SharedMemory!Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\VERMGMTBlockListFileMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_FILEMAPSWITCH_MUTEX_3176" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_HASHFILESWITCH_MUTEX" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\URLBLOCK_DOWNLOAD_MUTEX" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_c68_IE_EarlyTabStart_0x1118_Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_c68_ConnHashTable<3176>_HashTable_Mutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_c68_IESQMMUTEX_0_303" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_c68_IESQMMUTEX_0_331" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\IsoScope_c68_IESQMMUTEX_0_274" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\MSIMGSIZECacheMutex" Process iexplore.exe created mutex with name "\Sessions\1\BaseNamedObjects\_!SHMSFTHISTORY!_"42:Ta0b,"AppLaunch.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\ucrtbase_clr0400.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\PresentationCore\v4.0_4.0.0.0__31bf3856ad364e35\SHLWAPI.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-datetime-l1-1-1" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "api-ms-win-core-localization-obsolete-l1-2-0" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\VERSION.dll" - [base:0; Status:c0000135] "AppLaunch.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "4Ut221ym.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-1" - [base:0; Status:c0000135] "4Ut221ym.exe" failed to load missing module "ext-ms-win-kernel32-package-current-l1-1-0" - [base:0; Status:c0000135]43:T5b1,"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "1Ta10aM7.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "sk2Qt47.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "ck0rG18.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "rq7SB75.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "2Dc2225.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "5sD6MZ0.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE "FANBooster131.exe" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE44:T44a,Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36" (Indicator: "mozilla/5.0 ("; File: "00004036.00000FC4.486111.00400000.wprm") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" (Indicator: "mozilla/5.0 ("; File: "00004036.00000FC4.486111.00400000.wprm") Found string "@Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" (Indicator: "mozilla/5.0 ("; File: "00004036.00000FC4.489261.00537000.wprm") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/119.0.0.0 Safari/537.36" (Indicator: "mozilla/5.0 ("; Source: "00000000-00002040.00000000.81585.00D5A000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.36" (Indicator: "mozilla/5.0 ("; Source: "00000000-00002040.00000000.81585.00D5A000.00000004.mdmp")45:T769,Found string "hitpsy/unnwpaypalcomsignin" (Indicator: "paypal"; File: "screen_3.png") file/memory contains long string with (Indicator: "youtube"; File: "~DF48CB1DF001E92E1C.TMP") file/memory contains long string with (Indicator: "youtube"; File: "_712BBA86-A723-11F1-ABBF-0050569172E9_.dat") file/memory contains long string with (Indicator: "youtube"; File: "~DF802F3078ACA9FAFC.TMP") file/memory contains long string with (Indicator: "youtube"; File: "EKZM8SMB.txt") file/memory contains long string with (Indicator: "youtube"; File: "31XN25R7.txt") file/memory contains long string with (Indicator: "youtube"; File: "1166XN53.txt") file/memory contains long string with (Indicator: "youtube"; File: "908MRENR.txt") file/memory contains long string with (Indicator: "youtube"; File: "249P27QL.txt") file/memory contains long string with (Indicator: "youtube"; File: "QX6WCDG2.txt") Found string "085mYTXtuYP0vJ4Kx..BqmKEP..AAA.0.0.BqmKEP.AWcTuzEU8xDqZHuNGVoXecKHHZIfacebook.com/92174364250883129392280976805331275817D6GYar11KqDAyR-i_CB4A-vsfacebook.com/921719808792323135628380976805331275817" (Indicator: "facebook.com"; File: "D77OVPNX.txt") Found string "085mYTXtuYP0vJ4Kx..BqmKEP..AAA.0.0.BqmKEP.AWcTuzEU8xDqZHuNGVoXecKHHZIfacebook.com/92174364250883129392280976805331275817" (Indicator: "facebook.com"; File: "F6MVE94Q.txt") Found string "CONSENTWP.2676bayoutube.com/102431383388163210825482504061830633367" (Indicator: "youtube"; File: "CJANLBKS.txt") Found string "accounts.youtube.com" (Indicator: "youtube"; File: "PCAP") Found string "twitter.com" (Indicator: "twitter"; File: "PCAP") Found string "www.facebook.com" (Indicator: "facebook.com"; File: "PCAP") Found string "www.paypal.com" (Indicator: "paypal"; File: "PCAP") Found string "www.youtube.com" (Indicator: "youtube"; File: "PCAP") file/memory contains long string with (Indicator: "youtube"; File: "SSL")46:T8a2,"REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00000384.00000000.81930.00380000.00000004.mdmp "Software\AutoIt v3\AutoIt" in Source: 00000000-00000848.00000000.82599.000FC000.00000002.mdmp "SOFTWARE\Classes\" in Source: 00000000-00000848.00000000.82599.000FC000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Nls\Language" in Source: 00000000-00000848.00000000.82599.000FC000.00000002.mdmp "Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing" in Source: 00000000-00000848.00000001.84524.005E0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00000848.00000001.84524.005E0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\TabbedBrowsing" in Source: 00000000-00000848.00000002.84619.005E0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00000848.00000002.84619.005E0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00002040.00000000.81585.00350000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00002040.00000000.81585.00350000.00000004.mdmp "041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00003464.00000000.81378.00240000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00003464.00000002.84625.00AE1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00003480.00000000.81477.00131000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00004112.00000001.82271.00251000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\App Paths" in Source: 00000000-00004372.00000002.84963.00BB1000.00000020.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00005084.00000000.84951.003A0000.00000004.mdmp47:T54ee,"GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog" Response ==> HTTP/1.1 200 OK Content-Security-Policy-Report-Only: script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/scaffolding/sytroprc:52:0 Cross-Origin-Opener-Policy-Report-Only: same-origin; report-to=sytroprc:52:0 Report-To: {"group":"sytroprc:52:0" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/scaffolding/sytroprc:52:0"}] } Server: scaffolding on HTTPServer2 Content-Length: 1446 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN Date: Wed 02 Sep 2026 19:34:34 GMT Cache-Control: public max-age=14400 Content-Type: application/ocsp-response Age: 9922 with response body ==>30C28205C2A20A0100C2A0C28205C29B30C28205C29706092B060105050730010104C28205C28830C28205C28430C281C29EC2A2160414C3BCC2B709C3AA4D79....... "GET /r/r1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 993 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 02 Sep 2026 21:43:43 GMT Expires: Wed 02 Sep 2026 22:33:43 GMT Cache-Control: public max-age=3000 Age: 2173 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C28203C39D30C28201C385020101300D06092AC28648C286C3B70D01010B05003047310B300906035504061302555331223020060355040A1319476F6F676C....... "GET /wr2/oBFYYahzgVI.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 51170 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 02 Sep 2026 21:38:58 GMT Expires: Wed 02 Sep 2026 22:28:58 GMT Cache-Control: public max-age=3000 Age: 2458 Last-Modified: Wed 02 Sep 2026 17:50:26 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282C387C39E30C282C386C386020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F....... "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 52343 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 02 Sep 2026 21:38:28 GMT Expires: Wed 02 Sep 2026 22:28:28 GMT Cache-Control: public max-age=3000 Last-Modified: Wed 02 Sep 2026 20:45:44 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 2490 with response body ==>30C282C38C7330C282C38B5B020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F676C....... "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 49579 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 02 Sep 2026 21:58:47 GMT Expires: Wed 02 Sep 2026 22:48:47 GMT Cache-Control: public max-age=3000 Age: 1272 Last-Modified: Wed 02 Sep 2026 19:20:16 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282C381C2A730C282C380C28F020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.cn" Response ==> HTTP/1.1 200 OK Server: Tengine Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive Date: Wed 02 Sep 2026 21:56:08 GMT Cache-Control: max-age=7200 X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-DC-POP: sng-003 Via: ens-cache46.l2us4[0 0 200-0 H] ens-cache46.l2us4[1 0] ens-cache11.us22[0 0 200-0 H] ens-cache8.us22[2 0] Age: 1431 Ali-Swift-Global-Savetime: 1788386168 X-Cache: HIT TCP_MEM_HIT dirn:-2:-2 X-Swift-SaveTime: Wed 02 Sep 2026 21:56:08 GMT X-Swift-CacheTime: 3600 Timing-Allow-Origin: * EagleId: 2ff6179c17883875992358450e with response body ==>30C28201C3930A0100C2A0C28201C38C30C28201C38806092B060105050730010104C28201C2B930C28201C2B530C281C29EC2A2160414C2B13EC3836903C3B8....... "GET /r/gsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 1871 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 02 Sep 2026 21:43:37 GMT Expires: Wed 02 Sep 2026 22:33:37 GMT Cache-Control: public max-age=3000 Age: 2197 Last-Modified: Mon 31 Aug 2026 08:08:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282074B30C2820633020101300D06092AC28648C286C3B70D01010B05003057310B300906035504061302424531193017060355040A1310476C6F62616C53....... "GET /r/r4.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 528 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 02 Sep 2026 22:00:30 GMT Expires: Wed 02 Sep 2026 22:50:30 GMT Cache-Control: public max-age=3000 Age: 1184 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282020C30C28201C293020101300A06082AC28648C38E3D0403033047310B300906035504061302555331223020060355040A1319476F6F676C6520547275....... "GET /we1/pl4XiTjSDSk.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 454 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 02 Sep 2026 21:41:29 GMT Expires: Wed 02 Sep 2026 22:31:29 GMT Cache-Control: public max-age=3000 Last-Modified: Wed 02 Sep 2026 17:49:53 GMT Content-Type: application/pkix-crl Age: 2325 with response body ==>30C28201C38230C2820168020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C6520547275....... "GET /we1/G0k-BqpOX8k.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 347 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 02 Sep 2026 22:15:38 GMT Expires: Wed 02 Sep 2026 23:05:38 GMT Cache-Control: public max-age=3000 Age: 276 Last-Modified: Wed 02 Sep 2026 20:34:50 GMT Content-Type: application/pkix-crl with response body ==>30C282015730C281C3BE020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C652054727573....... "GET /we1/x6Eg-8TSwUw.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 308 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 02 Sep 2026 22:09:30 GMT Expires: Wed 02 Sep 2026 22:59:30 GMT Cache-Control: public max-age=3000 Last-Modified: Wed 02 Sep 2026 20:50:03 GMT Content-Type: application/pkix-crl Age: 644 with response body ==>30C282013030C281C397020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C652054727573....... "GET /rootg2.cer HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crt.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: binary/octet-stream Content-Length: 1145 Connection: keep-alive Last-Modified: Thu 27 Aug 2026 13:09:28 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: A2X7.ooO5I_EAPPeyyJbO.f4401befYg Accept-Ranges: bytes Server: AmazonS3 Date: Wed 02 Sep 2026 19:42:02 GMT ETag: "c6150925cfea5941ddc7ff2a0a506692" X-Cache: Hit from cloudfront Via: 1.1 a8894be3cc09919d8cad0be355a10772.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P5 X-Amz-Cf-Id: uMSWRM_rEDt5kOFdEelnERV_J_0tjfNvsVofP4Qt-EbtmUncp5FxYg== Age: 9495 with response body ==>30C282047530C282035DC2A003020102020900C2A70E4A4C34C282C2B77F300D06092AC28648C286C3B70D01010B05003068310B300906035504061302555331....... "GET /rootg2.cer HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crt.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: binary/octet-stream Content-Length: 1145 Connection: keep-alive Last-Modified: Thu 27 Aug 2026 13:09:28 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: A2X7.ooO5I_EAPPeyyJbO.f4401befYg Accept-Ranges: bytes Server: AmazonS3 Date: Wed 02 Sep 2026 19:42:02 GMT ETag: "c6150925cfea5941ddc7ff2a0a506692" X-Cache: Hit from cloudfront Via: 1.1 e774c9e3b514be02964a99136a6cdfda.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P5 X-Amz-Cf-Id: WH3QeE5HmPEjiEzu80xIPIu5x2qBxCAjSko3014-AMHfMQuEoT20WQ== Age: 9495 with response body ==>30C282047530C282035DC2A003020102020900C2A70E4A4C34C282C2B77F300D06092AC28648C286C3B70D01010B05003068310B300906035504061302555331....... "GET /rootg2.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: binary/octet-stream Content-Length: 713 Connection: keep-alive Last-Modified: Thu 27 Aug 2026 13:09:30 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: XO7o0SZxRTdLeuGaHJqiknh1RLN78jt0 Accept-Ranges: bytes Server: AmazonS3 Date: Wed 02 Sep 2026 18:56:18 GMT ETag: "3da54864ee51a020c52b8c403fe4f27a" X-Cache: Hit from cloudfront Via: 1.1 06cacd0422733e64f8afbe400dd4457c.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P15 X-Amz-Cf-Id: xJNJwfJueTIwUPktHozB9wFcqQjc5fbSGjxxLD-jGyJaWTBvgNp3Mg== Age: 12242 with response body ==>30C28202C38530C28201C2AD020101300D06092AC28648C286C3B70D01010B050030C281C298310B30090603550406130255533110300E060355040813074172....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootca1.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1438 Connection: keep-alive Date: Wed 02 Sep 2026 22:17:03 GMT x-amzn-RequestId: 4995e61a-e210-4acd-bdd3-3428e5511e95 Last-Modified: Wed 2 Sep 2026 22:16:57 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Expires: Wed 9 Sep 2026 21:16:57 GMT ETag: c432a5c4a897c9f9e32fbae853aaa37270872718 X-Cache: Hit from cloudfront Via: 1.1 909ec3586e2eba60d35c2f3468905558.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P7 X-Amz-Cf-Id: sR8s71bx4IHH52aEo1mlEHyoEz7w7ims1qNDTNEkJCK4iPwFDyJKsg== Age: 196 with response body ==>30C28205C29A0A0100C2A0C28205C29330C28205C28F06092B060105050730010104C28205C28030C282057C30C281C394C2A1493047310B3009060355040613....... "GET /rootca1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.rootca1.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: binary/octet-stream Content-Length: 964 Connection: keep-alive Last-Modified: Thu 27 Aug 2026 13:09:21 GMT x-amz-server-side-encryption: AES256 x-amz-version-id: IThAswNuZbgsz5NDnVom8rEuZw.FPlds Accept-Ranges: bytes Server: AmazonS3 Date: Wed 02 Sep 2026 20:33:22 GMT ETag: "f26879eea3439bea499e86821dc95d89" X-Cache: Hit from cloudfront Via: 1.1 5384957d0da33dc98fe1cbf6f1c100bc.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P10 X-Amz-Cf-Id: T-21tuCFlkIQCoEhN4ldHRnBmNW4c4A9vGTUX6HPklp4GHE6ui_k4Q== Age: 6418 with response body ==>30C28203C38030C28202C2A8020101300D06092AC28648C286C3B70D01010B05003039310B3009060355040613025553310F300D060355040A1306416D617A6F....... "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootg2.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 1560 Connection: keep-alive Date: Wed 02 Sep 2026 22:05:29 GMT x-amzn-RequestId: 7fbdabf5-9dd8-4e71-bb45-5c8f9ef9f75d Last-Modified: Wed 2 Sep 2026 22:04:46 GMT Cache-Control: max-age=302400 public no-transform must-revalidate Expires: Wed 9 Sep 2026 21:04:46 GMT ETag: 8dd1cc345862585d7fecdbf3f27c6779e1e45fff X-Cache: Hit from cloudfront Via: 1.1 edb4467fad6c19f876564012471f929a.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P7 X-Amz-Cf-Id: g9GOn78ftJy1-FMJrh3WfbqimKRF6cdqRT2-TCLfXYhp5w5pRqxktg== Age: 890 with response body ==>30C28206140A0100C2A0C282060D30C282060906092B060105050730010104C28205C3BA30C28205C3B630C281C3A1C2A1563054310B30090603550406130255....... "GET /r2m04.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.r2m04.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/pkix-crl Content-Length: 2453320 Connection: keep-alive Last-Modified: Wed 02 Sep 2026 11:05:14 GMT Accept-Ranges: bytes Expires: Wed 02 Sep 2026 19:46:29 GMT Date: Wed 02 Sep 2026 22:16:29 GMT Cache-Control: public max-age=1800 ETag: "6a9802ea-256f48" X-Cache: Hit from cloudfront Via: 1.1 7737ef6f12229d4564d45a2b0c059e2e.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK52-P3 X-Amz-Cf-Id: JOAE5FNM6kxWgsQQsPM2XP0CFzw7AxiNNFjpL0hccwzzrWwgSJ3YlA== Age: 230 with response body ==>30C283256F4330C283256E2A020101300D06092AC28648C286C3B70D01010B0500303C310B3009060355040613025553310F300D060355040A1306416D617A6F....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.r2m04.amazontrust.com" Response ==> HTTP/1.1 200 OK Content-Type: application/ocsp-response Content-Length: 471 Connection: keep-alive X-XSS-Protection: 1; mode=block X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff X-DC-POP: pdx2-004 Cache-Control: max-age=1800 Date: Wed 02 Sep 2026 22:02:31 GMT X-Cache: Hit from cloudfront Via: 1.1 3fb9189e3254ca5ce547d3c2434c5d14.cloudfront.net (CloudFront) X-Amz-Cf-Pop: JFK50-P16 X-Amz-Cf-Id: oE9FxL3xWpIKKyVkzVuzP2j18_hwM27rG2EjoqlmdkwO7cpVkXpkVg== Age: 1068 with response body ==>30C28201C3930A0100C2A0C28201C38C30C28201C38806092B060105050730010104C28201C2B930C28201C2B530C281C29EC2A21604141F52C2926156C28254....... "GET /we2/yK5nPhtHKQs.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 38437 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 02 Sep 2026 21:47:38 GMT Expires: Wed 02 Sep 2026 22:37:38 GMT Cache-Control: public max-age=3000 Age: 1965 Last-Modified: Wed 02 Sep 2026 19:46:05 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282C2962130C282C295C386020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C652054....... "GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 53822 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Wed 02 Sep 2026 21:38:27 GMT Expires: Wed 02 Sep 2026 22:28:27 GMT Cache-Control: public max-age=3000 Last-Modified: Wed 02 Sep 2026 20:16:11 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding Age: 2516 with response body ==>30C282C3923A30C282C39122020101300D06092AC28648C286C3B70D01010B0500303B310B3009060355040613025553311E301C060355040A1315476F6F676C....... "GET /r/r1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 11 Feb 2026 14:38:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Wed 02 Sep 2026 21:43:43 GMT Expires: Wed 02 Sep 2026 22:33:43 GMT Age: 2203 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /wr2/oBFYYahzgVI.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 02 Sep 2026 17:50:26 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Wed 02 Sep 2026 21:38:58 GMT Expires: Wed 02 Sep 2026 22:28:58 GMT Age: 2488 Last-Modified: Wed 02 Sep 2026 17:50:26 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body "GET /wr2/75r4ZyA3vA0.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 02 Sep 2026 20:45:44 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Wed 02 Sep 2026 21:38:28 GMT Expires: Wed 02 Sep 2026 22:28:28 GMT Last-Modified: Wed 02 Sep 2026 20:45:44 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding Age: 2518 with no response body "GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed, 02 Sep 2026 19:20:16 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 304 Not Modified Date: Wed 02 Sep 2026 21:58:47 GMT Expires: Wed 02 Sep 2026 22:48:47 GMT Age: 1299 Last-Modified: Wed 02 Sep 2026 19:20:16 GMT Cache-Control: public max-age=3000 Vary: Accept-Encoding with no response body48:T24ef,"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6c630000 "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74d70000 "sk2Qt47.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 68000000 "sk2Qt47.exe" loaded module "FECLIENT.DLL" at base 6d680000 "sk2Qt47.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6c640000 "sk2Qt47.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74d70000 "ck0rG18.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6c440000 "ck0rG18.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74d70000 "rq7SB75.exe" loaded module "%WINDIR%\SYSTEM32\ADVPACK.DLL" at base 6c640000 "rq7SB75.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74d70000 "AppLaunch.exe" loaded module "KERNEL32.DLL" at base 76840000 "AppLaunch.exe" loaded module "OLEAUT32.DLL" at base 75200000 "AppLaunch.exe" loaded module "OLE32.DLL" at base 76a80000 "AppLaunch.exe" loaded module "ADVAPI32.DLL" at base 76640000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75550000 "AppLaunch.exe" loaded module "PROPSYS.DLL" at base 73a00000 "AppLaunch.exe" loaded module "COMCTL32.DLL" at base 73dc0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73a00000 "AppLaunch.exe" loaded module "SETUPAPI.DLL" at base 76be0000 "AppLaunch.exe" loaded module "NTMARTA.DLL" at base 74330000 "AppLaunch.exe" loaded module "SHELL32.DLL" at base 75550000 "AppLaunch.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 767c0000 "AppLaunch.exe" loaded module "PROFAPI.DLL" at base 74ee0000 "AppLaunch.exe" loaded module "APPHELP.DLL" at base 74d70000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6ddd0000 "AppLaunch.exe" loaded module "LINKINFO.DLL" at base 6f4d0000 "AppLaunch.exe" loaded module "USER32.DLL" at base 76520000 "AppLaunch.exe" loaded module "NTSHRUI.DLL" at base 71c40000 "AppLaunch.exe" loaded module "SRVCLI.DLL" at base 74ac0000 "AppLaunch.exe" loaded module "CSCAPI.DLL" at base 6faf0000 "AppLaunch.exe" loaded module "SLC.DLL" at base 733c0000 "AppLaunch.exe" loaded module "SHLWAPI.DLL" at base 77160000 "AppLaunch.exe" loaded module "SSPICLI.DLL" at base 74d50000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74d70000 "AppLaunch.exe" loaded module "WINHTTP.DLL" at base 70b10000 "AppLaunch.exe" loaded module "WININET.DLL" at base 752a0000 "AppLaunch.exe" loaded module "CRYPTBASE.DLL" at base 74dc0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74890000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 743f0000 "schtasks.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 767c0000 "schtasks.exe" loaded module "CLBCATQ.DLL" at base 762f0000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base 734d0000 "schtasks.exe" loaded module "SSPICLI.DLL" at base 74d50000 "schtasks.exe" loaded module "ADVAPI32.DLL" at base 76640000 "schtasks.exe" loaded module "XMLLITE.DLL" at base 73660000 "schtasks.exe" loaded module "CRYPTBASE.DLL" at base 74dc0000 "schtasks.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73b90000 "schtasks.exe" loaded module "RPCRT4.DLL" at base 76920000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 703b0000 "AppLaunch.exe" loaded module "KERNEL32" at base 76840000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 643e0000 "AppLaunch.exe" loaded module "MSCOREE.DLL" at base 6bb70000 "AppLaunch.exe" loaded module "PSAPI.DLL" at base 77110000 "AppLaunch.exe" loaded module "RPCRT4.DLL" at base 76920000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 62fd0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73b90000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6c660000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6a9b0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62570000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 64de0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 61700000 "AppLaunch.exe" loaded module "UXTHEME.DLL" at base 73b90000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 60ee0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 6a8a0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 60760000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6c640000 "AppLaunch.exe" loaded module "NTDLL.DLL" at base 76fc0000 "AppLaunch.exe" loaded module "BCRYPT.DLL" at base 749e0000 "AppLaunch.exe" loaded module "CRYPTSP.DLL" at base 748d0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74660000 "AppLaunch.exe" loaded module "IMM32.DLL" at base 77130000 "AppLaunch.exe" loaded module "COMCTL32.DLL" at base 71720000 "AppLaunch.exe" loaded module "GDI32.DLL" at base 764d0000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\WINDOWSBASE\1A4CC316FB6D09525321FC0BE44692D8\WINDOWSBASE.NI.DLL" at base 60340000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIONCORE\468F4E17BE144CA12A73A4297EACC9CC\PRESENTATIONCORE.NI.DLL" at base 5f700000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\PRESENTATIO5AE0F00F#\252CC7B0FAE8CFE083BDC149957C0C54\PRESENTATIONFRAMEWORK.NI.DLL" at base 5e310000 "AppLaunch.exe" loaded module "UCRTBASE_CLR0400.DLL" at base 6a4a0000 "AppLaunch.exe" loaded module "DWRITE.DLL" at base 5e1d0000 "AppLaunch.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 74ff0000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\WPFGFX_V0400.DLL" at base 5e040000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\WPF\PRESENTATIONNATIVE_V0400.DLL" at base 5df50000 "AppLaunch.exe" loaded module "VERSION.DLL" at base 74360000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 5dc70000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.IDENTITYMODEL\C2EF5BC545B98A289F02D0B3EDDBE280\SYSTEM.IDENTITYMODEL.NI.DLL" at base 5d960000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SMDIAGNOSTICS\DC67DCB4B2FB4A3853D458CAB08561F0\SMDIAGNOSTICS.NI.DLL" at base 6c620000 "AppLaunch.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.TRANSACTIONS\3D760B4A3260A41EF84A3FD866780980\SYSTEM.TRANSACTIONS.NI.DLL" at base 5d250000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 6a130000 "AppLaunch.exe" loaded module "WS2_32.DLL" at base 771d0000 "AppLaunch.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74880000 "AppLaunch.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\DIASYMREADER.DLL" at base 5afc0000 "4Ut221ym.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 68000000 "4Ut221ym.exe" loaded module "OLE32.DLL" at base 76a80000 "4Ut221ym.exe" loaded module "ADVAPI32.DLL" at base 76640000 "4Ut221ym.exe" loaded module "PROPSYS.DLL" at base 73a00000 "4Ut221ym.exe" loaded module "COMCTL32.DLL" at base 73dc0000 "4Ut221ym.exe" loaded module "OLEAUT32.DLL" at base 75200000 "4Ut221ym.exe" loaded module "APPHELP.DLL" at base 74d70000 "4Ut221ym.exe" loaded module "CLBCATQ.DLL" at base 762f0000 "4Ut221ym.exe" loaded module "KERNEL32.DLL" at base 76840000 "4Ut221ym.exe" loaded module "%WINDIR%\SYSTEM32\IEFRAME.DLL" at base 692b0000 "4Ut221ym.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 751f0000 "4Ut221ym.exe" loaded module "URLMON.DLL" at base 76380000 "4Ut221ym.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 72560000 "4Ut221ym.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73a00000 "4Ut221ym.exe" loaded module "%PROGRAMFILES%\INTERNET EXPLORER\IEPROXY.DLL" at base 72570000 "4Ut221ym.exe" loaded module "IERTUTIL.DLL" at base 76d80000 "4Ut221ym.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75550000 "4Ut221ym.exe" loaded module "USER32.DLL" at base 76520000 "4Ut221ym.exe" loaded module "SETUPAPI.DLL" at base 76be0000 "4Ut221ym.exe" loaded module "RPCRT4.DLL" at base 76920000 "4Ut221ym.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74d7000049:Tfcb,"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6" was detected as "Microsoft Cabinet" and name: "sfx" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6" was detected as "Microsoft Visual C/C++" and name: "Compiler" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6" was detected as "Microsoft Cabinet File" and name: "Archive" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6" was detected as "Microsoft Linker" and name: "Linker" "1Ta10aM7.exe" was detected as "Microsoft Cabinet" and name: "sfx" "1Ta10aM7.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "1Ta10aM7.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "1Ta10aM7.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "1Ta10aM7.exe" was detected as "Microsoft Linker" and name: "Linker" "sk2Qt47.exe" was detected as "Microsoft Cabinet" and name: "sfx" "sk2Qt47.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "sk2Qt47.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "sk2Qt47.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "sk2Qt47.exe" was detected as "Microsoft Linker" and name: "Linker" "ck0rG18.exe" was detected as "Microsoft Cabinet" and name: "sfx" "ck0rG18.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "ck0rG18.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "ck0rG18.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "ck0rG18.exe" was detected as "Microsoft Linker" and name: "Linker" "rq7SB75.exe" was detected as "Microsoft Cabinet" and name: "sfx" "rq7SB75.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "rq7SB75.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "rq7SB75.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "rq7SB75.exe" was detected as "Microsoft Linker" and name: "Linker" "4Ut221ym.exe" was detected as "Microsoft Cabinet" and name: "sfx" "4Ut221ym.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "4Ut221ym.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "4Ut221ym.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "4Ut221ym.exe" was detected as "Microsoft Linker" and name: "Linker" "2Dc2225.exe" was detected as "Microsoft Cabinet" and name: "sfx" "2Dc2225.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "2Dc2225.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "2Dc2225.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "2Dc2225.exe" was detected as "Microsoft Linker" and name: "Linker" "5sD6MZ0.exe" was detected as "Microsoft Cabinet" and name: "sfx" "5sD6MZ0.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "5sD6MZ0.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "5sD6MZ0.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "5sD6MZ0.exe" was detected as "Microsoft Linker" and name: "Linker" "FANBooster131.exe" was detected as "Microsoft Cabinet" and name: "sfx" "FANBooster131.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "FANBooster131.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "FANBooster131.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "FANBooster131.exe" was detected as "Microsoft Linker" and name: "Linker" "3vO15kf.exe" was detected as "Microsoft Cabinet" and name: "sfx" "3vO15kf.exe" was detected as "EP:Microsoft Visual C/C++" and name: "Compiler" "3vO15kf.exe" was detected as "Microsoft Visual C/C++" and name: "Compiler" "3vO15kf.exe" was detected as "Microsoft Cabinet File" and name: "Archive" "3vO15kf.exe" was detected as "Microsoft Linker" and name: "Linker"4a:T1749,"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "1Ta10aM7.exe" file has an entrypoint instructions - "call 0x4058d9,jmp 0x404f9f,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x404ea9,jmp 0x40512b,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x42a01c],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "sk2Qt47.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "ck0rG18.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "rq7SB75.exe" file has an entrypoint instructions - "call 0x407155,jmp 0x406a6a,push 0x58,push 0x4072b8,call 0x407208,xor ebx, ebx,mov dword ptr [ebp - 0x20], ebx,lea eax, [ebp - 0x68],push eax,call dword ptr [0x40a184],mov dword ptr [ebp - 4], ebx,mov eax, dword ptr fs:[0x18],mov esi, dword ptr [eax + 4],mov edi, ebx,mov edx, 0x4088ac,mov ecx, esi,xor eax, eax,lock cmpxchg dword ptr [edx], ecx,test eax, eax,je 0x406abc,cmp eax, esi,jne 0x406aaf,xor esi, esi,inc esi,mov edi, esi,jmp 0x406abf,push 0x3e8,call dword ptr [0x40a188],jmp 0x406a93,xor esi, esi,inc esi," "4Ut221ym.exe" file has an entrypoint instructions - "call 0x420aea,jmp 0x4203fb,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fdf0,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0,mov dword ptr [ecx + 4], 0x49fdf8,mov dword ptr [ecx], 0x49fdf0,ret ,push ebp,mov ebp, esp,push esi,push dword ptr [ebp + 8],mov esi, ecx,call 0x4205e7,mov dword ptr [esi], 0x49fe0c,mov eax, esi,pop esi,pop ebp,ret 4,and dword ptr [ecx + 4], 0,mov eax, ecx,and dword ptr [ecx + 8], 0," "2Dc2225.exe" file has an entrypoint instructions - "call 0x4058d9,jmp 0x404f9f,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x404ea9,jmp 0x40512b,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x42a01c],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "5sD6MZ0.exe" file has an entrypoint instructions - "call 0x4058d9,jmp 0x404f9f,mov ecx, dword ptr [ebp - 0xc],mov dword ptr fs:[0], ecx,pop ecx,pop edi,pop edi,pop esi,pop ebx,mov esp, ebp,pop ebp,push ecx,ret ,mov ecx, dword ptr [ebp - 0x10],xor ecx, ebp,call 0x404ea9,jmp 0x40512b,push eax,push dword ptr fs:[0],lea eax, [esp + 0xc],sub esp, dword ptr [esp + 0xc],push ebx,push esi,push edi,mov dword ptr [eax], ebp,mov ebp, eax,mov eax, dword ptr [0x42a01c],xor eax, ebp,push eax,push dword ptr [ebp - 4],mov dword ptr [ebp - 4], 0xffffffff,lea eax, [ebp - 0xc],mov dword ptr fs:[0], eax,ret ,push eax," "FANBooster131.exe" file has an entrypoint instructions - "call 0x40ff23,jmp 0x40f992,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,cmp ecx, dword ptr [0x413014],bnd jne 0x40fb1b,bnd ret ,bnd jmp 0x40fb49,push ebp,mov ebp, esp,push 0,call dword ptr [0x415068],push dword ptr [ebp + 8],call dword ptr [0x415064],push 0xc0000409,call dword ptr [0x415014],push eax,call dword ptr [0x415008],pop ebp,ret ,push ebp,mov ebp, esp,sub esp, 0x324,push 0x17,call 0x410540,test eax, eax,je 0x40fb62,push 2,pop ecx,int 0x29," "3vO15kf.exe" file has an entrypoint instructions - "call 0x4032e6,jne 0x4032ed,je 0x4032ed,test eax, 0xeb5b9ba5,or al, byte ptr [ecx + eax*4 - 0x15],out 0x32, al,add byte ptr [eax], al,jmp 0x4032fe,and ch, bl,cmc ,inc esp,and dh, byte ptr [esi + eax + 0x75],add al, 0x94,push ss,xor dword ptr [ecx - 0x3dbbb39], ebx,xor byte ptr [eax], al,add byte ptr [eax], al,sub esp, 4,jne 0x403317,je 0x403317,dec ebp,lahf ,mov edx, dword ptr [esp],add esp, 4,jmp 0x403325,mov byte ptr [ecx], ch,shr bl, 5,test al, 0xeb,stc ,mov byte ptr [eax - 0x4373fa15], ch,shr bl, 1,pop es,add eax, dword ptr fs:[edx],je 0x40333c,jne 0x40333c,jb 0x40337c,and dh, byte ptr [esi],in eax, dx,push dword ptr [eax + 0xa4],jne 0x403349,"4b:T732,"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "sk2Qt47.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "sk2Qt47.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "ck0rG18.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "ck0rG18.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "rq7SB75.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "rq7SB75.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "1Ta10aM7.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "1Ta10aM7.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "2Dc2225.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "2Dc2225.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "3vO15kf.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "3vO15kf.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "4Ut221ym.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "4Ut221ym.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "4Ut221ym.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "5sD6MZ0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "5sD6MZ0.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")4c:Tfda,Observed system executable string:"C:\Windows\system32\apphelp.dll" [Source: 00003480.00000D98.646855.00050000.wprm] Observed system executable string:"%WINDIR%\system32\advpack.dll" [Source: 00000000-00004372-00000C2B-277029102] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"" [Source: 00000000-00004372-00000BC1-277177137] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"" [Source: 00000000-00003464-00000BC1-278087753] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"" [Source: 00000000-00004112-00000BC1-278731543] Observed system executable string:"rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"" [Source: 00000000-00003480-00000BC1-280340150] Observed system executable string:"%WINDIR%\System32\shdocvw.dll" [Source: 00000000-00004036-00000C2B-281970184] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00004128-00000C2B-284115144] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00003544-00000C2B-286815283] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00003544-00000C2B-286922892] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003544-00000C2B-287063906] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003544-00000C2B-287230156] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003544-00000C2B-287252989] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00003544-00000C2B-287396315] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00003544-00000C2B-287534797] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00003544-00000C2B-287563679] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00003544-00000C2B-287609473] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\uxtheme.dll" [Source: 00000000-00003544-00000C2B-287696851] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00003544-00000C2B-287769701] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00003544-00000C2B-287789914] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00003544-00000C2B-287821402] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00003544-00000C2B-287843814] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00003544-00000C2B-288159338] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\WindowsBase\1a4cc316fb6d09525321fc0be44692d8\WindowsBase.ni.dll" [Source: 00000000-00003544-00000C2B-288494373] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\PresentationCore\468f4e17be144ca12a73a4297eacc9cc\PresentationCore.ni.dll" [Source: 00000000-00003544-00000C2B-288546381]4d:T718,Spawned process "sk2Qt47.exe" (UID: 00000000-00003464) Spawned process "ck0rG18.exe" (UID: 00000000-00004112) Spawned process "rq7SB75.exe" (UID: 00000000-00003480) Spawned process "1Ta10aM7.exe" (UID: 00000000-00002040) Spawned process "AppLaunch.exe" (UID: 00000000-00004036) Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offic ..." (UID: 00000000-00004068), Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offic ..." (UID: 00000000-00004128) Spawned process "2Dc2225.exe" (UID: 00000000-00000384) Spawned process "AppLaunch.exe" (UID: 00000000-00003544) Spawned process "3vO15kf.exe" (UID: 00000000-00003940) Spawned process "4Ut221ym.exe" (UID: 00000000-00000848) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00003176) Spawned process "iexplore.exe" with commandline "SCODEF:3176 CREDAT:275457 /prefetch:2" (UID: 00000000-00001868) Spawned process "iexplore.exe" with commandline "SCODEF:3176 CREDAT:209939 /prefetch:2" (UID: 00000000-00003252) Spawned process "iexplore.exe" with commandline "SCODEF:3176 CREDAT:734215 /prefetch:2" (UID: 00000000-00004104) Spawned process "iexplore.exe" with commandline "SCODEF:3176 CREDAT:603154 /prefetch:2" (UID: 00000000-00003744) Spawned process "iexplore.exe" with commandline "SCODEF:3176 CREDAT:996372 /prefetch:2" (UID: 00000000-00002148) Spawned process "iexplore.exe" with commandline "SCODEF:3176 CREDAT:2307092 /prefetch:2" (UID: 00000000-00002900) Spawned process "iexplore.exe" with commandline "SCODEF:3176 CREDAT:406598 /prefetch:2" (UID: 00000000-00004768) Spawned process "5sD6MZ0.exe" (UID: 00000000-00005084) Spawned process "AppLaunch.exe" (UID: 00000000-00005108)4e:T718,Spawned process "sk2Qt47.exe" (UID: 00000000-00003464) Spawned process "ck0rG18.exe" (UID: 00000000-00004112) Spawned process "rq7SB75.exe" (UID: 00000000-00003480) Spawned process "1Ta10aM7.exe" (UID: 00000000-00002040) Spawned process "AppLaunch.exe" (UID: 00000000-00004036) Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offic ..." (UID: 00000000-00004068), Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\Offic ..." (UID: 00000000-00004128) Spawned process "2Dc2225.exe" (UID: 00000000-00000384) Spawned process "AppLaunch.exe" (UID: 00000000-00003544) Spawned process "3vO15kf.exe" (UID: 00000000-00003940) Spawned process "4Ut221ym.exe" (UID: 00000000-00000848) Spawned process "iexplore.exe" with commandline "https://accounts.google.com/" (UID: 00000000-00003176) Spawned process "iexplore.exe" with commandline "SCODEF:3176 CREDAT:275457 /prefetch:2" (UID: 00000000-00001868) Spawned process "iexplore.exe" with commandline "SCODEF:3176 CREDAT:209939 /prefetch:2" (UID: 00000000-00003252) Spawned process "iexplore.exe" with commandline "SCODEF:3176 CREDAT:734215 /prefetch:2" (UID: 00000000-00004104) Spawned process "iexplore.exe" with commandline "SCODEF:3176 CREDAT:603154 /prefetch:2" (UID: 00000000-00003744) Spawned process "iexplore.exe" with commandline "SCODEF:3176 CREDAT:996372 /prefetch:2" (UID: 00000000-00002148) Spawned process "iexplore.exe" with commandline "SCODEF:3176 CREDAT:2307092 /prefetch:2" (UID: 00000000-00002900) Spawned process "iexplore.exe" with commandline "SCODEF:3176 CREDAT:406598 /prefetch:2" (UID: 00000000-00004768) Spawned process "5sD6MZ0.exe" (UID: 00000000-00005084) Spawned process "AppLaunch.exe" (UID: 00000000-00005108)4f:Tb80,The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: FC:B8:DC:ED:6F:0B:18:09:F8:63:FD:24:B5:43:5B:82:24:12:8D:CE; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: BC:1F:B5:F8:04:0C:7B:4F:F4:4F:20:30:D3:BA:66:E6:AF:8E:8F:AF; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: DB:16:C1:37:8D:6C:67:F5:7B:69:A5:CC:5A:E4:14:86:68:68:28:08; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 2F:3E:B0:A8:44:32:59:B0:15:E4:8E:5A:B5:0C:9C:5C:04:8F:36:E4; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 36:C6:15:F5:21:0B:24:21:0E:72:00:85:DD:C6:59:8A:81:39:9C:5F; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: 3C:F7:A3:68:2E:01:AD:2D:3C:81:BA:39:16:59:75:E3:82:26:E5:84; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global G2 TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US" (SHA1: 63:4D:64:4E:22:D8:E7:16:CF:C2:CD:55:B5:B4:7D:94:08:AE:C1:45; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 1B:51:1A:BE:AD:59:C6:CE:20:70:77:C0:BF:0E:00:43:B1:38:26:12; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B7:40:25:17:EE:AA:C8:0A:B0:46:81:18:6E:82:47:BD:78:51:CD:0A; see report for more information) The input sample is signed with a certificate issued by "CN=Amazon RSA 2048 M04, O=Amazon, C=US" (SHA1: EE:C1:BD:4E:34:75:3D:C4:2D:EA:58:F4:C4:BE:80:F1:E7:A2:AE:4E; see report for more information)50:T2d9b,"1Ta10aM7.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\1Ta10aM7.exe]- [targetUID: 00000000-00002040] "sk2Qt47.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\sk2Qt47.exe]- [targetUID: 00000000-00004372] "ck0rG18.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\ck0rG18.exe]- [targetUID: 00000000-00003464] "rq7SB75.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\rq7SB75.exe]- [targetUID: 00000000-00003480] "4Ut221ym.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\4Ut221ym.exe]- [targetUID: 00000000-00000848] "2Dc2225.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\2Dc2225.exe]- [targetUID: 00000000-00003480] "5sD6MZ0.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\5sD6MZ0.exe]- [targetUID: 00000000-00005084] "FANBooster131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "3vO15kf.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386"- Location: [%TEMP%\IXP002.TMP\3vO15kf.exe]- [targetUID: 00000000-00003940] "FANBooster131.lnk" has type "MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Unicoded MachineID hapubws-pc KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive NeedIndexed ctime=Wed Sep 2 22:19:31 2026 atime=Wed Sep 2 22:19:31 2026 mtime=Thu Mar 28 01:11:14 2019 length=102568 window=normal IDListSize 0x01f6 Root folder "59031A47-3F72-44A7-89C5-5595FE6B30EE" LocalBasePath "C:\Users\""- [targetUID: N/A] "index-Es9wMzhK_1_.js" has type "Unknown"- [targetUID: N/A] "7F163155784C838E248DC76B973A1804" has type "Unknown"- [targetUID: N/A] "FFjvfhElzS5Q3BEGcIBxzIxgo-3469oiGT9DWDYPz6DhfgQe914iiBfD-GevAmvU9KONMKn3YhINqU49pVNahkCkeiF2w9Hlit1WpaE_brMCJG_1_.css" has type "Unknown"- [targetUID: N/A] "identifier_2_.htm" has type "Unknown"- [targetUID: N/A] "identifier_1_.htm" has type "Unknown"- [targetUID: N/A] "login_1_.htm" has type "Unknown"- [targetUID: N/A] "api_1_.js" has type "Unknown"- [targetUID: N/A] "F1EYIM3X.htm" has type "HTML document ASCII text with very long lines (56821) with CRLF line terminators"- [targetUID: N/A] "dinosaur_1_.png" has type "Unknown"- [targetUID: N/A] "0839ECC4815B5D8D5ED699ED1C20C543" has type "Unknown"- [targetUID: N/A] "595CD0DCED5F6DE43A9C77C525C44511" has type "Unknown"- [targetUID: N/A] "75A092F4522006A97542D6AC4F4E69D2" has type "Unknown"- [targetUID: N/A] "9C69E496D546F49A980D7350EC49A180" has type "Unknown"- [targetUID: N/A] "imagestore.dat" has type "Unknown"- [targetUID: N/A] "68317AD4F8681C59B8DA0296EF2FCDBA" has type "Unknown"- [targetUID: N/A] "KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWub2bVmUiAw_1_.woff" has type "Unknown"- [targetUID: N/A] "KFOMCnqEu92Fr1ME7kSn66aGLdTylUAMQXC89YmC2DPNWubEbVmUiAw_1_.woff" has type "Unknown"- [targetUID: N/A] "main_1_.js" has type "Unknown"- [targetUID: N/A] "~DF4F148703ECD3B47F.TMP" has type "Unknown"- [targetUID: N/A] "~DF48CB1DF001E92E1C.TMP" has type "Unknown"- [targetUID: N/A] "~DF4DD3A20BB8585015.TMP" has type "Unknown"- [targetUID: N/A] "ay1hV6OlegS_1_.ico" has type "Unknown"- [targetUID: N/A] "_712BBA86-A723-11F1-ABBF-0050569172E9_.dat" has type "Unknown"- [targetUID: N/A] "Qw3hZQNGEDjaO2m6tqIqX5E-AVS5_rSejo46_PCTRspJ0OosolrBEJL3HMXfxQASluL2m_dANVawBpSF_1_.woff" has type "Unknown"- [targetUID: N/A] "en-US.4" has type "Unknown"- [targetUID: N/A] "~DFCF337D6076FC8178.TMP" has type "Unknown"- [targetUID: N/A] "~DFFFEDA6F6B4DDD716.TMP" has type "Unknown"- [targetUID: N/A] "~DFB4B08E2A17CB80CB.TMP" has type "Unknown"- [targetUID: N/A] "~DF14074ACA1678D782.TMP" has type "Unknown"- [targetUID: N/A] "~DF9705842FDE446FC4.TMP" has type "Unknown"- [targetUID: N/A] "~DF16CC35A79A665A16.TMP" has type "Unknown"- [targetUID: N/A] "~DF960FE0B339D68DE0.TMP" has type "Unknown"- [targetUID: N/A] "~DF802F3078ACA9FAFC.TMP" has type "Unknown"- [targetUID: N/A] "~DF840139D538D1F5B6.TMP" has type "Unknown"- [targetUID: N/A] "~DF57F0F235EB39CAB9.TMP" has type "Unknown"- [targetUID: N/A] "~DFE9D2743F83CC4013.TMP" has type "Unknown"- [targetUID: N/A] "firefox_1_.png" has type "Unknown"- [targetUID: N/A] "yt_logo_rgb_light_1_.png" has type "Unknown"- [targetUID: N/A] "httpErrorPagesScripts_1_" has type "Unknown"- [targetUID: N/A] "_6A6F76FC-A71C-11F1-ABBF-0050569172E9_.dat" has type "Unknown"- [targetUID: N/A] "_6A6F76FA-A71C-11F1-ABBF-0050569172E9_.dat" has type "Unknown"- [targetUID: N/A] "edgium_1_.png" has type "Unknown"- [targetUID: N/A] "login_2_.htm" has type "Unknown"- [targetUID: N/A] "RecoveryStore._6A6F76F8-A71C-11F1-ABBF-0050569172E9_.dat" has type "Unknown"- [targetUID: N/A] "chrome_1_.png" has type "Unknown"- [targetUID: N/A] "supported_browsers_1_.htm" has type "Unknown"- [targetUID: N/A] "epic-favicon-96x96_1_.png" has type "Unknown"- [targetUID: N/A] "_6A6F76FB-A71C-11F1-ABBF-0050569172E9_.dat" has type "Unknown"- [targetUID: N/A] "favicon_2_.ico" has type "Unknown"- [targetUID: N/A] "_4AD8BF92-A71D-11F1-ABBF-0050569172E9_.dat" has type "Unknown"- [targetUID: N/A] "_4AD8BF95-A71D-11F1-ABBF-0050569172E9_.dat" has type "Unknown"- [targetUID: N/A] "_712BBA85-A723-11F1-ABBF-0050569172E9_.dat" has type "Unknown"- [targetUID: N/A] "_4AD8BF91-A71D-11F1-ABBF-0050569172E9_.dat" has type "Unknown"- [targetUID: N/A] "_712BBA84-A723-11F1-ABBF-0050569172E9_.dat" has type "Unknown"- [targetUID: N/A] "_2959C266-A72A-11F1-ABBF-0050569172E9_.dat" has type "Unknown"- [targetUID: N/A] "_712BBA83-A723-11F1-ABBF-0050569172E9_.dat" has type "Unknown"- [targetUID: N/A] "_712BBA82-A723-11F1-ABBF-0050569172E9_.dat" has type "Unknown"- [targetUID: N/A] "_4AD8BF94-A71D-11F1-ABBF-0050569172E9_.dat" has type "Unknown"- [targetUID: N/A] "_4AD8BF93-A71D-11F1-ABBF-0050569172E9_.dat" has type "Unknown"- [targetUID: N/A] "_6A6F76FD-A71C-11F1-ABBF-0050569172E9_.dat" has type "Unknown"- [targetUID: N/A] "Vk4cmgW6O-5_1_.webp" has type "Unknown"- [targetUID: N/A] "errorPageStrings_1_" has type "Unknown"- [targetUID: N/A] "B0IAA2Z62CUIL0WVR42L.temp" has type "Unknown"- [targetUID: N/A] "googlelogo_color_74x24dp_1_.png" has type "Unknown"- [targetUID: N/A] "opera_1_.png" has type "Unknown"- [targetUID: N/A] "index-CfssTcG8_1_.css" has type "Unknown"- [targetUID: N/A] "Registry.pol" has type "Unknown"- [targetUID: N/A] "8B2B9A00839EED1DFDCCC3BFC2F5DF12" has type "Unknown"- [targetUID: N/A] "dnserror_1_" has type "Unknown"- [targetUID: N/A] "B76BE66D46C355931939D8CF818D03FD_68DC46933CF3DE41CC968E0784D43DC3" has type "Unknown"- [targetUID: N/A] "BAD725C80F9E10846F35D039A996E4A8_88B6AE015495C1ECC395D19C1DD02894" has type "Unknown"- [targetUID: N/A] "24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA" has type "Unknown"- [targetUID: N/A] "75CA58072B9926F763A91F0CC2798706_3AD253ACA02D44EA5FD30683B8A5B5FA" has type "Unknown"- [targetUID: N/A] "NewErrorPageTemplate_1_" has type "Unknown"- [targetUID: N/A] "CheckConnection_1_.htm" has type "Unknown"- [targetUID: N/A] "favicon_3_.ico" has type "Unknown"- [targetUID: N/A] "DABA17F5E36CBE65640DD2FE24F104E7" has type "Unknown"- [targetUID: N/A] "3B7CEBA4139B7484BAF665AC9E712D61" has type "Unknown"- [targetUID: N/A] "05DDC6AA91765AACACDB0A5F96DF8199" has type "Unknown"- [targetUID: N/A] "620BEF1064BD8E252C599957B3C91896" has type "Unknown"- [targetUID: N/A] "892580777767344DCAEF580FFA143EA6_EF1B61DD3F93C58DBD0734F13C15C0F6" has type "Unknown"- [targetUID: N/A] "EKZM8SMB.txt" has type "Unknown"- [targetUID: N/A] "31XN25R7.txt" has type "Unknown"- [targetUID: N/A] "QW190NWK.txt" has type "Unknown"- [targetUID: N/A] "BCB67D7ECB470284AF35679F339E879F" has type "Unknown"- [targetUID: N/A] "V8JQUKDU.txt" has type "Unknown"- [targetUID: N/A] "1166XN53.txt" has type "Unknown"- [targetUID: N/A] "U18BRVVE.txt" has type "Unknown"- [targetUID: N/A] "908MRENR.txt" has type "Unknown"- [targetUID: N/A] "JRD1IWQZ.txt" has type "Unknown"- [targetUID: N/A] "M2IHUM3U.txt" has type "Unknown"- [targetUID: N/A] "B46811C17859FFB409CF0E904A4AA8F8" has type "Unknown"- [targetUID: N/A] "249P27QL.txt" has type "Unknown"- [targetUID: N/A] "QX6WCDG2.txt" has type "Unknown"- [targetUID: N/A] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_49536AB5156BDD74EFF881D01C36A419" has type "Unknown"- [targetUID: N/A] "D1BEC81CCAFDC823A062FF26A89A6B6D_B9B4646227E0866A0D172EA2B644DB92" has type "Unknown"- [targetUID: N/A] "59D76868C250B3240414CE3EFBB12518_E84C7BB52C4A8340F810725B568484F4" has type "Unknown"- [targetUID: N/A] "6CAFE3B721B7CE350C58A8F3EB28AA44_C4935EE08CAA8E5372EBE50CFA866626" has type "Unknown"- [targetUID: N/A] "E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F" has type "Unknown"- [targetUID: N/A] "F28CC103A764A74B222272A7D2BDDA5C" has type "Unknown"- [targetUID: N/A] "FHIRO4K4.txt" has type "Unknown"- [targetUID: N/A] "26C212D9399727259664BDFCA073966E_912C3CA51DE6018A7BE4CA7BC64AAFCD" has type "Unknown"- [targetUID: N/A] "EVSH8PZN.txt" has type "Unknown"- [targetUID: N/A] "C30A8653A628E8368A1D33BB7E570E4E" has type "Unknown"- [targetUID: N/A] "55D343B052AE566C8BF677731180E634" has type "Unknown"- [targetUID: N/A] "15MW09UK.txt" has type "Unknown"- [targetUID: N/A] "CC640368512A0520EF9FE4E00D0FE9C4" has type "Unknown"- [targetUID: N/A] "B54B00CE250A47F2A29BFE4A70858A02" has type "Unknown"- [targetUID: N/A] "BA8E834886E353ED96ACC8AB83273509" has type "Unknown"- [targetUID: N/A] "O4UIO3RN.htm" has type "gzip compressed data original size modulo 2^32 365"- [targetUID: N/A] "J6OUQQ7M.txt" has type "Unknown"- [targetUID: N/A] "favicon_1_.htm" has type "Unknown"- [targetUID: N/A] "D77OVPNX.txt" has type "Unknown"- [targetUID: N/A] "S7ZWYVDZ.txt" has type "Unknown"- [targetUID: N/A] "9IL1CTXZ.txt" has type "Unknown"- [targetUID: N/A] "F6MVE94Q.txt" has type "Unknown"- [targetUID: N/A] "6HI8K8QL.txt" has type "Unknown"- [targetUID: N/A] "gpt.ini" has type "Unknown"- [targetUID: N/A] "9ZZJVXBI.txt" has type "Unknown"- [targetUID: N/A] "NSTAP12U.txt" has type "Unknown"- [targetUID: N/A] "CJANLBKS.txt" has type "Unknown"- [targetUID: N/A] "IRHJ2M0Z.txt" has type "Unknown"- [targetUID: N/A] "www.epicgames_1_.xml" has type "Unknown"- [targetUID: N/A] "bscframe_1_.htm" has type "Unknown"- [targetUID: N/A] "rise131M9Asphalt.tmp" has type "Unknown"- [targetUID: N/A] "OfficeTrackerNMP131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "MaxLoonaFest131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "~DF7D7D02400C057A80.TMP" has type "Unknown"- [targetUID: N/A] "~DFBD72A33580E5A80C.TMP" has type "Unknown"- [targetUID: N/A] "httpErrorPagesScripts_2_" has type "Unknown"- [targetUID: N/A] "errorPageStrings_2_" has type "Unknown"- [targetUID: N/A] "dnserror_2_" has type "Unknown"- [targetUID: N/A] "NewErrorPageTemplate_2_" has type "Unknown"- [targetUID: N/A] "QXSK15M3.htm" has type "gzip compressed data original size modulo 2^32 365"- [targetUID: N/A] "ZFGJH5NR.htm" has type "gzip compressed data original size modulo 2^32 365"- [targetUID: N/A] "7JQ9H3W3.txt" has type "Unknown"- [targetUID: N/A] "JG9WC9W0.txt" has type "Unknown"- [targetUID: N/A] "8BX9J0H5.txt" has type "Unknown"- [targetUID: N/A]51:Tb94,"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\DIAGNOSTICS"; Key: ""; Value: "")52:T10d8,"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "853FC7D709954581B64B381F2C51FD68628EBC03DBCAD593D04266947F6EFDB6"; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\CMF\CONFIG"; Key: "SYSTEM"; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\WINDOWS ERROR REPORTING\WMR"; Key: "DISABLE"; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SETUP"; Key: "SOURCEPATH"; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION"; Key: "DEVICEPATH"; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US"; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US"; Value: "") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\DATACOLLECTION"; Key: "COMMERCIALDATAOPTIN"; Value: "")53:T511,"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\sk2qt47.exe" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp000.tmp\5sd6mz0.exe" "sk2Qt47.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\ck0rg18.exe" "sk2Qt47.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp001.tmp\4ut221ym.exe" "ck0rG18.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\rq7sb75.exe" "ck0rG18.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp002.tmp\3vo15kf.exe" "rq7SB75.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\1ta10am7.exe" "rq7SB75.exe" reads file "c:\users\%osuser%\appdata\local\temp\ixp003.tmp\2dc2225.exe" "1Ta10aM7.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe" "2Dc2225.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe" "4Ut221ym.exe" reads file "c:\windows\system32\ieframe.dll" "4Ut221ym.exe" reads file "c:\program files\internet explorer\ieproxy.dll" "4Ut221ym.exe" reads file "c:\program files\internet explorer\iexplore.exe" "5sD6MZ0.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\applaunch.exe"54:T435,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Reference to an external IP address lookup service identified Matched sigs: Contains ability to detect presence of virtual environment (API string) Matched sigs: Able to retrieve information set for devices (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Contains ability to detect sandbox (imports API) Matched sigs: Contains ability to delay the execution of current thread Matched sigs: Contains ability to query volume size Matched sigs: Contains ability to detect virtual environment (API)55:Tc9a,"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to touch file "C:\853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe.Local\" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\COMCTL32.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to touch file "C:\Cabinet.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to touch file "C:\Windows\system32\Cabinet.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to touch file "C:\VERSION.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to touch file "C:\Windows\system32\VERSION.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to touch file "C:\Windows\system32\apphelp.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to touch file "C:\Windows\AppPatch\AcLayers.DLL" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to touch file "C:\SspiCli.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to touch file "C:\Windows\system32\SspiCli.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to touch file "C:\WINSPOOL.DRV" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to touch file "C:\Windows\system32\WINSPOOL.DRV" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to touch file "C:\MPR.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to touch file "C:\Windows\system32\MPR.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to touch file "C:\Windows\AppPatch\AcGenral.DLL" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to touch file "C:\UxTheme.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to touch file "C:\Windows\system32\UxTheme.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to touch file "C:\WINMM.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to touch file "C:\Windows\system32\WINMM.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to touch file "C:\samcli.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to touch file "C:\Windows\system32\samcli.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to touch file "C:\MSACM32.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to touch file "C:\Windows\system32\MSACM32.dll"56:Td25,"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\Cabinet.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\VERSION.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\SspiCli.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\MPR.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\UxTheme.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\WINMM.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\samcli.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\MSACM32.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\sfc.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\sfc_os.DLL" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\dwmapi.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\sk2Qt47.exe" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\FLTLIB.DLL" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\MSVCP140.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\ucrtbase.DLL" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\5sD6MZ0.exe" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll"57:T87a,"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe.Local\" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\WINSPOOL.DRV" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe.Config" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\853FC7D709954581B64B381F2C51FD68628EBC03DBCAD593D04266947F6EFDB6.EXE.LOCAL" "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" trying to access non-existent file "C:\853FC7D709954581B64B381F2C51FD68628EBC03DBCAD593D04266947F6EFDB6.EXE.CONFIG" "sk2Qt47.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\sk2Qt47.exe.Local\" "sk2Qt47.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\WINSPOOL.DRV" "sk2Qt47.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\sk2Qt47.exe.Config" "sk2Qt47.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" "sk2Qt47.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\SK2QT47.EXE.LOCAL" "sk2Qt47.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\SK2QT47.EXE.CONFIG" "ck0rG18.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\ck0rG18.exe.Local\" "ck0rG18.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\WINSPOOL.DRV" "ck0rG18.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\ck0rG18.exe.Config" "ck0rG18.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP"58:T4b2,Found reference to API "WNetCancelConnection2W" (Indicator: "WNetCancelConnection"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "WNetUseConnectionW" (Indicator: "WNetUseConnection"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "WNetAddConnection2W" (Indicator: "WNetAddConnection"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "WNetAddConnection2W" (Indicator: "WNetAddConnection"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "WNetUseConnectionW" (Indicator: "WNetUseConnection"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "WNetCancelConnection2W" (Indicator: "WNetCancelConnection"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "WNetGetConnectionW" (Indicator: "WNetGetConnection"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp")59:T63d,Found http requests in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D" Found http requests in header "GET /r/r1.crl" Found http requests in header "GET /wr2/oBFYYahzgVI.crl" Found http requests in header "GET /wr2/75r4ZyA3vA0.crl" Found http requests in header "GET /wr2/9UVbN0w5E6Y.crl" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D" Found http requests in header "GET /r/gsr1.crl" Found http requests in header "GET /r/r4.crl" Found http requests in header "GET /we1/pl4XiTjSDSk.crl" Found http requests in header "GET /we1/G0k-BqpOX8k.crl" Found http requests in header "GET /we1/x6Eg-8TSwUw.crl" Found http requests in header "GET /rootg2.cer" Found http requests in header "GET /rootg2.crl" Found http requests in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D" Found http requests in header "GET /rootca1.crl" Found http requests in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D" Found http requests in header "GET /r2m04.crl" Found http requests in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D" Found http requests in header "GET /we2/yK5nPhtHKQs.crl" Found http requests in header "GET /wr2/oQ6nyr8F0m0.crl"5a:T317e,Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:ApDeWzUPMX_zt9w3zWUuvLHSGGKzQA:uhRdfkwsYgT2aIKUConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S286279774:1788387596647903 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:ApDeWzUPMX_zt9w3zWUuvLHSGGKzQA:uhRdfkwsYgT2aIKU"; in File: "SSL") Found requests in header "GET /_/bscframe HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:ApDeWzUPMX_zt9w3zWUuvLHSGGKzQA:uhRdfkwsYgT2aIKU"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:ApDeWzUPMX_zt9w3zWUuvLHSGGKzQA:uhRdfkwsYgT2aIKU"; in File: "SSL") Found requests in header "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:ApDeWzUPMX_zt9w3zWUuvLHSGGKzQA:uhRdfkwsYgT2aIKU"; in File: "SSL") Found requests in header "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-AliveCookie: __Host-GAPS=1:ApDeWzUPMX_zt9w3zWUuvLHSGGKzQA:uhRdfkwsYgT2aIKU"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S1023921693:1788387602432218 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:ApDeWzUPMX_zt9w3zWUuvLHSGGKzQA:uhRdfkwsYgT2aIKUConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "GET /v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S825429695:1788387626439958 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:ApDeWzUPMX_zt9w3zWUuvLHSGGKzQA:uhRdfkwsYgT2aIKUConnection: Keep-AliveDNT: 1"; in File: "SSL") Found requests in header "POST /v3/signin/identifier?continue=https://accounts.google.com/&dsh=S825429695:1788387626439958&flowEntry=ServiceLogin&flowName=WebLiteSignIn&followup=https://accounts.google.com/ HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: accounts.google.comContent-Length: 260DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:ApDeWzUPMX_zt9w3zWUuvLHSGGKzQA:uhRdfkwsYgT2aIKUidentifier=&hiddenPassword=&usi=S825429695%3A1788387626439958&domain=®ion=US&=&bgresponse=FNLReferenceError%3A+%27Symbol%27+is+undefined&pstMsg=1&checkConnection=youtube%3A59928&checkedDomains=youtube&action=1&at=ALTjPXM1JNmzBBt_AzBBqDuloz75%3A1788387626609"; in File: "SSL") Found requests in header "POST /v3/signin/identifier?checkConnection=youtube:59928&checkedDomains=youtube&continue=https://accounts.google.com/&dsh=S825429695:1788387626439958&flowEntry=ServiceLogin&flowName=WebLiteSignIn&followup=https://accounts.google.com/&pstMsg=1 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoContent-Type: application/x-www-form-urlencodedAccept-Encoding: gzip, deflateHost: accounts.google.comContent-Length: 257DNT: 1Connection: Keep-AliveCache-Control: no-cacheCookie: __Host-GAPS=1:ApDeWzUPMX_zt9w3zWUuvLHSGGKzQA:uhRdfkwsYgT2aIKUidentifier=&hiddenPassword=&usi=S825429695%3A1788387626439958&domain=®ion=US&=&bgresponse=FNLReferenceError%3A+%27Symbol%27+is+undefined&pstMsg=1&checkConnection=youtube%3A38&checkedDomains=youtube&action=1&at=ALTjPXNskWOVqZF1UDLDjDmvV-Yc%3A1788387656681"; in File: "SSL") Found requests in header "GET /images/branding/googlelogo/2x/googlelogo_color_74x24dp.png HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: ssl.gstatic.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=-496288875×tamp=1788387595873 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=1720256536×tamp=1788387601049 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=1143963030×tamp=1788393195920 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=GmRgtFH9d7FS14E6b-hLhXncfhrGTMpT9bl_74Us45hGpSUWMkwtAYtohufT4pmVA-WWXt3GvcOwXB-hLeJiYLVVPzy0UzUQww1NCvNoyZC2MyACNe8qI3YTUsSiUixtOKNpXgDf6EZ6kPQ36tgTnrsd0kfQiXZgS98jG7s3kedlHJ4BkjCL5G5NOwHzYkgjw7S1VeRZuykB4ogi6Jn2lWNQGcMfN_yEjoL60tekv72WW9IGryWdKDTZRbatVmmJxU5rkT1cICT4nuho3hq1XTvoz3b0OVsfCy9Xyj5klM8CRMYmDG0wV97scwP419QbeQ9b2_8Uv4ELOSadFgiNoQ; hideBrowserUpgradeBox=true; VISITOR_INFO1_LIVE=PzhXMgTYT9g; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgag%3D%3D; __Secure-ROLLOUT_TOKEN=CMG05bmX2vmAmwEQqd-Eh_fQlgMYqd-Eh_fQlgM%3D; YSC=fPkqyFntqRI"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=-83697303×tamp=1788402200799 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=GmRgtFH9d7FS14E6b-hLhXncfhrGTMpT9bl_74Us45hGpSUWMkwtAYtohufT4pmVA-WWXt3GvcOwXB-hLeJiYLVVPzy0UzUQww1NCvNoyZC2MyACNe8qI3YTUsSiUixtOKNpXgDf6EZ6kPQ36tgTnrsd0kfQiXZgS98jG7s3kedlHJ4BkjCL5G5NOwHzYkgjw7S1VeRZuykB4ogi6Jn2lWNQGcMfN_yEjoL60tekv72WW9IGryWdKDTZRbatVmmJxU5rkT1cICT4nuho3hq1XTvoz3b0OVsfCy9Xyj5klM8CRMYmDG0wV97scwP419QbeQ9b2_8Uv4ELOSadFgiNoQ; hideBrowserUpgradeBox=true; VISITOR_INFO1_LIVE=PzhXMgTYT9g; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgag%3D%3D; __Secure-ROLLOUT_TOKEN=CMG05bmX2vmAmwEQqd-Eh_fQlgMYqd-Eh_fQlgM%3D; YSC=fPkqyFntqRI"; in File: "SSL") Found requests in header "GET /accounts/CheckConnection?pmpo=https://accounts.google.com&v=1209989808×tamp=1788404268650 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Referer: https://accounts.google.com/Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.youtube.comDNT: 1Connection: Keep-AliveCookie: CONSENT=WP.2676ba; __Secure-YNID=21.YT=GmRgtFH9d7FS14E6b-hLhXncfhrGTMpT9bl_74Us45hGpSUWMkwtAYtohufT4pmVA-WWXt3GvcOwXB-hLeJiYLVVPzy0UzUQww1NCvNoyZC2MyACNe8qI3YTUsSiUixtOKNpXgDf6EZ6kPQ36tgTnrsd0kfQiXZgS98jG7s3kedlHJ4BkjCL5G5NOwHzYkgjw7S1VeRZuykB4ogi6Jn2lWNQGcMfN_yEjoL60tekv72WW9IGryWdKDTZRbatVmmJxU5rkT1cICT4nuho3hq1XTvoz3b0OVsfCy9Xyj5klM8CRMYmDG0wV97scwP419QbeQ9b2_8Uv4ELOSadFgiNoQ; hideBrowserUpgradeBox=true; VISITOR_INFO1_LIVE=PzhXMgTYT9g; VISITOR_PRIVACY_METADATA=CgJVUxIEGgAgag%3D%3D; __Secure-ROLLOUT_TOKEN=CMG05bmX2vmAmwEQqd-Eh_fQlgMYqd-Eh_fQlgM%3D; YSC=fPkqyFntqRI"; in File: "SSL") Found requests in header "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com"; in File: "SSL") Found requests in header "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/v5/yQ/l/0,cross/FFjvfhElzS5Q3BEGcIBxzIxgo-3469oiGT9DWDYPz6DhfgQe914iiBfD-GevAmvU9KONMKn3YhINqU49pVNahkCkeiF2w9Hlit1WpaE_brMCJG.css HTTP/1.1Accept: text/css, */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/y1/r/ay1hV6OlegS.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yP/r/kUc6oHI0fJd.woff HTTP/1.1Accept: */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.facebook.comAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yH/r/uR_TIYVE0g0.eot HTTP/1.1Accept: */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.facebook.comAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/y5/r/Vk4cmgW6O-5.webp HTTP/1.1Accept: image/png, image/svg+xml, image/*;q=0.8, */*;q=0.5Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL") Found requests in header "GET /rsrc.php/yf/r/ipwqPKyH2FY.ttf HTTP/1.1Accept: */*Referer: https://www.facebook.com/loginAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoOrigin: https://www.facebook.comAccept-Encoding: gzip, deflateHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive"; in File: "SSL")5b:T856,Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "InternetOpenUrlW" (Indicator: "InternetOpen"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp")5c:T692,file/memory contains long string with (Indicator: " connect "; File: "dnserror_1_") Found reference to API "inet_addr" (Indicator: "inet_addr"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "inet_ntoa" (Indicator: "inet_ntoa"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "gethostname" (Indicator: "gethostname"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "gethostbyname" (Indicator: "gethostbyname"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00000848.00000000.82599.01270000.00000002.mdmp, 00000000-00000848.00000001.84524.01270000.00000002.mdmp") Found reference to API "Do you accept all of the terms of the preceding License Agreement? If you choose No, Install will close. To install you must accept this agreement." (Indicator: " accept "; Source: "00000000-00003464.00000000.81378.00AEA000.00000002.mdmp")5d:Ta872,"GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" "GET /ServiceLogin?passive=1209600&continue=https%3A%2F%2Faccounts.google.com%2F&followup=https%3A%2F%2Faccounts.google.com%2F HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comCookie: __Host-GAPS=1:ApDeWzUPMX_zt9w3zWUuvLHSGGKzQA:uhRdfkwsYgT2aIKUConnection: Keep-AliveDNT: 1" "GET /v3/signin/identifier?continue=https://accounts.google.com/&followup=https://accounts.google.com/&passive=1209600&flowName=WebLiteSignIn&flowEntry=ServiceLogin&dsh=S286279774:1788387596647903 HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comConnection: Keep-AliveDNT: 1Cookie: __Host-GAPS=1:ApDeWzUPMX_zt9w3zWUuvLHSGGKzQA:uhRdfkwsYgT2aIKU" "0000000100000001�0000000100000001000000010000000100000001000000010000000100000001�00000001�0000000100000001�0000001r10e3��W��tƚ�zY��Ne�M��Il��v:�D�+�d9��]`A�,��㹽�ؑ��=�=��;��ۯ�oΐ��'��@V�u*{p��;��HV{i�^{f�3��\��#��{��12�~54��`��R��b��:��Rp'��?�8=�>vo�[i�U`�2{\[�{5��m��}�2�t��|��9LS��]l�}�xCC�Kp�V�|V�}O��r;0��W��n4�UO�7�;�R�uOXZ��$��2V��/-�3��CKB�f)u\R�q��\r�uXPf2i�e@�~y��x�R��1�t��ZN��D�W��OP��'Qǹ��0L�so�`B��.�4�7h��c��+��Ih��q��`�Z>;��3P��e��ĽZ#�V`��u�F>2��%m�S�[m��:E>��C��!�(�ƮJ�jr��!�q�GC$�\zCF��9�.IE��M�[��`X�I��F��7��⇟YUa�6�:Κ�q0�5п��Q��p��W�g��|6eƷa��9�}�6�#n�d;��Е>,4�b~�(S^Yt�2쑪{2�e�&��7D��U��/�+(}a�c��O~�f��_!�6ǐ�G��05le1�fS{�U 5(Մ#(�D�Z:t��P�م�X�I�HY��g�S�#ݚW��o�b#}�֥��9(�&t>D�P�hNn`�7z�,��ћK�z5%�ہ��[�U��n��p��41:�j=�nU�a��`q��r�p��W��c�1�`�� s��$\��:�sg��(J��N��XQ�f��@�'ߧ[L��2H��T��be6쥘O*;�e�P��R3�&>��!�Gb!s��2إ� ��Ι�M�j��Uv��>Z^�MC�<�z:�>d�kW+��h�6`��I��X�3�A��|C�W��L��L�� xMB��?A��P"�v�(h�]]�Jc�Cgq*��}yl��n��_ɖKr,��y"fM��`=�o�ܠs�&rOޥ��(܋��>P��=2�u\Q��N�l�z^f��\�Ys��J�4vZ��Q�%c�{��`U?��+�n*��2��P)��)I��Df2�͡�D�a��2H�X�KBj�Q��d��mD�F&�?�E~8O/��:wO)Pb�^b+k6X��d�s��T��n�px�N�^E��=N��p��M5�WR)��"�A�N)��J�V'�)�n��VtS�ctC6��,�"�jn��Z��*i��#5�i�BU��]V)�J~B��s�nD�u��|��;�EͶu��^��B�� a��*H"��h�:T�.�E��J��o��}\��b�se1�ag�KR��t;��gfX�C�+�*�В!�MZEз5�q�溵�_m��{UT�"?��PG��H��@�!"l�;�ni̯oHE|��(��]�;�dK䎶'�,O0�U!&RPҀ��QiP�[��*%�{�Q�V8*�YU��c��=�N��s��&O{�5��z��w��2�l9�Bq.��p�P'�p��⋜([��@�|��QU��?^�.d�VЕ=?��S\��dd^�H[�l�A�V�R�6.�t�厔��g8��n.�}4��pp�Mds�7LK6�h�Ȗ�B܈�r�O�r�~ٓ�{�wh+�S�}o��(x��w��1��_��H��j��i�v�7�s�4�y%��k��ОD&��L*ڙ��U�e�D.��3&2�qؑ�|�#^+�NHPTuJN�Q9q�?>KӈLE��yi0�C��M��{r82,E�G�֝8�G;��C��%7,��!r��8��|>B�^ΰJ�}�x��V~Y{��ي*�ɩ��Gˑ0S]�]�&�I�f��I�~(E�t��.��aY��&^h"9��xZ�{ul�S�j;*p�c��*�mW��k��;�J�o�oü��һ�<��Hz�v�징G��.y��$��}d}��՗��fV��Kn4t�P��*��!��LC�42[;ǅ6�(�Z�oD�v��>zJ�S��t�_x�e�>R��XT"�C-�E��<�u��G��6�1`X�h��(�ڰj:�~n�/�5�ČP�V��u�'�c��\;�m'�j`u�B6v�\�4l�6��4��Hd�A��S�w��ഖT�̐�匾��_��", "00000001�00000001]00000001i00000001s00000001�00000001<0000000100000001�010de+��/ìI��ڭ�I !��p8cC��W��d�&y�ݚ�LaK�V��t�l&Tֶ.r�&��zag�4�7��|*��EL&"��)��S4��;�+E��D{e�R4Q�6I��e�p��0�Y��s.�e�-�S��L낖�sZ6�e��*�A[&�K��yrW��`�4/�Xg��7�j"G角nϊoӘ'�ʇ�5�'��x�4b��'x� ��Z��1��Ih3��2a��$��q+��l��x��p�ȓ$T�ǉ̥:Ħ��W|]<��c��L%�#�DY�$�@�=|9َG1+_`ʡ��ty�H�W�N1B��)��)9�s��K�8w�i%�؈2("6rW�1��J�R��*��L�>��io��ഷt�b�uv=6�U��&�g=�>��M{ _´��/k�ׁ�`N��љJ��J� mPZ{9^��q��SV;�JA�T�p�CY3��@�0W==Y��A�BL��w)Kq��E|��">�ex��V��^O��Mz˳e�1��+��(�ې�EI�3�f|lk��v�o��+�l#�n�-z��Y5>�!�y��Xg��=��ΎG#��IbiK񃒏�Ұ��<�K��;�^�Ǔ��~*t6r�)0)M�QZ��_bGļVѵL��=Ͳ]c��"||]", "��&�w*Eh>I{��lNk�w�<�C�18�[�~M^ܓ��~��O�e4�f��ە�#Cџ7��^_;�?��>^��V�o|7�sG�:��;L��f�B��[��r��qc�N��3��$��t�t��#�M��|��/��jv��|/CɣO��e��)�4�ta��l��-g��9s�7Q��B%@��:��(��ާBȗB��7wnh�'�_4sU;�w��ۣ`f�oC4/�R$H㓐��@�g�qD��/�L�9��rH��Ak8��kd�.gv��v��)��-��V��V�H�r�U&�U�Bg�ϟ0�N��ZA�O�/w��w��B��Eh��m~��1cf'5uT0&}\��*tc=}��愅�if��='J3`�l�wn��À�cd��)�*^��r9硚W��.��`hYl��;�;K��&�ף��a��l;�H֨M�]wj��f��P�N�^�)��'��·��V\#��gp;��j��I�vw��46b#�lL��t��B�60��9<�qi�Y��aRo�z��O�bY�b*�?�G$��c��e�:�e��uTDt^h,��&&�5E��[*#�qP ��|7�_��g��u�)d(�ޑ��&:r��R�}��-��>�:��**�M�IHƩ�*��r��}�8��d�t�M�*ip}p��]|�8�s>X=�4f��j�v�j�n��LMq[�v��7�t��o�Cxd�[h��e��JzRhîq~Pgbl��F'�8��ݗ�6&�!�M��-)�o��N��u!�+G�v\k��$|�eysqbiq��p�ҝ�9��@�F��Dy�&pF8P�-P\��o��o/ˏN1� ��O��A�Cg׏�Aĥ�n��l��֦S��#�w)��Һ�&߁/rayܴ�@��rK^��=��[W��zA��7KfaeE�g@kri��2�cf�]�Q5��P�E��7�2�A��-�6k�f�̴;D��F?�FCc�X^=zjg�vi��9x��5�!��S��?y^��j^UNr��R�+�K:�f�;�v�10�L��~ki?��a��[q�X=�h$�M10�_=�4�F��Fo�*>s�4��6Jx(n!��Q�%B%J�x��k�ml��N��R�^��Lg�y� ��6��Ux6�3b��?��f�ܝ_��E78��؛�p˲��խ��>�٧�]�j�g)_*�^LQw�.Rx��QhZ��e7ߦ��l�X7~]|��", "�.�9��/AW�#��~R��s��>�)AH��q�i�g�xe�A�� 5h��/��9T�[�/�5wZ�=�G`��`��>\g}��x�x�w��d�e�'�� 0��f��[�?JC��Z��<��xkS��O�Lx�Ƿ��"�(Z��]��j�{�8}*��ֲ�f�ӫb�SQ9}ܐ�J�#V�p��B��h!/��,q��,��6�Tn�F_-Z�V�1Q&ˬ0�#�j��4W�%�lS\�(\`<��@��~>Ʀ�Ԋ�)�[��CV�j/��e�"Bʶ]v��Ѩ��t�t��V"��~�A�N*�4�A��>�%J�28��u=2z��͛��u�⩝�5k/m��#x�B*�1�NǺ��E7rN'Fk?3�/%��K~ȠpGO@�R<;w�&��u[�'�b�� 1D�`DP��o/f\|܎��܂\��o�@,햳�zT�AH偑��{��4m@ܱ5��aW~�}�~P��Z��{3{��xu��s�E��כ��O�=÷�f��J��@*Z.�@͜�O�|x!�a|'��7�j�gJ�=�I��k�/p��|��E�&�=��(��:P?m�|��l�̄��R+;��z�$q�A��y�\ή^�uW�x��$�1CZM��فnFMDRe��}�~'H�O��4�+��27�9�#��'.��B\�-��X_S)�/�'y^��:w��l�*��.ע�u��toW'��7��cl��>N:HL��(>Z%\B��q�ug�ʳǧ�^�S�&��\�ʹ[/��֠�1y��*��q9�Tx!�ϫ2�2�q�i*��5k�Rҡ�_�ȗ��Tnt��!v�C��\&g�T&�'4�I�H��E�P�'r��7��O�}T~��0�,)��M2��N.9z�%c\�J�ҙcD^b��W��_��tnY#չ��>�R�&r�%ެ9�iK��XR�5��uel��+�r�Uv�*܃��{Ɛ�nk`T�;��-��b��9L+��l4�x1�Iǈ'��@^��<��T>G�5d׻)�L��+ݖ��. �-�� 9úi-�D��C$�з�|B$�s\�b*��+fe�rqr6�Z��$��n��\z�>�L��0��_��*'h�z6��q��tނ0fs�.4,)��l��0N�v�0,r��ƽ_�&\zA�OqC�w�+�~��N��U��Aw��[�P��L@�Q��*�=��û.�F��<��'�Ff��L+�">�/|(�?cq��tAȆ��=��)��T�O��?�P��I��Bk��-�e>n,nTf�FO9��y��c��e��?�Ī5G� ��L5��,�$I�]'B��A��Uak��{cÂ��̓!D5��υ�s*-��xZ��"̀i��38�%�RF��'(}o�8j!�Fmճ8%�r��"��h�$?L�s=��:��}r<�D*i�w}+��q��a��p:(��?�F~�N<�@�7⟇�Z�ͳ;��lt��7�-j�N��m�iICP�1҈�a^c��{s��p��Oz�.;�fr̮·À�t��m��f�P�I�n_��)Ƹ�l�P�Y1�N��|�,��rp�q,��:��K'� �X/��n��_CH��/p�;GΌ��!U��e�K.��e��l��[�U#�#4EUٔ2��ld�Ԧ$9Ig~��V6G� �+PE!��aUy�VIU�P�8S+Z�B�`^�k��s��َ6��Q^M��-�Qw:�n�M�bd!"�`��/�/��k_[��L� �oY�r�C�=��A�N�(��vg}u9@��:�x��ކ��,5��*2`<�L��L�d�F��P��/(�M_Y��Y8�M��z#tGN��?��9P}[b��3x�!pڨ#_T�|f�", "5��2?(?5pOh;�5!�a6��y��<:o{��<��Ǒ��^�"0��4�n�D��?��:�ڍ}Fao��-4�8<��oP��33�2��Q�B\�j:��|�~�}�x��gG��BQ�$�40_��J�e�-_j��u7D��<��NN��;��5�b2x|�B�y ��[��@��R7��m^��佅;R�ܽ�eI9w+�u��a5�{��e��7��/�>̔9�ƊǈrH��|\NL2��)%eԽ!��ז��{�"lf !��X&�8�D>��u$�6Y)�r�+��"��G^X+�<�#w��ڥ�E�r;�-ҀIJs��YwV��$��/��)!��r�r�sUu%�9�z��M��c�J��U�DE��K2��l JĀ9c6�P��kL�cWE�lM�)�� A+7XB� p�9��l��e��K�I�XX��n�]Z�"�E�F�f��N��鈹Ê�T�cVi/iNl��j6�F��}~�=˓��M�9��N��Nq:�B��=CFh��q�-�[�:X '��`�7��!��b@C��!�0��}��+�n��]��U3x�3�o�WG��#�ׄ�3sh��I�o(*�VYU�ה�dq{��i!�b��M_䅓-��V�,+s�P90S��#�S�B�JT��8r,�1�(\I�'�ڰr�Np�,�d�A�J��p��KR*�B+�<�i�:%q�Է�M�/�e��Ҍn�붚,2Y��b�r�"�p��r ;�Uw�-�QLGR'��j`(�d�;��&k��I��ܑL��~�.J�g1s~�y.��S��I�� zu�rܱ5�K̀2B:N��㋣y/`��2��0�P�g��gJ4�$�=�Y�˩�MvF4��|U4��t�4T��U?�J.q��\�%��Q�8Hj�W�E��zê��F��Z�B��q"F��ש��-�O��7�28ix��)6f��P�t仸)�F�)�єbgT�z$��#�|��42$W��ieH��ִ��V��i��v3��Һ��f��^�0�^�?��S��4�+��V�r�V��S=�{Οd�Bŷ�P�f߰�]��(1Cֆ��Oרiik��<֮K��R��_KE�:�CC�o4D�:'�L4�i+r$M��y��=��n�x�r̬|Z��%��g�2��vW��JwH��I��0N�4�f|�--��Zs;�t3�sm�Uƣ&�Y«�c-�Y��xWsIE�+{k �S�", "�$��m� ��m�?](?w�n*ѹ�P�E��%`��7Sl풮#{��`��-�Z�j��;��)휵�I��mڊ�Q�)��>u�}�{;:>��i_M�[�AM��f��6�~�F�D+��t��;"��_Ո G�vY�J�%�ф��#�@Pe�P�>��^��a�c`";q]jLA��F� #�E��|m�M��V��0��M윲��N�|v�:7�tƸXF�[�/��s�+��L)f12ݥ�Ϛ�m-��{��{Mt]��o�y+]��:��Ã��\ʮe��\d��i]j��U�G�skE��WIt}��E��..��kvV�6��-�b��bM��[�"%�V��[Īn�:�Rz��*�*�Twd5ҡ��R7WP�qA�0�`�~U`�H�e�oҦ��Z�#t��?��>4݊l�oF�� -7��Q:�(V��BVn��i9yA�@4e�aC�h��`��4�i��$I��X8i��7�7��QHO�Rט��)KL(�T7��놐��l��p2$�k��ߏ��edI$O:��'x�=@��FsU 9?�s��(�s��A`��v��Վ�z4Q�WW^��ɞF�H��x�l�7�b8�� 6�2t̓��R�Yf-�c�oǏ�i�d6xL6a/�߰sM-�i�Ag�E��Y��h��`Z��\�!��f`5y��lon��XN'��J��ŜCc��,E Z��D��>MY��=�)p~��|i��%J{?�|��y�@;��7pK��u��<��?��)k��<��:K�c��]��?>P�[Jԩ��yB�<��z��e#W��u�㋄�VrS1�Gמ9�D��0��^'�Vqr��̪&P��kE.'�}|��sG��\��k�vξzZ��~]8�e�u��R��3ieB�l*�0�Sg��X?=]e�� P��n��[��3��`��G�MQ�>_�G+tDQI��.��ڞ}F_�k�_�7�"8�>�;_��S�|CJ#j3��4~UR�+��Tz��sߟ�Ju��tKoe:(Ƕ�U�LV՛.�)�m-��T��T&��@�V�T$��OJ�Qr�Y�VWڐ�7��F�12�){��`�.�yu�i��R�Gf�o", "t��b/��_h�Ȍ⍎C!C��.x��#3^�7:��Ա�{~׾�0ǘz}LƫPu�*�.昴��WB��(��ė�7�pC��QO-p��4 F%�r�B�jT|[߳��2O$:7+;�t��k��i��}�Ċ�?V�"��K��yAƇ�t%0�m�hмF��rȳ\��l�J�j�@�BA�Z�4��,6�KI�ڦ�T�Tk`��0�J��y�}��", "00000001�00000001]00000001m00000001s00000001�0000000180000000100000001�00000001+00000001�00000001�00000001�00000001d00000001�00000001�00000001�00000001840�/wC{m�K/m�Izߌm.Sl2I��,��+J�|�0��j�h��-�:n�'��gے�*S�ל�#�E6��&�:��>y�-��h�L�˳H풑4={d²�r��t�'�3��1��c���9�ovF��xU��@w�{��Biٮ�Ry�̑��?�(>�+�W]�,0"Co��)cas3QH��)k�SD��4te�~��`�+��;��?"t�S�x2��Ә�yf��lp��3��?�߇T��[2�gfC�Q.��9�?��" "00000001�00000001�00000001;00000001�00000001T00001A46a��+l&bbd��,&� �睙��㜪��:�nu��+��z9?��Q��՝�x��h�չR,y�J��+�t�^y8��ivۖՀ�w�{�U�x��3G�[��|��p�{��K�?��a��O?�[%/_<��%r~�}w��v&�wC|V��\�0��H6#��r��K,�.Z��St��o�H��ti��=�-�:�V��mS�ݳ�n�l��]@O��`Q�;}*�++(�%aE��f��_w��q��9I_�"-%?s�+%ͫ��;��CAҕ��c�i�m �=�h��k&OL�dM�2}a��d�P|��=0�'�@��7��Bg��#��?y�ڸG��vaTm!��{�2��/��.��!Vv�L>��Tum��:�aTq@�1�NS��+�v&�;%W�{��f��]o��μyٽ}��@�B� 2�-D[��{_YIW��A� ��2�ԁ�J� ��!l��*�fX��3�)��KeO6�G�z#�v��K�m��Qm!J��nX6�BAҕ�b�&��+u ¨2��$c� ��V�/�L�vJ�&�Rٓ��HGؖ��Ruۘ+<�@\�`ì��B� Ī-D�_�bM{�h0$W.�w�j�'��+uPĨ2�$ch� ��V�/�L�wJ��Rٓ��Ѿވ��~�|5��@AFT[��F��YԺ��-��RM�. $A�0�OS��V��Q%d0I�?AL�3�L_ؙ��\M��'��#~��4μy鿝��@�B� Ϫ-D�_:PK�R$H�2�_�.�?H��b��>�J$1��I ��'��;��T�d��x��7�g޼�ߎFK�!P�g��/�Ӈ}�\IW��4�/��Y�T�~��:NbT��@�1��􅝹pJ�^�ʞlo�7Y8�f^�O�f��8^�5p/`�h��v$D�2<��[��B�ش�At�qbգ6i��ޞOm��1��#��1a�9gQ��", "00000001�00000001]00000001[00000001�00000001�00000001817a2�+�V�&D�v.J��մ�N��K$s�_H��c|$�C)��>��ǱH)��@�i�=� E�{�E��{��x��<��5p�Mg�|��{�T�3�Vgޑw��[��y��5��7�ގX��q��Xj $�zX�X�ȸA��/D�j*g�`��8��:��8͔��^��ӂ+��w�#��N.0^��S.0^f��X.0^��]. ^�k�ŔR�]�&Հ�y؍��by�͔��6y��v�C��"��:��P\��ր��L>��os,N��|�cq2*��e��:X͘W��'�ϛ��Y�R�h8�i:�:x\'��U��˗�_ݢaYQ�ꄺ~��x�".Y�Z{�e��7!��<�D��&�ڛ�G��2�<�%xh��0��(��%OW��Q.],~"�@�t�Y�2|%�D�ٞ�~8}U-�D�}u��Fj�@ч�G��HZ�p�X�v�V��T�_WoM澈r �,܋��`u�-r��d�3�=��k��-�ó��N��A�|v�?|��A��J��])#h��}i��L��r��H�g'l��5�'�7%[ �H��t1��S�7x�oF�e��ѕm�t��?U�k�d��oצ��(UHY��Η��&��O`�A�o�O��}��!�Sb��F��6T�T�!DWqb�X×��L�M'��X4j��m~:�s8-�壕:=w��=��.�i�]��o��ͨ��VHaP�", "��'ڳ�c��bh�P-N��{��#��'/(.�m�/.*�x��4W�� zLוo8Yx�MP�3�jn�M��{��>�9�^��}IY>c&�y$a�,A'�<��#//OW�}vE'Ȳ�s��I��f��L�'9�f��یImU�{1�t�p�vE��5�ɳeRj�i8Z7�[Cr��T_mEҺ��B̼��ݕ%r�Ȱ�Q�z��6�{�CV>�XB�bf?�J�n;Y�t,'��x%9��J��ۭ�� eݔcT�nb�u��U��9�S��t�|�U":�)��s�tP�>��n�2߄n��8@6�ghR�iMp8�d�ZOI3n`wC�X>��S(��G�mC�DǒB:v>��t՝$2�c�V)�~�h�~:gbj��N��A'O>=e�>Ӎ�HN^^|�e�D&��+_fO=�%��]k��1��op��T8~L��8?&|��>�Ǐ�KF��06X�r��9�@u6��e�BՏ,W(�&��hL>��'d��p��K'M�슳��:h)�CMi�\��K�;aU�'�#�ê(O G��4�M��r��*��ê(O`�⛨Y9Rt��K�yN��9J�;��6��-@1q��(&[@6LP��a��8l��-@�D [�b��Z�b��Ѐ�d�3��m�E��l��]�\�-;��jl��μ@�\��LD��B��B�\�Yƫ�XNZ�/}�W��vK�� YW�� Y�b7�]��%��JL��!IK\9 �J�!IK��!IKr�!IK$ �Ee?�D��Q]i�O�6=��ct��?O�5{�$��,U�!��,��T�w�iØڍ�0��x/H�X�m�{ۨ��F=@��6��QZ��F��|��Y-��轖��ۣ�??��znض;�S�[��U7y��3*��+&Nۮ��Q�_~H\��=�n%f��[G�Яg��zb�cw��_�3תs�W��(h|��ex�:�6�f��r0&0D�V�!�ȍ��2�E�Bf��8�jw�A��zY_� Hw��KC-��W�-"�_4��E#7��HƐG��xW'�&8��@tP�Qv��1T�)O�3�!*ff��Ɨ��v�Z�̬*D��LA2�1��q�v�(6��C,3��8��)3��R��V�/��d��w}[�髉��N1��TJ��>��L��tt�q�r��1{��.H�>�LH�dR�� |��ᓝ�`�C��z48�quQ�?�z�p��ٷ�W�\�dU��t��NZ~�:;��6c6O��SG��l��1~ ��7#�hD��_˲�S�x��"��%"�|u��3��.G��a9LFPY�x9b-��?�@v�IŋCD��x"�e�^"l��u'b��Pj��5�^D�e�u8.ĂN�U�o=��ĞEa��*kG{�^��`��3z", "�g)h�?��K&v��á[��W7�X��'�.z��/-i_f��Y��/��ZǃJxt��I\e?��a�-U�d�<��KJ�C��G��\Zn-��\̨��Tfq�}N��+��3�1��r��\� ��2�#�3�{��d� �yA��PF��R��/��J$��O��L5��쀬�JjLD^��4r\Ayr��>��˳��hVa�Ҍ�+�B]�UL�ܒ��}_T6n95�:��nQ�$�T��V�B^�A\��M��BN5X K!'�eG�-&�n\=ou��Ь�)�D��䕴�+i(�$ׁ�5f��Srǃ��d��J��X��O޽��r"^fqdcr�P�z'�yv�E�s��[��0��s��f��'{�R�Ar�q��E#<�ťP%�D�P��GĻ\j�U��ӎ��x�im��3�]�Ż��A̙o;�>��q��̟t��=��y��B��a.�@ڤ��v��Zw�t�tRj%��Yo_YM�01��'S�_��GV��;�� V�e��ݚk�q�a�o��L�W7��x��;��h�W�_� ��ƞ��?��5¬��k��[��F4z荍V�u�X��y�r/�ƞ��G��MԲ\|Ğ&}��&]��ͫ��rl:�"O�zs�zIO��]��=Y��ݼ�L:M��RM_(E*L�I��2L��R�kv�Twj;��I�4��$��JZb�п��4]K5�'��*zS��v�'��M(�ӝ��_C��h4��,�7��׋�_7��1�7lwtP�}�aV��D��n�S-�Ȑ��Qd8J"�F��B?)�l�m_��5�^��n��N��֓��UGo��-��e�J�a)��%�٤ݷ��_��le��2��I&-+��q!d21M���]__��E��dU2��Euq_B�l�s�w��2�t��R��Y��q��r�F��L]�>]t�T��a�袹=�y8�b_�m�.v�1}0�hb�-��<��u�@�Fwmс[��iw<�Z��:��cv�zm-� �g�Y.�M��\qNq0&�BBp��ɼsԏ��kk�%��|�*��LA7|��.l��|iYgUt�c7ڻ�e�Ƌ@�~۽An>�Z��p�6'�2h�C�֝k�Δ�%E��Xڝ�~�-�3�S�7ͭ�R��㣵V)��׶��R(��'v�u�D�َYwK��cp4�Sh��O6��Y]�V��*J", "U��$��+e��&Zf76KL.GfT��y ��#�� ]�W�}ن�*R��", "000001�12c7iO�J�D��E/�|'&�'W��pL��!��!"��}�}�N0vW�C��2�[LQ�� #W0(��x�T��C��K^@�|��o�|��/�|.��Sa�'ݧ՘��I��o��t�'>�jO`��?�[Gݥ�C)��|U'�]��1ĸToop~L]\�Wufv�}�ӕQO�A�]'d��0 �L>��YQ��X��ofhɓ>8��Nb��jz��U��0hy��7��y��mf�O��C�V?1�_�u;:�d�w��9�h�AUgc�&�G;��$v|n�]�Qw��M�;�CG8p��(�P�\EP[�?��q�j�G�0�,b��TP��i��r�S=Gc�W�d��dW��ɠ�:�oOr��6ga��-�G��N�9t��U�z6�^/�<=��K$3F�I0�F�=��/��=�F^��$��Q��0�þ�t��M��h��Ў��G�(��;BuI�J�2��B��׫��FkkC��ή��B��f�q��+E�?�3h��#�L<��C�ITQ�0��-��cY� >��FDK9w6��q��jU�^go�4!��(ʆr[�"��D`cة��[��84��ʑ�i�l��=;Ip�?CK�))CB��#r��˳�g��@��$�dy|��3��]P<�`Ņ��A��FY�Oڮ�?X��B�5��;.ƃ�D��a%�g��^��J&Z��a��o�)1��K��Fڑ��v4��-p�?� DSh|��=�H1t�ާ��?�ac�o$`1M�w>�L��*�r�65N�"0�i�5�Ӧsw��S�;❑H�㚬��;��bóT_�H�z��'?.��@�d�tu��?z]��t��,'�>T��˝��¡�=׹z��iRAEcx��P?x��O�H��R�A�}�6��9�*ԉ�9P��{��.�~�|��mr��Ӭ��j��o��i�8kh�#��^%��䐄f@]#��⤑N h�C%V��3�?zw�w~��maL\7�_�y/��R��^_^�;=�)�0��`䓊,�RA�\vv1��tV#�" "V(�-�Ϸ�p�q��k��]Q�;��Z�t�e`�_rA(ZQ[n��.��ڨ{�S��(��;�8�ڮ1��+Z �$��\�'��c1N��!]ϖ��N�Q�_��W��$��˿��sv��|�p*�B��`�H��V\�aQ�T#1��{�ӝS�t��@j4$㓍fE}�ZA{�+E��`��ʴ@��&�6'X��ƙi.92dV?�%��r��[=��V��)�W�**I�4��l��vb�2��K~��:�*M��ٲ��ұ��/�f�?�6<�HH��0��E��p�c�;��z��/�6��%wy�i�B��pz�� 2�ߋ��cI"�n>��[g��/B&4��;"�exT�8+�_;�M͚��LD��O�a��UC�I��iUM�1�Dhc8=��Y��؊"�RCH��u��+��$c!w�YB�6W ��C�s��Piy��̒K��^�q��ܲ�� ][�5�d�X+�ufL�ֶȈ�s�4'��x4XH��iƒw,6��\)r�nB�G9�5Q*$rp��bJ�P��帕kPqX2�J�$�̚��?[��W��7O6d��Q��r� ��1��|?�&�%먗n*b��0<~�4r��G�=��-��J�R�� @5d^vnn�d�K~:��D�Z �&�%)Pa�Q�Ϗ?��"e+pn��_<��!q��O;Pȣ��O��茢~lw��or�X�zKl��8�d򰈏?Y��AI��-꠪LY��*j�E�k�~F<(@G�V��u<��A�vR�˃�A�D��lAg�xc��c��=^Eh�ب5}��F��7�H��Q�.��D�P�9�F��:1��[nq~�B�&�B�l��,�Έ:V��M�2��zL`��a�i��CW��@��Hmx�x�-�0V�'��-sLx� �� c�1&G5��k��"�zG��"5e:T2c28,Found URL "https://accounts.google.com/auditpolicygpinterop.dllauxiliarydisplaycpl.dll:\windows\system32\ieframe.dllchxreadingstringime.dll:\windows\system32\propsys.dlldevicepairingfolder.dlldevicepairinghandler.dlldevicepairingproxy.dll:\windows\system32\shell32.dll:\windows\system32\ieframe.dllttps://accounts.google.com/ttps://accounts.google.com/locationnotifications.exettps://accounts.google.com/ttps://accounts.google.com/eryperformancefrequencymediametadatahandler.dll\laa\mi:elevatecreateprocesswrpmitigationapphelp.dllen-usen-usar-sapt-brzh-twzh-cnzh-hkcs-czda-dkel-gres-esfi-fifr-frde-dehe-ilhu-huit-itja-jpko-krnl-nlnb-nopl-plpt-ptru-rusv-setr-trbg-bghr-hret-eelv-lvlt-ltro-rosr-latn-cssk-sksl-sith-thuk-uafy-nlqps-plocqps-plocm:\windows\apppatch\aclayers.dll127*52c64b7e\scripts\;c:\users\hap6-32\:\windows\system32\winspool.drvhon\pyth%:\windows\system32\setupapi.dllmp\%:\windows\system32\cfgmgr32.dll:\windows\system32\sfc.dllms-win-core-processthreads-l1-1-0:\windows\apppatch\acgenral.dllutoitdata=c:\users\hapubws\appdata\roamingcommonprogramfiles=c:\program" - Source: "00000000-00000848.00000000.82599.005E0000.00000004.mdmp") Found URL "https://accounts.google.com/pushprinterconnections.exerestartmanageruninstall.mofsystempropertiesadvanced.exesystempropertiesremote.exewindowsanytimeupgradeui.exeware\microsoft\oleaut:\windows:\windows\inf:\windows\inf:\windowsnsufficient" - Source: "00000000-00000848.00000000.82599.005E0000.00000004.mdmp") Found URL "https://accounts.google.comystem32\api-ms-win-core-sysinfo-l1-2-1.dllc:\windows\system32\api-ms-w-core-sysinfo-l1-2-1.dll\win0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000053007600690063006500610063006b00200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000microsoft.management.infrastructure.native.unmanaged.dll:\users\hapubws\appdata\local\temp\ixp001.tmp\4ut221ym.exeistry\user\s-1-5-21-2092356043-4041700817-663127204-1001_classeshttps://accounts.google.com/c:\program" - Source: "00000000-00000848.00000000.82599.005E0000.00000004.mdmp") Found URL "https://accounts.google.com/ttps://accounts.google.com/ttps://accounts.google.com/mediametadatahandler.dll\laa\mi:elevatecreateprocesswrpmitigationapphelp.dllen-usen-usar-sapt-brzh-twzh-cnzh-hkcs-czda-dkel-gres-esfi-fifr-frde-dehe-ilhu-huit-itja-jpko-krnl-nlnb-nopl-plpt-ptru-rusv-setr-trbg-bghr-hret-eelv-lvlt-ltro-rosr-latn-cssk-sksl-sith-thuk-uafy-nlqps-plocqps-plocm:\windows\apppatch\aclayers.dll127*52c64b7e\scripts\;c:\users\hap6-32\:\windows\system32\winspool.drvhon\pyth%:\windows\system32\setupapi.dllmp\%:\windows\system32\cfgmgr32.dll:\windows\system32\sfc.dllms-win-core-processthreads-l1-1-0:\windows\apppatch\acgenral.dllutoitc:\windows\system32\imm32.dll\win:\windows\system32\cryptbase.dllomspec=c:\windows\system32\cmd.exe:\windows\system32\msvcp140.dll:\windows\system32\ucrtbase.dllroperty" - Source: "00000000-00000848.00000001.84524.005E0000.00000004.mdmp") Found URL "https://accounts.google.com/arse" - Source: "00000000-00000848.00000001.84524.005E0000.00000004.mdmp") Found URL "https://accounts.google.com/pushprinterconnections.exettps://www.epicgames.com/id/loginttps://twitter.com/i/flow/loginttps://www.epicgames.com/id/loginwindowsanytimeupgradeui.exeware\microsoft\oleaut:\windows:\windows\inf:\windows\inf:\windowsnsufficient" - Source: "00000000-00000848.00000001.84524.005E0000.00000004.mdmp") Found URL "https://www.youtube.com/api-ms-win-core-rtlsupport-l1-1-0.dllapi-ms-win-core-sysinfo-l1-1-0.dllapi-ms-win-core-threadpool-l1-1-0.dllapi-ms-win-crt-filesystem-l1-1-0.dllhttps://www.youtube.com/ttps://steamcommunity.com/openid/loginformttps://steamcommunity.com/openid/loginformapi-ms-win-security-sddl-l1-1-0.dllhttps://www.youtube.com/https://www.youtube.com/auxiliarydisplayclassinstaller.dll^8^8^ommonprogramfiles=c:\program" - Source: "00000000-00000848.00000001.84524.005E0000.00000004.mdmp") Found URL "https://steamcommunity.com/openid/loginformhttps://steamcommunity.com/openid/loginformhttps://steamcommunity.com/openid/loginform:\windows\system32\api-ms-win-crt-locale-l1-1-0.dllhttps://twitter.com/i/flow/loginopenc:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\tdrivetypeidasyncinvokeh=\!windowstpathext." - Source: "00000000-00000848.00000001.84524.005E0000.00000004.mdmp") Found URL "https://acs.google.com/9420940,4448,3024,,rtlgetversion,ntdll.dll," - Source: "00000000-00000848.00000001.84524.005E0000.00000004.mdmp") Found URL "https://store.steampowered.com/login000009/apubws-pclugplaylugplaywitter.comid/loginropsys.dllemotesvr.dlwose.dll007_fxscomces.dllgfxsutilitykinstall.dllstel.dll004" - Source: "00000000-00000848.00000001.84524.005E0000.00000004.mdmp") Found URL "https://www.epicgames.com/id/loginhttps://www.epicgames.com/id/loginhttps://www.epicgames.com/id/loginhttps://www.epicgames.com/id/loginhttps://www.epicgames.com/id/loginin.exedxp.dldxpps.dlldxva2.dllt.hlpui.aega.cpiels.dllhes.dllnt.dllevr.dl" - Source: "00000000-00000848.00000001.84524.005E0000.00000004.mdmp") Found URL "https://accounts.google.com/https://accounts.google.com/c:\program" - Source: "00000000-00000848.00000001.84524.005E0000.00000004.mdmp") Found URL "https://accounts.google.comhttps://store.steampowered.com/loginorer\ui\swdrm.dllhttps://accounts.google.com/https://accounts.google.com/:\users\hapubws\appdata\local\temp\ixp001.tmphttps://accounts.google.com/:\program" - Source: "00000000-00000848.00000001.84524.005E0000.00000004.mdmp") Found URL "https://accounts.google.com/:\program" - Source: "00000000-00000848.00000001.84524.005E0000.00000004.mdmp") Found URL "https://accounts.google.com/https://www.paypal.com/signin:\program" - Source: "00000000-00000848.00000001.84524.005E0000.00000004.mdmp") Found URL "https://twitter.com/i/flow/loginc:\users\hapubws\appdata\local\temp\ixp001.tmp/steamcommunity.com/openid/loginformc:\users\hapubws\appdata\local\temp\ixp001.tmphttps://accounts.google.com/0069006300650020005000610063006b00200031000000000003000000b4defb03c0defb0388e0fb0392e009688d105(ffffff08e0fb0316bc0868ca7dd88d100000003cdffb0308e0fb0320bc08688205000000002b69010000002fbc086820082050000ca7dd88d10000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6" - Source: "00000000-00000848.00000001.84524.005E0000.00000004.mdmp") Found URL "https://accounts.google.com/ttps://accounts.google.com/ttps://accounts.google.com/mediametadatahandler.dll\laa\mi:elevatecreateprocesswrpmitigationapphelp.dllen-usen-usar-sapt-brzh-twzh-cnzh-hkcs-czda-dkel-gres-esfi-fifr-frde-dehe-ilhu-huit-itja-jpko-krnl-nlnb-nopl-plpt-ptru-rusv-setr-trbg-bghr-hret-eelv-lvlt-ltro-rosr-latn-cssk-sksl-sith-thuk-uafy-nlqps-plocqps-plocm:\windows\apppatch\aclayers.dll127*52c64b7e\scripts\;c:\users\hap6-32\:\windows\system32\winspool.drvhon\pyth%:\windows\system32\setupapi.dllmp\%:\windows\system32\cfgmgr32.dll:\windows\system32\sfc.dllindows\system32\ext-ms-win-kernel32-package-current-l1-1-0.dllms-win-core-processthreads-l1-1-0:\windows\apppatch\acgenral.dllutoitc:\windows\system32\imm32.dll\winmsiscanbuffer:\windows\system32\cryptbase.dllomspec=c:\windows\system32\cmd.exe:\windows\system32\msvcp140.dll:\windows\system32\ucrtbase.dllroperty" - Source: "00000000-00000848.00000002.84619.005E0000.00000004.mdmp") Found URL "https://accounts.google.com/arse" - Source: "00000000-00000848.00000002.84619.005E0000.00000004.mdmp") Found URL "https://accounts.google.com/pushprinterconnections.exettps://www.epicgames.com/id/loginttps://twitter.com/i/flow/loginttps://www.epicgames.com/id/loginwindowsanytimeupgradeui.exeware\microsoft\oleautindows:\windows\inf:\windows\infindowsfficient" - Source: "00000000-00000848.00000002.84619.005E0000.00000004.mdmp") Found URL "https://www.youtube.com/api-ms-win-core-rtlsupport-l1-1-0.dllapi-ms-win-core-sysinfo-l1-1-0.dllapi-ms-win-core-threadpool-l1-1-0.dllapi-ms-win-crt-filesystem-l1-1-0.dllhttps://www.youtube.com/ttps://steamcommunity.com/openid/loginformttps://steamcommunity.com/openid/loginformapi-ms-win-security-sddl-l1-1-0.dllhttps://www.youtube.com/https://www.youtube.com/auxiliarydisplayclassinstaller.dll^8^8^ommonprogramfiles=c:\program" - Source: "00000000-00000848.00000002.84619.005E0000.00000004.mdmp") Found URL "https://steamcommunity.com/openid/loginformhttps://steamcommunity.com/openid/loginformhttps://steamcommunity.com/openid/loginform:\windows\system32\api-ms-win-crt-locale-l1-1-0.dllhttps://twitter.com/i/flow/loginopenc:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_41e855142bd5705d\osethemedataexitcodemsiscanbufferh=\!windowstpathext." - Source: "00000000-00000848.00000002.84619.005E0000.00000004.mdmp") Found URL "https://acs.google.com/9420940,4448,3024,,rtlgetversion,ntdll.dll," - Source: "00000000-00000848.00000002.84619.005E0000.00000004.mdmp") Found URL "https://store.steampowered.com/login000009/apubws-pclugplaylugplaywitter.comid/loginlose" - Source: "00000000-00000848.00000002.84619.005E0000.00000004.mdmp") Found URL "https://www.epicgames.com/id/loginhttps://www.epicgames.com/id/loginhttps://www.epicgames.com/id/loginhttps://www.epicgames.com/id/loginhttps://www.epicgames.com/id/loginin.exedxp.dldxpps.dlldxva2.dllt.hlpui.aega.cpiels.dllhes.dllnt.dllevr.dl" - Source: "00000000-00000848.00000002.84619.005E0000.00000004.mdmp") Found URL "https://accounts.google.com/https://accounts.google.com/c:\program" - Source: "00000000-00000848.00000002.84619.005E0000.00000004.mdmp") Found URL "https://accounts.google.comhttps://store.steampowered.com/loginorer\ui\swdrm.dllhttps://accounts.google.com/https://accounts.google.com/:\users\hapubws\appdata\local\temp\ixp001.tmphttps://accounts.google.com/:\program" - Source: "00000000-00000848.00000002.84619.005E0000.00000004.mdmp") Found URL "https://accounts.google.com/:\program" - Source: "00000000-00000848.00000002.84619.005E0000.00000004.mdmp") Found URL "https://accounts.google.com/https://accounts.google.com/:\program" - Source: "00000000-00000848.00000002.84619.005E0000.00000004.mdmp") Found URL "https://twitter.com/i/flow/loginc:\users\hapubws\appdata\local\temp\ixp001.tmp/steamcommunity.com/openid/loginformc:\users\hapubws\appdata\local\temp\ixp001.tmphttps://accounts.google.com/0069006300650020005000610063006b00200031000000000003000000b4defb03c0defb0388e0fb0392e009688d105(ffffff08e0fb0316bc0868ca7dd88d100000003cdffb0308e0fb0320bc08688205000000002b69010000002fbc086820082050000ca7dd88d10000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6" - Source: "00000000-00000848.00000002.84619.005E0000.00000004.mdmp") Found URL "https://ipinfo.io/https://www.maxmind.com/en/locate-my-ip-addressauthorization:" - Source: "00000000-00002040.00000000.81585.00D5A000.00000004.mdmp") Found URL "http://www.winimage.com/zlibdllherfqq2lyf8x5[x]tiulm:.p)q+e4" - Source: "00000000-00002040.00000000.81585.00D5A000.00000004.mdmp")5f:T6db,Found string "GET / HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: accounts.google.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /favicon.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoDNT: 1Connection: Keep-AliveHost: www.google.com" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /login HTTP/1.1Accept: text/html, application/xhtml+xml, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.facebook.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /rsrc.php/y1/r/ay1hV6OlegS.ico HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static.xx.fbcdn.netDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /id/login HTTP/1.1Accept: text/html, application/xhtml+xml, */*User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateDNT: 1Host: www.epicgames.comConnection: Keep-AliveAccept-Language: en-US" (Indicator: "HTTP/1.1"; File: "SSL") Found string "GET /account-portal/static/epic-favicon-96x96.png HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like GeckoHost: static-assets-prod.unrealengine.comDNT: 1Connection: Keep-Alive" (Indicator: "HTTP/1.1"; File: "SSL")60:Tf02,GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.pki.goog GET /r/r1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /wr2/oBFYYahzgVI.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /wr2/75r4ZyA3vA0.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.digicert.cn GET /r/gsr1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /r/r4.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /we1/pl4XiTjSDSk.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /we1/G0k-BqpOX8k.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /we1/x6Eg-8TSwUw.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /rootg2.cer HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crt.rootg2.amazontrust.com GET /rootg2.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.rootg2.amazontrust.com GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootca1.amazontrust.com GET /rootca1.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.rootca1.amazontrust.com GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.rootg2.amazontrust.com GET /r2m04.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: crl.r2m04.amazontrust.com GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.r2m04.amazontrust.com GET /we2/yK5nPhtHKQs.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /r/r1.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed 11 Feb 2026 14:38:00 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /wr2/oBFYYahzgVI.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed 02 Sep 2026 17:50:26 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /wr2/75r4ZyA3vA0.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed 02 Sep 2026 20:45:44 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1 Cache-Control: max-age = 3000 Connection: Keep-Alive Accept: */* If-Modified-Since: Wed 02 Sep 2026 19:20:16 GMT User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog 61:Td6b,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V" in header "GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.pki.goog" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfq" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base62 string in header "hLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQ" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base62 string in header "P4v0cB1JgmGggC72NkK8MCEA59dSNcqDd" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.digicert.cn" Contains base62 string in header "MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPW" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base62 string in header "2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootca1.amazontrust.com" Contains base62 string in header "MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIf" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base62 string in header "aREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36" in header "GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.rootg2.amazontrust.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBTih" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com" Contains base62 string in header "uFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYV" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com" Contains base62 string in header "2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: ocsp.r2m04.amazontrust.com"62:T9b5,Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; File: "00003544.00000DD8.675446.00402000.wprm") Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; File: "00003544.00000DD8.675446.00402000.wprm") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; File: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; Source: "00000000-00000384.00000000.81924.0110A000.00000004.mdmp") Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; Source: "00000000-00000384.00000000.81924.0110A000.00000004.mdmp") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "AttachThreadInput" (Indicator: "AttachThreadInput"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "VkKeyScanW" (Indicator: "VkKeyScan"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "UnregisterHotKey" (Indicator: "UnregisterHotKey"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp") Found reference to API "RegisterHotKey" (Indicator: "RegisterHotKey"; Source: "00000000-00000848.00000000.82599.000FC000.00000002.mdmp")63:T6fb,"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" called "FindFirstFileW" with parameter %TEMP%\IXP000.TMP\*.* (UID: 00000000-00004372) "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004372) "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" called "FindNextFileW" with parameter 5sD6MZ0.exe (UID: 00000000-00004372) "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" called "FindNextFileW" with parameter sk2Qt47.exe (UID: 00000000-00004372) "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" called "FindFirstFileA" with parameter %TEMP%\IXP000.TMP\* (UID: 00000000-00004372) "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00004372) "sk2Qt47.exe" called "FindFirstFileW" with parameter %TEMP%\IXP001.TMP\*.* (UID: 00000000-00003464) "sk2Qt47.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003464) "sk2Qt47.exe" called "FindNextFileW" with parameter 4Ut221ym.exe (UID: 00000000-00003464) "sk2Qt47.exe" called "FindNextFileW" with parameter ck0rG18.exe (UID: 00000000-00003464) "sk2Qt47.exe" called "FindFirstFileA" with parameter %TEMP%\IXP001.TMP\* (UID: 00000000-00003464) "sk2Qt47.exe" called "FindNextFileA" with parameter .. (UID: 00000000-00003464) "ck0rG18.exe" called "FindFirstFileW" with parameter %TEMP%\IXP002.TMP\*.* (UID: 00000000-00004112) "ck0rG18.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00004112) "ck0rG18.exe" called "FindNextFileW" with parameter 3vO15kf.exe (UID: 00000000-00004112) "ck0rG18.exe" called "FindNextFileW" with parameter rq7SB75.exe (UID: 00000000-00004112)64:Tdf7,Found string "FromBase64" (Indicator: "base64"; File: "00003544.00000DD8.675446.00402000.wprm") Found string "AesGcm256" (Indicator: "aes"; File: "00003544.00000DD8.675446.00402000.wprm") Found string "AesFastEngine" (Indicator: "aes"; File: "00003544.00000DD8.675446.00402000.wprm") Found string "FromBase64String" (Indicator: "base64"; File: "00003544.00000DD8.675446.00402000.wprm") Found string "FromBase64String" (Indicator: "FromBase64String"; File: "00003544.00000DD8.675446.00402000.wprm") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; File: "00003544.00000DD8.675446.00402000.wprm") Found string "base64str" (Indicator: "base64"; File: "00003544.00000DD8.675446.00402000.wprm") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; File: "00003544.00000DD8.675446.00402000.wprm") Found string "FromBase64CharArray" (Indicator: "base64"; File: "00003544.00000DD8.675446.00402000.wprm") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; File: "00003544.00000DD8.675446.00402000.wprm") file/memory contains long string with (Indicator: "aes"; File: "SSL") file/memory contains long string with (Indicator: "aes256"; File: "SSL") Found string "FromBase64" (Indicator: "base64"; Source: "00000000-00000384.00000000.81924.0110A000.00000004.mdmp") Found string "AesGcm256" (Indicator: "aes"; Source: "00000000-00000384.00000000.81924.0110A000.00000004.mdmp") Found string "AesFastEngine" (Indicator: "aes"; Source: "00000000-00000384.00000000.81924.0110A000.00000004.mdmp") Found string "FromBase64String" (Indicator: "base64"; Source: "00000000-00000384.00000000.81924.0110A000.00000004.mdmp") Found string "FromBase64String" (Indicator: "FromBase64String"; Source: "00000000-00000384.00000000.81924.0110A000.00000004.mdmp") Found string "MD5CryptoServiceProvider" (Indicator: "md5cryptoserviceprovider"; Source: "00000000-00000384.00000000.81924.0110A000.00000004.mdmp") Found string "base64str" (Indicator: "base64"; Source: "00000000-00000384.00000000.81924.0110A000.00000004.mdmp") Found string "System.Security.Cryptography.X509Certificates" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000384.00000000.81924.0110A000.00000004.mdmp") Found string "FromBase64CharArray" (Indicator: "base64"; Source: "00000000-00000384.00000000.81924.0110A000.00000004.mdmp") Found string "System.Security.Cryptography" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000384.00000000.81924.0110A000.00000004.mdmp") Found string "system.security.cryptography.csp.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000384.00000000.81930.00380000.00000004.mdmp") Found string "system.io.compression.zipfile.dll" (Indicator: "zipfile"; Source: "00000000-00000384.00000000.81930.00380000.00000004.mdmp") Found string "system.security.cryptography.algorithms.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000384.00000000.81930.00380000.00000004.mdmp") Found string "system.security.cryptography.encoding.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000384.00000000.81930.00380000.00000004.mdmp") Found string "system.security.cryptography.primitives.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000384.00000000.81930.00380000.00000004.mdmp") Found string "system.security.cryptography.x509certificates.dll" (Indicator: "System.Security.Cryptography"; Source: "00000000-00000384.00000000.81930.00380000.00000004.mdmp")65:T1315,Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00000384.00000000.81930.00380000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00000384.00000000.81930.00380000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00000384.00000000.81930.00380000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00000384.00000000.81930.00380000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00000384.00000000.81930.00380000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000384.00000000.81930.00380000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP003.TMP\2Dc2225.exe" (Indicator: "\Device\"; Source: "00000000-00000384.00000000.81930.00380000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00000848.00000000.82599.005E0000.00000004.mdmp, 00000000-00000848.00000001.84524.005E0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00000848.00000000.82599.005E0000.00000004.mdmp, 00000000-00000848.00000001.84524.005E0000.00000004.mdmp, 00000000-00000848.00000002.84619.005E0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00000848.00000000.82599.005E0000.00000004.mdmp, 00000000-00000848.00000001.84524.005E0000.00000004.mdmp, 00000000-00000848.00000002.84619.005E0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00000848.00000000.82599.005E0000.00000004.mdmp, 00000000-00000848.00000001.84524.005E0000.00000004.mdmp, 00000000-00000848.00000002.84619.005E0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00000848.00000000.82599.005E0000.00000004.mdmp, 00000000-00000848.00000001.84524.005E0000.00000004.mdmp, 00000000-00000848.00000002.84619.005E0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000848.00000000.82599.005E0000.00000004.mdmp, 00000000-00000848.00000001.84524.005E0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP001.TMP\4Ut221ym.exe" (Indicator: "\Device\"; Source: "00000000-00000848.00000000.82599.005E0000.00000004.mdmp, 00000000-00000848.00000001.84524.005E0000.00000004.mdmp, 00000000-00000848.00000002.84619.005E0000.00000004.mdmp") Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00000848.00000002.84619.005E0000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00000848.00000002.84619.005E0000.00000004.mdmp") Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002040.00000000.81585.00350000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002040.00000000.81585.00350000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002040.00000000.81585.00350000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00002040.00000000.81585.00350000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00002040.00000000.81585.00350000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002040.00000000.81585.00350000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\IXP003.TMP\1Ta10aM7.exe" (Indicator: "\Device\"; Source: "00000000-00002040.00000000.81585.00350000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003464.00000000.81378.00240000.00000004.mdmp, 00000000-00003464.00000001.83300.00240000.00000004.mdmp, 00000000-00003464.00000002.84625.00240000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00003464.00000000.81378.00240000.00000004.mdmp, 00000000-00003464.00000001.83300.00240000.00000004.mdmp, 00000000-00003464.00000002.84625.00240000.00000004.mdmp")66:T14d9,Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: 853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: sk2Qt47.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: sk2Qt47.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: sk2Qt47.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: sk2Qt47.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: sk2Qt47.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: ck0rG18.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: ck0rG18.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: ck0rG18.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: ck0rG18.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: ck0rG18.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: rq7SB75.exe] Observed import api "EqualSid" which can "test two security identifier (SID) values for equality" [Source: rq7SB75.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: rq7SB75.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: rq7SB75.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: rq7SB75.exe] Observed import api "AddAce" which can "add one or more access control entries (ACEs) to a specified access control list (ACL)" [Source: 4Ut221ym.exe] Observed import api "AllocateAndInitializeSid" which can "allocate and initialize a security identifier (SID) with up to eight subauthorities" [Source: 4Ut221ym.exe] Observed import api "CheckTokenMembership" which can "determine whether a specified security identifier (SID) is enabled in an access token" [Source: 4Ut221ym.exe] Observed import api "CopySid" which can "copy a security identifier (SID) to a buffer" [Source: 4Ut221ym.exe] Observed import api "DuplicateToken" which can "create a new access token that duplicates one already in existence" [Source: 4Ut221ym.exe] Observed import api "DuplicateTokenEx" which can "create a new access token that duplicates an existing token" [Source: 4Ut221ym.exe] Observed import api "FreeSid" which can "free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function" [Source: 4Ut221ym.exe] Observed import api "GetAce" which can "obtain a pointer to an access control entry (ACE) in an access control list (ACL)" [Source: 4Ut221ym.exe] Observed import api "GetAclInformation" which can "retrieve information about an access control list (ACL)" [Source: 4Ut221ym.exe] Observed import api "GetLengthSid" which can "return the length in bytes of a valid security identifier (SID)" [Source: 4Ut221ym.exe] Observed import api "GetSecurityDescriptorDacl" which can "retrieve a pointer to the discretionary access control list (DACL) in a specified security descriptor" [Source: 4Ut221ym.exe] Observed import api "GetTokenInformation" which can "retrieve a specified type of information about an access token" [Source: 4Ut221ym.exe] Observed import api "InitializeAcl" which can "initialize a new ACL structure" [Source: 4Ut221ym.exe] Observed import api "InitializeSecurityDescriptor" which can "initialize a new security descriptor" [Source: 4Ut221ym.exe] Observed import api "InitializeSid" which can "initialize a security identifier (SID)" [Source: 4Ut221ym.exe] Observed import api "SetSecurityDescriptorDacl" which can "set information in a discretionary access control list (DACL)" [Source: 4Ut221ym.exe]67:T52b,"1Ta10aM7.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\1Ta10aM7.exe]- [targetUID: 00000000-00002040] "sk2Qt47.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\sk2Qt47.exe]- [targetUID: 00000000-00004372] "ck0rG18.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\ck0rG18.exe]- [targetUID: 00000000-00003464] "rq7SB75.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\rq7SB75.exe]- [targetUID: 00000000-00003480] "4Ut221ym.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\4Ut221ym.exe]- [targetUID: 00000000-00000848] "2Dc2225.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\2Dc2225.exe]- [targetUID: 00000000-00003480] "5sD6MZ0.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\5sD6MZ0.exe]- [targetUID: 00000000-00005084] "3vO15kf.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386"- Location: [%TEMP%\IXP002.TMP\3vO15kf.exe]- [targetUID: 00000000-00003940]68:T689,"1Ta10aM7.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\1Ta10aM7.exe]- [targetUID: 00000000-00002040] "sk2Qt47.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\sk2Qt47.exe]- [targetUID: 00000000-00004372] "ck0rG18.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\ck0rG18.exe]- [targetUID: 00000000-00003464] "rq7SB75.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP002.TMP\rq7SB75.exe]- [targetUID: 00000000-00003480] "4Ut221ym.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386 5 sections"- Location: [%TEMP%\IXP001.TMP\4Ut221ym.exe]- [targetUID: 00000000-00000848] "2Dc2225.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP003.TMP\2Dc2225.exe]- [targetUID: 00000000-00003480] "5sD6MZ0.exe" has type "PE32 executable for MS Windows 6.00 (console) Intel i386 5 sections"- Location: [%TEMP%\IXP000.TMP\5sD6MZ0.exe]- [targetUID: 00000000-00005084] "FANBooster131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "3vO15kf.exe" has type "PE32 executable for MS Windows 5.01 (GUI) Intel i386"- Location: [%TEMP%\IXP002.TMP\3vO15kf.exe]- [targetUID: 00000000-00003940] "OfficeTrackerNMP131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A] "MaxLoonaFest131.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- [targetUID: N/A]69:T578,"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP0"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP000.TMP\"") "sk2Qt47.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "sk2Qt47.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP1"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP001.TMP\"") "ck0rG18.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "ck0rG18.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP2"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP002.TMP\"") "rq7SB75.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE") "rq7SB75.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUNONCE"; Key: "WEXTRACT_CLEANUP3"; Value: "rundll32.exe %WINDIR%\system32\advpack.dll,DelNodeRunDLL32 "%TEMP%\IXP003.TMP\"")6a:Tcea,"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\sk2Qt47.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\5sD6MZ0.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "sk2Qt47.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\ck0rG18.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "sk2Qt47.exe" wrote 31232 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\4Ut221ym.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000200100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "ck0rG18.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\rq7SB75.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "ck0rG18.exe" wrote 26624 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3vO15kf.exe": 4d5aff000100000004001000ffff00004001000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0a240000000000000000 ... "rq7SB75.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1Ta10aM7.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "rq7SB75.exe" wrote 10464 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2Dc2225.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...6b:T6cb,TCP traffic to 142.251.163.84 on port 443 is sent without HTTP header TCP traffic to 142.251.45.3 on port 80 is sent without HTTP header TCP traffic to 142.251.219.131 on port 443 is sent without HTTP header TCP traffic to 142.251.219.46 on port 443 is sent without HTTP header TCP traffic to 142.251.157.119 on port 443 is sent without HTTP header TCP traffic to 157.240.11.35 on port 443 is sent without HTTP header TCP traffic to 155.102.54.134 on port 80 is sent without HTTP header TCP traffic to 57.145.2.128 on port 443 is sent without HTTP header TCP traffic to 23.45.138.131 on port 443 is sent without HTTP header TCP traffic to 162.159.140.229 on port 443 is sent without HTTP header TCP traffic to 23.48.8.218 on port 443 is sent without HTTP header TCP traffic to 104.18.20.94 on port 443 is sent without HTTP header TCP traffic to 104.18.21.177 on port 443 is sent without HTTP header TCP traffic to 104.19.229.21 on port 443 is sent without HTTP header TCP traffic to 3.221.26.248 on port 443 is sent without HTTP header TCP traffic to 18.238.80.31 on port 80 is sent without HTTP header TCP traffic to 151.101.1.21 on port 443 is sent without HTTP header TCP traffic to 150.171.109.72 on port 443 is sent without HTTP header TCP traffic to 99.84.160.31 on port 80 is sent without HTTP header TCP traffic to 18.164.123.208 on port 80 is sent without HTTP header TCP traffic to 13.226.94.71 on port 80 is sent without HTTP header TCP traffic to 18.238.45.26 on port 80 is sent without HTTP header TCP traffic to 52.84.24.24 on port 80 is sent without HTTP header TCP traffic to 142.251.151.4 on port 443 is sent without HTTP header TCP traffic to 142.251.108.95 on port 443 is sent without HTTP header6c:T771,"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\5sD6MZ0.exe" with delete access "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP\sk2Qt47.exe" with delete access "sk2Qt47.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "sk2Qt47.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "sk2Qt47.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\4Ut221ym.exe" with delete access "sk2Qt47.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP\ck0rG18.exe" with delete access "ck0rG18.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "ck0rG18.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "ck0rG18.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "ck0rG18.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\3vO15kf.exe" with delete access "ck0rG18.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP\rq7SB75.exe" with delete access "rq7SB75.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP" with delete access "rq7SB75.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP000.TMP" with delete access "rq7SB75.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP001.TMP" with delete access "rq7SB75.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP002.TMP" with delete access "rq7SB75.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\2Dc2225.exe" with delete access "rq7SB75.exe" opened "C:\Users\%OSUSER%\AppData\Local\Temp\IXP003.TMP\1Ta10aM7.exe" with delete access6d:T6f2,RegCreateKeyExA RegOpenKeyExA OpenProcessToken RegDeleteValueA RegCloseKey GetSystemInfo GetModuleFileNameA CreateProcessA GetStartupInfoW TerminateProcess WriteFile GetTempPathA LockResource GetTempFileNameA FindNextFileA DeleteFileA Sleep CreateDirectoryA CreateFileA GetVersionExA GetSystemDirectoryA CreateThread GetTickCount UnhandledExceptionFilter FindResourceA FindFirstFileA LoadLibraryExA GetProcAddress LoadLibraryA GetFileAttributesA GetDriveTypeA GetModuleHandleW GetModuleFileNameW GetFileSizeEx CreateFileW GetCommandLineW LoadLibraryExW GetModuleHandleExW GetCommandLineA ExitThread FindFirstFileExW IsDebuggerPresent FindNextFileW RegDeleteKeyW SetSecurityDescriptorDacl RegCreateKeyExW RegOpenKeyExW CreateProcessAsUserW RegEnumKeyExW CreateProcessWithLogonW GetUserNameW RegDeleteValueW IcmpSendEcho VirtualAllocEx GetDriveTypeW GetComputerNameW CopyFileExW WriteProcessMemory OpenProcess OutputDebugStringW CreateToolhelp32Snapshot DeleteFileW ReadProcessMemory GetTempPathW Process32NextW CreateProcessW FindFirstFileW CopyFileW GetSystemDirectoryW VirtualAlloc Process32FirstW LoadLibraryW FindResourceExW GetFileSize GetFileAttributesW DeviceIoControl GetTempFileNameW CreateDirectoryW GetVersionExW ShellExecuteW ShellExecuteExW FindWindowW GetCursorPos GetWindowThreadProcessId GetClipboardData FindWindowExW SetKeyboardState InternetConnectW HttpSendRequestW FtpOpenFileW InternetCrackUrlW InternetOpenUrlW InternetCloseHandle InternetReadFile InternetQueryOptionW HttpQueryInfoW InternetOpenW FtpGetFileSize InternetQueryDataAvailable sendto closesocket socket WSAStartup accept recvfrom connect send listen bind recv SleepEx VirtualProtect6e:T607,Wrote 112 instructions to a remote process Wrote 73 instructions to a remote process Wrote 2 instructions to a remote process Wrote 89 instructions to a remote process Wrote 10 instructions to a remote process Wrote 82 instructions to a remote process Wrote 6 instructions to a remote process Wrote 16 instructions to a remote process Wrote 23 instructions to a remote process Wrote 56 instructions to a remote process Wrote 13 instructions to a remote process Wrote 74 instructions to a remote process Wrote 27 instructions to a remote process Wrote 42 instructions to a remote process Wrote 20 instructions to a remote process Wrote 5 instructions to a remote process Wrote 9 instructions to a remote process Wrote 66 instructions to a remote process Wrote 21 instructions to a remote process Wrote 11 instructions to a remote process Wrote 24 instructions to a remote process Wrote 87 instructions to a remote process Wrote 22 instructions to a remote process Wrote 7 instructions to a remote process Wrote 67 instructions to a remote process Wrote 54 instructions to a remote process Wrote 30 instructions to a remote process Wrote 46 instructions to a remote process Wrote 17 instructions to a remote process Wrote 113 instructions to a remote process Wrote 65 instructions to a remote process Wrote 19 instructions to a remote process Wrote 40 instructions to a remote process Wrote 88 instructions to a remote process Wrote 48 instructions to a remote process Wrote 39 instructions to a remote process6f:T4b2,Spawned process "853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe" (UID: 00000000-00004372) Spawned process "sk2Qt47.exe" (UID: 00000000-00003464) Spawned process "ck0rG18.exe" (UID: 00000000-00004112) Spawned process "rq7SB75.exe" (UID: 00000000-00003480) Spawned process "1Ta10aM7.exe" (UID: 00000000-00002040) Spawned process "AppLaunch.exe" (UID: 00000000-00004036) Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\OfficeTrackerNMP131\\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST" (UID: 00000000-00004068) Spawned process "schtasks.exe" with commandline "schtasks /create /f /RU "%OSUSER%" /tr "%ALLUSERSPROFILE%\\OfficeTrackerNMP131\\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST" (UID: 00000000-00004128) Spawned process "2Dc2225.exe" (UID: 00000000-00000384) Spawned process "AppLaunch.exe" (UID: 00000000-00003544) Spawned process "3vO15kf.exe" (UID: 00000000-00003940) Spawned process "4Ut221ym.exe" (UID: 00000000-00000848) Spawned process "5sD6MZ0.exe" (UID: 00000000-00005084) Spawned process "AppLaunch.exe" (UID: 00000000-00005108)70:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAACIiIcAAAAAAAAAAAAAAIiIiI+Hd3dwAAAAAAAACIiIiIiHd3eHdwAAAAAIiIj4iI/4d3d3iIdwAAAAd3/4iIiP/4d3ePiId3gAAHB/iIiIj/iIh3j4j3d3cABwf4d4iP/4iIeI+I93d3cAcHh3eIj/iIiHiPiId3d3AHB4iHeP+IiHiIj4iHd3dwBweIiI//iHd4iI+IhwAAAAcHd3ePiPd3eIiPiIcAAAAHB3d3j4+Hd3iIj4iHAAAABwd4h4//h3d4iI+IhwAAAAcHd3eIj4h3eIiPiIcAAAAHB4t4iP/4iIiIj4iHAAAABweHeIj/+IiIh/94hwAAAAcH+IiI//iIiIf/iIcAAAAHB/+IiP//iIiH/4iHAAAABwf/iIiIiIiHeP+IhwAAAAcH+Id3d4iIiIj/iIcAAAAHd4eIiIiPiIiP/4iHAAAAAIh3//iIj/////+IhwAAAAAAd///+P////+PeIcAAAAAAHf///+IiId3iIeHcAAAAAB3h3d3d3eIiIj4iHAAAAAAd4d3iI//////+Hh3AAAAAHeIeP////////+HeAAAAAB3iIj//////4iIiHgAAAiAd4iIj4iIiIiIiIeAAAAAAAj/iIiIiHiIiIiHAAAAAAAAAAh4iIiIiIh3gAAAAAgAAAAAAAAIAAAAAAiAAAD/+A///4AA//wAAH/AAAA/gAAAB4AAAAOAAAABgAAAAYAAAAGAAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD/AAAA/8AAAP/AAAB/wAAAf8AAAD/AAAA/wAAAPkAAAH/gAAD//gAB/v/7/nw==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791709881482,"unified_at":"2026-10-11T09:11:21.482Z","metadata":{"hashes":{"sha256":"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","sha1":"f3a19fd33ff34cb7f2b448e0b703d25e5a789d3c","md5":"23178fd674e0857fd28c3f1062e84348","sha512":"82f24d5ac943e1e48100217e3edd048b372c4be132663577dfd33816cbe1fb00813aeabbb89ac5110e690a1d2b517fe70488121ad6bfa970823031c7b38e1c9c","ssdeep":"49152:jzjNftH5O+e6fus2HiaH5e8/VYjcBTTTZF/M:RtZOUiCq3kcBvTZF","ssdeep_chunks":["49152:jzjNftH","49152:zjNftH5","49152:jNftH5O","49152:NftH5O+","49152:ftH5O+e","49152:tH5O+e6","49152:H5O+e6f","49152:5O+e6fu","49152:O+e6fus","49152:+e6fus2","49152:e6fus2H","49152:6fus2Hi","49152:fus2Hia","49152:us2HiaH","49152:s2HiaH5","49152:2HiaH5e","49152:HiaH5e8","49152:iaH5e8/","49152:aH5e8/V","49152:H5e8/VY","49152:5e8/VYj","49152:e8/VYjc","49152:8/VYjcB","49152:/VYjcBT","49152:VYjcBTT","49152:YjcBTTT","49152:jcBTTTZ","49152:cBTTTZF","49152:BTTTZF/","49152:TTTZF/M","98304:jzjNftH","98304:zjNftH5","98304:jNftH5O","98304:NftH5O+","98304:ftH5O+e","98304:tH5O+e6","98304:H5O+e6f","98304:5O+e6fu","98304:O+e6fus","98304:+e6fus2","98304:e6fus2H","98304:6fus2Hi","98304:fus2Hia","98304:us2HiaH","98304:s2HiaH5","98304:2HiaH5e","98304:HiaH5e8","98304:iaH5e8/","98304:aH5e8/V","98304:H5e8/VY","98304:5e8/VYj","98304:e8/VYjc","98304:8/VYjcB","98304:/VYjcBT","98304:VYjcBTT","98304:YjcBTTT","98304:jcBTTTZ","98304:cBTTTZF","98304:BTTTZF/","98304:TTTZF/M","49152:RtZOUiC","49152:tZOUiCq","49152:ZOUiCq3","49152:OUiCq3k","49152:UiCq3kc","49152:iCq3kcB","49152:Cq3kcBv","49152:q3kcBvT","49152:3kcBvTZ","49152:kcBvTZF"],"imphash":"646167cce332c1c252cdcb1839e0cf48"},"file_info":{"file_name":"23178fd674e0857fd28c3f1062e84348.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1826304,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1701274810000,"last_seen":1788387548000,"last_multi_scan":1788387548000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","risepro","backdoor","smokeloader","credentialharvesting","redlinestealer","criminal","informationstealer","downloader","suspicious"]},"stats":{"av":{"malicious_count":12,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":112},"sandbox_signatures":{"informative_count":292,"suspicious_count":16,"malicious_count":13,"total":321},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Crifi.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Crifi.1 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Spy.Win32.Redline.lu!heur","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005aad751 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Kryptik.JKR.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.UIR","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Generic.Win32.1852842","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"SmokeLoader","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Reads system mouse configuration"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current hardware profile (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"malicious","value":"Writes shellcode to a remote process"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Able to query registry keys (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Privilege Escalation","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modify auto-execute functionality"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Imports system security related APIs"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access recent files"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"},{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Privilege Escalation","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"},{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Contains ability to retrieve/open a process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"malicious","value":"Spawns many processes"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"},{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Drops files with image extension"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Drops XML files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"suspicious","value":"Writes a PE file header to disc"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Decrypted SSL network traffic"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Discovery","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Calls an API typically used to remove a directory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"malicious","value":"Schedules a task to be executed at a specific time and date"},{"type":"informative","value":"Able to create or schedule tasks using domain/system privileges"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Persistence","technique":"Shortcut Modification","attack_id":"T1547.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/009","identifiers":[{"type":"informative","value":"Contains ability to register hotkeys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Privilege Escalation","technique":"Bypass User Account Control","attack_id":"T1548.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1548/002","identifiers":[{"type":"informative","value":"Contains ability to bypass UAC using COM object (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"informative","value":"Contains ability to detect presence of virtual environment (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Contains ability to query volume size"},{"type":"informative","value":"Able to retrieve information set for devices (API string)"},{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Dotnet file packed with confuser protection"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"},{"type":"informative","value":"Contains ability to load CLR runtime module (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to block user input (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Imports SHEmptyRecycleBin API"},{"type":"informative","value":"Able to permanently delete files from the Recycle Bin"},{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"},{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"Clear Persistence","attack_id":"T1070.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/009","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"Masquerade Task or Service","attack_id":"T1036.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/004","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"},{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Credential Access","technique":"Windows Credential Manager","attack_id":"T1555.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/004","identifiers":[{"type":"informative","value":"Contains ability to to enumerates the credentials (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"informative","value":"Contains ability to retrieve system network configuration"},{"type":"informative","value":"Contains references to the retrieval of internet session handle (imports API)"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Discovery","technique":"Password Policy Discovery","attack_id":"T1201","attack_id_wiki":"https://attack.mitre.org/techniques/T1201","identifiers":[{"type":"informative","value":"Contains ability to retrieve password policy information"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Contains ability to provide information and utilities for managing network resources (API string)"},{"type":"informative","value":"Imports windows networking-related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Able to identify remote systems"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Contains ability to find and load resources of a specific module"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"malicious","value":"Contacts multiple hosts"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Communicates with HTTPS web server (GET/POST requests)"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"},{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"malicious","value":"Detected multiple DNS responses with a low TTL"},{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Command and Control","technique":"Dead Drop Resolver","attack_id":"T1102.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1102/001","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (Cloud) detected file with high confidence","description":"\"Portable Executable (Cloud) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-16","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$27","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryA\" (Indicator: \"CreateDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1074.001","id":"string-423","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" in Source: sample.bin, \"System\\CurrentControlSet\\Control\\Session Manager\\FileRenameOperations\" in Source: sample.bin, \"DSystem\\CurrentControlSet\\Control\\Session Manager\" in Source: sample.bin, \"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-120","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-161","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-208","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-315","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-345","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"sample.bin\"), Found reference to API \"FreeResource\" (Indicator: \"FreeResource\"; Source: \"sample.bin\"), Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"sample.bin\"), Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"sample.bin\"), Found reference to API \"FindResourceA\" (Indicator: \"FindResource\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-550","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"wextract.pdb\"","origin":"sample.bin","id":"string-7","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-204","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-307","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-319","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"sample.bin\"), Found reference to API \"RemoveDirectoryA\" (Indicator: \"RemoveDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.004","id":"string-308","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\"), Found reference to API \"SeShutdownPrivilege\" (Indicator: \"SeShutdownPrivilege\"; Source: \"sample.bin\"), Found reference to API \"LookupPrivilegeValueA\" (Indicator: \"LookupPrivilegeValue\"; Source: \"sample.bin\"), Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"sample.bin\"), file/memory contains long string with (Indicator: \"AdjustTokenPrivileges\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-77","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"sample.bin\"), Found reference to API \"EqualSid\" (Indicator: \"EqualSid\"; Source: \"sample.bin\"), Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"sample.bin\"), Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"sample.bin\"), Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"InitializeSid\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-114","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1222","id":"string-426","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"sample.bin\"), Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1489","id":"string-316","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-230","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesA\" (Indicator: \"GetFileAttributes\"; Source: \"sample.bin\"), Found reference to API \"GetSystemDirectoryA\" (Indicator: \"GetSystemDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoSizeA\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoSizeA\" (Indicator: \"GetFileVersionInfoSize\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentDirectoryA\" (Indicator: \"GetCurrentDirectory\"; Source: \"sample.bin\"), Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; Source: \"sample.bin\"), Found reference to API \"GetFileVersionInfoA\" (Indicator: \"GetFileVersionInfo\"; Source: \"sample.bin\"), Found reference to API \"GetTempFileNameA\" (Indicator: \"GetTempFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-207","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-80","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-427","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\"), Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1057","id":"string-85","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExA\" in \"sample.bin\", Found registry query API: \"RegOpenKeyExA\" in \"sample.bin\", Found registry query API: \"RegQueryInfoKeyA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-229","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; Source: \"sample.bin\"), Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1113","id":"string-78","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"sample.bin\"), Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-83","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\"), Found reference to API \"Error loading %shGetProcAddress() failed on function '%s'. Possible reason: incorrect version of advpack.dll being used./Windows 95 or Windows NT is required to install\" (Indicator: \"GetProcAddress\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-317","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134","id":"string-437","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-121","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-205","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-164","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\App Paths\" (Indicator: \"microsoft\\windows\\currentversion\\app paths\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1012","id":"string-96","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-131","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \".n-.gs\", Heuristic match: \"lr>qk.ag\", Heuristic match: \"og.mr\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"sample.bin\"), Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"sample.bin\"), Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1033","id":"string-908","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1543","id":"string-167","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in \"sample.bin\", Found system information discovery API: \"ExpandEnvironmentStringsA\" in \"sample.bin\"","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-89","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.015","id":"string-721","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-162","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-249","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1124","id":"string-247","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1029","id":"string-365","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"sample.bin\"), Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"sample.bin\"), Found reference to API \"GetVersion\" (Indicator: \"GetVersion\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-171","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-193","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1083","id":"string-312","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" (Indicator: \"software\\microsoft\\windows\\currentversion\\run\"; in Source: \"sample.bin\"), Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\RunOnce\" (Indicator: \"software\\microsoft\\windows\\currentversion\\runonce\"; in Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1547","id":"string-184","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-310","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"sample.bin\"), Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055.001","id":"string-318","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1055","id":"string-92","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1112","id":"string-304","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1070.006","id":"string-409","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"MsgWaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\"), Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"sample.bin\"), Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1497.003","id":"string-226","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"file/memory contains long string with (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\"), Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1134.001","id":"string-306","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcA\" (Indicator: \"CallWindowProc\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1564.003","id":"string-320","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"DecryptFileA\" (Indicator: \"DecryptFileA\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1573","id":"string-602","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"DecryptFileA\" (Indicator: \"DecryptFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-438","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"DecryptFileA\" (Indicator: \"DecryptFile\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1140","id":"string-212","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; Source: \"sample.bin\"), Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-148","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"sample.bin\"), Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1622","id":"string-183","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-354","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"file/memory contains long string with (Indicator: \"ExitWindows\"; Source: \"sample.bin\"), Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-189","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"system.io.compression.dll\" (Source: \"00000000-00000384.00000000.81930.00380000.00000004.mdmp\")\n Found string \"clrcompression.dll\" (Source: \"00000000-00000384.00000000.81930.00380000.00000004.mdmp\")\n Found string \"system.io.compression.filesystem.dll\" (Source: \"00000000-00000384.00000000.81930.00380000.00000004.mdmp\")\n Found string \"system.io.compression.zipfile.dll\" (Source: \"00000000-00000384.00000000.81930.00380000.00000004.mdmp\")\n Found string \"system.io.compression.dll\" (Source: \"00000000-00002040.00000000.81585.00350000.00000004.mdmp\")\n Found string \"clrcompression.dll\" (Source: \"00000000-00002040.00000000.81585.00350000.00000004.mdmp\")\n Found string \"system.io.compression.filesystem.dll\" (Source: \"00000000-00002040.00000000.81585.00350000.00000004.mdmp\")\n Found string \"system.io.compression.zipfile.dll\" (Source: \"00000000-00002040.00000000.81585.00350000.00000004.mdmp\")\n Found string \"unknown compression method\" (Source: \"00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"00004036.00000FC4.489261.00537000.wprm\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; File: \"00004036.00000FC4.489261.00537000.wprm\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; File: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"OpenThreadToken\" (Indicator: \"OpenThread\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"$28","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"$29","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\IXP000.TMP\\ (UID: 00000000-00004372)\n \"sk2Qt47.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\IXP001.TMP\\ (UID: 00000000-00003464)\n \"ck0rG18.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\IXP002.TMP\\ (UID: 00000000-00004112)\n \"rq7SB75.exe\" called \"RemoveDirectoryA\" with parameter %TEMP%\\IXP003.TMP\\ (UID: 00000000-00003480)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; File: \"00004036.00000FC4.489261.00537000.wprm\")\n Found reference to API \"CreateRemoteThread\" (Indicator: \"CreateRemoteThread\"; Source: \"00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to detect presence of virtual environment (API string)","description":"Found reference to API \"SetupDiGetClassDevsA\" (Indicator: \"SetupDiGetClassDevs\"; File: \"00004036.00000FC4.489261.00537000.wprm\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; File: \"00004036.00000FC4.489261.00537000.wprm\")\n Found reference to API \"SetupDiGetClassDevsA\" (Indicator: \"SetupDiGetClassDevs\"; Source: \"00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"SetupDiEnumDeviceInfo\"; Source: \"00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-253","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load CLR runtime module (Dotnet)","description":"Observed imported APIs from \"mscoree.dll\" : \"CLRCreateInstance\" [Source: FANBooster131.exe]","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-170","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"00004036.00000FC4.489261.00537000.wprm\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"00004036.00000FC4.489261.00537000.wprm\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file packed with confuser protection","description":"Observed string: \"ConfusedByAttribute\" (Indicator: \"ConfusedByAttribute\") in Source: 00003544.00000DD8.675446.00402000.wprm\n Observed string: \"Confuser.Core 1.6.0+447341964f\" (Indicator: \"Confuser.Core \") in Source: 00003544.00000DD8.675446.00402000.wprm\n Observed string: \"ConfusedByAttribute\" (Indicator: \"ConfusedByAttribute\") in Source: 00000000-00000384.00000000.81924.0110A000.00000004.mdmp\n Observed string: \"Confuser.Core 1.6.0+447341964f\" (Indicator: \"Confuser.Core \") in Source: 00000000-00000384.00000000.81924.0110A000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1027.002","relevance":1,"id":"string-232","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00000384.00000000.81924.0110A000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005084.00000000.84951.00ECA000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\uzi; Source: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")\n Found string - \\.\\uzi; Source: \"00000000-00003464.00000000.81378.00AEA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to block user input (API string)","description":"Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; File: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-547","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"$2d","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"00004036.00000FC4.489261.00537000.wprm\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"00003544.00000DD8.675446.00402000.wprm\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00000384.00000000.81924.0110A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"00004036.00000FC4.489261.00537000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00000384.00000000.81930.00380000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00000848.00000000.82599.005E0000.00000004.mdmp, 00000000-00000848.00000001.84524.005E0000.00000004.mdmp, 00000000-00000848.00000002.84619.005E0000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002040.00000000.81585.00350000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003464.00000000.81378.00240000.00000004.mdmp, 00000000-00003464.00000001.83300.00240000.00000004.mdmp, 00000000-00003464.00000002.84625.00240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2f","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.97436","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$30","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$31","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"$32","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"00003544.00000DD8.675446.00402000.wprm\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00000384.00000000.81924.0110A000.00000004.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; Source: \"00000000-00003464.00000000.81378.00AEA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003544-00000C2C-287886896\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"get_UserName\" (Source: \"00000000-00000384.00000000.81924.0110A000.00000004.mdmp\")\n Found string \"get_Is64BitOperatingSystem\" (Source: \"00000000-00000384.00000000.81924.0110A000.00000004.mdmp\")\n Found string \"GetUserNameW\" (Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found string \"GetUserNameA\" (Source: \"00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003544-00000C2C-287886896\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00003544-00000C2C-288405570\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"00004036.00000FC4.489261.00537000.wprm\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"00004036.00000FC4.489261.00537000.wprm\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"00004036.00000FC4.489261.00537000.wprm\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information set for devices (API string)","description":"Found reference to API \"SetupDiGetClassDevsA\" (Indicator: \"setupdigetclassdevs\"; File: \"00004036.00000FC4.489261.00537000.wprm\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"setupdienumdeviceinfo\"; File: \"00004036.00000FC4.489261.00537000.wprm\")\n Found reference to API \"SetupDiGetClassDevsA\" (Indicator: \"setupdigetclassdevs\"; Source: \"00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")\n Found reference to API \"SetupDiEnumDeviceInfo\" (Indicator: \"setupdienumdeviceinfo\"; Source: \"00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-533","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"00004036.00000FC4.489261.00537000.wprm\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"00004036.00000FC4.489261.00537000.wprm\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; File: \"00004036.00000FC4.489261.00537000.wprm\")\n Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; File: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"GetKeyboardLayoutNameW\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"AppLaunch.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004036)\n \"schtasks.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004068)\n \"schtasks.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00004128)\n \"schtasks.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00004128)\n \"AppLaunch.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00003544)\n \"AppLaunch.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00003544)\n \"AppLaunch.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00003544)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00004372)\n \"sk2Qt47.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003464)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"4Ut221ym.exe\" called \"GetForegroundWindow\" (UID: 00000000-00000848)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"AppLaunch.exe\" called \"IsWow64Process\" with parameter \"4036\" - (UID: 00000000-00004036)\n \"schtasks.exe\" called \"IsWow64Process\" with parameter \"4068\" - (UID: 00000000-00004068)\n \"schtasks.exe\" called \"IsWow64Process\" with parameter \"4128\" - (UID: 00000000-00004128)\n \"AppLaunch.exe\" called \"IsWow64Process\" with parameter \"3544\" - (UID: 00000000-00003544)\n \"4Ut221ym.exe\" called \"IsWow64Process\" with parameter \"848\" - (UID: 00000000-00000848)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"AppLaunch.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00004036)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$36","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$37","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"schtasks.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00004068)\n \"schtasks.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00004128)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: sk2Qt47.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: ck0rG18.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: rq7SB75.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: 4Ut221ym.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00004112-30330-83-00257155","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"00004036.00000FC4.489261.00537000.wprm\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileA@KERNEL32.DLL at 00000000-00004112-30330-31-00252390\n FindFirstFileExW@KERNEL32.DLL at 00000000-00002040-31486-638-00D465AB\n FindFirstFileExW@KERNEL32.DLL at 00000000-00000384-41559-638-010F65AB\n FindFirstFileExW@KERNEL32.DLL at 00000000-00005084-56128-638-00EB65AB","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeA@KERNEL32.DLL at 00000000-00004112-30330-62-002555A0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp, 00000000-00000848.00000001.84524.72571000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004112-30330-83-00257155\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002040-31486-544-00D3588C\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00000384-41559-544-010E588C\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005084-56128-544-00EA588C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00004112-30330-83-00257155\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00002040-31486-544-00D3588C\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00000384-41559-544-010E588C\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00005084-56128-544-00EA588C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00000000-00004112-30330-14-00252BFB\n GetVersionExA@KERNEL32.DLL at 00000000-00004112-30330-22-0025681F\n GetVersionExA@KERNEL32.DLL at 00000000-00004112-30330-74-002536EE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"$38","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00000000-00004112-30330-60-0025597D\n GetDiskFreeSpaceA@KERNEL32.DLL at 00000000-00004112-30330-67-00256952","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.001","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$39","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set list\" (Indicator: \"set \"; File: \"00004036.00000FC4.486111.00400000.wprm\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system","description":"GetSystemInfo@KERNEL32.DLL at 00000000-00004112-30330-63-00255467","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":4,"id":"stream-86","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"00004036.00000FC4.489261.00537000.wprm\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve password policy information","description":"file/memory contains long string with (Indicator: \"net accounts\"; File: \"SSL\")","origin":"File/Memory","mitre_attack_id":"T1201","relevance":1,"id":"string-527","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"Found string \"tracert.exe\" (Indicator: \"tracert\"; Source: \"00000000-00000848.00000001.84524.005E0000.00000004.mdmp, 00000000-00000848.00000002.84619.005E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"OpenProcessToken@ADVAPI32.DLL at 00000000-00004112-30330-15-00251F90\n OpenProcessToken@ADVAPI32.DLL at 00000000-00004112-30330-72-002518A3\n GetProcessHeap@KERNEL32.DLL at 00000000-00002040-31486-1187-00D49C43\n GetProcessHeap@KERNEL32.DLL at 00000000-00000384-41559-1187-010F9C43\n GetProcessHeap@KERNEL32.DLL at 00000000-00005084-56128-1187-00EB9C43","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$3b","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Reads system mouse configuration","description":"\"4Ut221ym.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\CONTROL PANEL\\MOUSE\";)\n \"4Ut221ym.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\CONTROL PANEL\\MOUSE\";)","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-202","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"4Ut221ym.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"4Ut221ym.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"4Ut221ym.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\")\n \"4Ut221ym.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\"; Key: \"USESHORTNAME\")\n \"4Ut221ym.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\"; Key: \"APPENDPATH\")\n \"4Ut221ym.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\IEXPLORE.EXE\"; Key: \"PATH\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Environment Awareness","name":"Tries to access recent files","description":"\"iexplore.exe\" trying to touch file \"\\Device\\HarddiskVolume2\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Recent\\CustomDestinations\\\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-169","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Able to execute applications using .NET process API","description":"Found string \"ProcessStartInfo\" (Source: \"00000000-00000384.00000000.81924.0110A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-934","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"5sD6MZ0.exe\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00000384.00000000.81930.010FD000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00000384.00000000.81930.010FD000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00002040.00000000.81585.00D4D000.00000002.mdmp, 00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00002040.00000000.81585.00D4D000.00000002.mdmp, 00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"00004036.00000FC4.489261.00537000.wprm\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"00004036.00000FC4.489261.00537000.wprm\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00000384.00000000.81930.010FD000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002040.00000000.81585.00D4D000.00000002.mdmp, 00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"AppLaunch.exe\" called \"CopyFileA\" to copy %WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe to new location %LOCALAPPDATA%\\MaxLoonaFest131\\MaxLoonaFest131.exe (UID: 00000000-00004036)\n \"AppLaunch.exe\" called \"CopyFileA\" to copy %WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe to new location %TEMP%\\FANBooster131\\FANBooster131.exe (UID: 00000000-00004036)\n \"AppLaunch.exe\" called \"CopyFileA\" to copy %WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe to new location %ALLUSERSPROFILE%\\OfficeTrackerNMP131\\OfficeTrackerNMP131.exe (UID: 00000000-00004036)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"AppLaunch.exe\" called \"CreateDirectoryW\" with parameter %WINDIR%\\System32\\GroupPolicy\\Machine (UID: 00000000-00004036)\n \"AppLaunch.exe\" called \"CreateDirectoryW\" with parameter %WINDIR%\\System32\\GroupPolicy\\User (UID: 00000000-00004036)\n \"AppLaunch.exe\" called \"CreateDirectoryA\" with parameter %LOCALAPPDATA%\\MaxLoonaFest131 (UID: 00000000-00004036)\n \"AppLaunch.exe\" called \"CreateDirectoryA\" with parameter %TEMP%\\FANBooster131 (UID: 00000000-00004036)\n \"AppLaunch.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Caches (UID: 00000000-00004036)\n \"AppLaunch.exe\" called \"CreateDirectoryA\" with parameter %ALLUSERSPROFILE%\\OfficeTrackerNMP131 (UID: 00000000-00004036)\n \"AppLaunch.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00003544)\n \"AppLaunch.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00003544)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$3c","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3e","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Can load assembly that contains the code that is currently executing (Dotnet)","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; File: \"00003544.00000DD8.675446.00402000.wprm\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00000384.00000000.81924.0110A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ocsp.pki.goog\"\n \"c.pki.goog\"\n \"ocsp.digicert.cn\"\n \"crt.rootg2.amazontrust.com\"\n \"crl.rootg2.amazontrust.com\"\n \"ocsp.rootca1.amazontrust.com\"\n \"crl.rootca1.amazontrust.com\"\n \"ocsp.rootg2.amazontrust.com\"\n \"crl.r2m04.amazontrust.com\"\n \"ocsp.r2m04.amazontrust.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"194.49.94.152:50500\"\n \"194.49.94.152:19053\"\n \"142.251.163.84:443\"\n \"142.251.45.3:80\"\n \"142.251.219.131:443\"\n \"142.251.219.46:443\"\n \"142.251.157.119:443\"\n \"157.240.11.35:443\"\n \"155.102.54.134:80\"\n \"57.145.2.128:443\"\n \"23.45.138.131:443\"\n \"162.159.140.229:443\"\n \"23.48.8.218:443\"\n \"104.18.20.94:443\"\n \"104.18.21.177:443\"\n \"104.19.229.21:443\"\n \"3.221.26.248:443\"\n \"18.238.80.31:80\"\n \"151.101.1.21:443\"\n \"150.171.109.72:443\"\n \"99.84.160.31:80\"\n \"18.164.123.208:80\"\n \"13.226.94.71:80\"\n \"18.238.45.26:80\"\n \"52.84.24.24:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00004112-30330-11-00256A60\n WaitForSingleObject@KERNEL32.DLL at 00000000-00004112-30330-37-00253FEF\n MsgWaitForMultipleObjects at 00000000-00004112-30330-95-00253680\n WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00002040-31486-217-00D328D0\n WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00000384-41559-217-010E28D0\n WaitForSingleObjectEx@KERNEL32.DLL at 00000000-00005084-56128-217-00EA28D0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: sk2Qt47.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: ck0rG18.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: rq7SB75.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: 4Ut221ym.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.DLL at 00000000-00004112-30330-33-00252F1D\n LoadLibraryExA@KERNEL32.DLL at 00000000-00004112-30330-41-00256495\n LoadLibraryA@KERNEL32.DLL at 00000000-00004112-30330-42-0025202A\n LoadLibraryA@KERNEL32.DLL at 00000000-00004112-30330-73-002517EE\n LoadLibraryA@KERNEL32.DLL at 00000000-00004112-30330-112-00254224\n LoadLibraryExW@KERNEL32.DLL at 00000000-00002040-31486-593-00D393D2\n LoadLibraryExW@KERNEL32.DLL at 00000000-00000384-41559-593-010E93D2\n LoadLibraryExW@KERNEL32.DLL at 00000000-00005084-56128-593-00EA93D2","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; File: \"00004036.00000FC4.489261.00537000.wprm\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; File: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"LoadUserProfileW\" (Indicator: \"LoadUserProfile\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")\n Found reference to API \"LoadUserProfileW\" (Indicator: \"LoadUserProfile\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"LogonUserW\" (Indicator: \"LogonUser\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Contains ability to register hotkeys (API string)","description":"Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; File: \"00003544.00000DD8.675446.00402000.wprm\")\n Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"00000000-00000384.00000000.81924.0110A000.00000004.mdmp\")\n Found reference to API \"RegisterHotKey\" (Indicator: \"RegisterHotKey\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547.009","relevance":1,"id":"string-545","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileW in import section (Source: 4Ut221ym.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$41","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"FANBooster131.lnk\" as clean (type is \"MS Windows shortcut Item id list present Points to a file or directory Has Description string Has Relative path Unicoded MachineID hapubws-pc KnownFolderID F3CE0F7C-4901-4ACC-8648-D5D44B04EF8F Archive NeedIndexed ctime=Wed Sep 2 22:19:31 2026 atime=Wed Sep 2 22:19:31 2026 mtime=Thu Mar 28 01:11:14 2019 length=102568 window=normal IDListSize 0x01f6 Root folder \"59031A47-3F72-44A7-89C5-5595FE6B30EE\" LocalBasePath \"C:\\Users\\\"\")\n Antivirus vendors marked dropped file \"OfficeTrackerNMP131.exe\" as clean (type is \"PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections\"), Antivirus vendors marked dropped file \"MaxLoonaFest131.exe\" as clean (type is \"PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$42","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"$43","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"$44","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"$45","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$46","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"ttps://www.paypal.com/signin\" (Indicator: \"paypal.com\")\n \"ww.paypal.com\" (Indicator: \"paypal.com\")\n \"https://www.paypal.com/signin\" (Indicator: \"paypal.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$47","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"iexplore.exe\" (UID: 00000000-00003176)\n Launches browser \"iexplore.exe\" (UID: 00000000-00001868)\n Launches browser \"iexplore.exe\" (UID: 00000000-00003252)\n Launches browser \"iexplore.exe\" (UID: 00000000-00004104)\n Launches browser \"iexplore.exe\" (UID: 00000000-00003744)\n Launches browser \"iexplore.exe\" (UID: 00000000-00002148)\n Launches browser \"iexplore.exe\" (UID: 00000000-00002900)\n Launches browser \"iexplore.exe\" (UID: 00000000-00004768)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"AppLaunch.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 765F0000\n \"iexplore.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 765F0000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$48","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"AppLaunch.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 62FD0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"AppLaunch.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 749E0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"AppLaunch.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 63C30000\n \"AppLaunch.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 643E0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76920000\n \"sk2Qt47.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76920000\n \"ck0rG18.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76920000\n \"rq7SB75.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76920000\n \"1Ta10aM7.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76920000\n \"AppLaunch.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76920000\n \"schtasks.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76920000\n \"2Dc2225.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76920000\n \"3vO15kf.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76920000\n \"4Ut221ym.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76920000\n \"5sD6MZ0.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76920000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"0d000e003024b964@KERNELBASE.dll\"\n \"0d000e001022046a@KERNELBASE.dll\"\n \"1800190068e80368@api-ms-win-core-synch-l1-2-0.dll\"\n \"1800190088e80368@api-ms-win-core-synch-l1-2-0.dll\"\n \"0d000e00cc5f0368@ntdll.dll\"\n \"1500160020730a68@ADVAPI32.dll\"\n \"0e000f00e4730a68@ADVAPI32.dll\"\n \"0e000f0050740a68@ADVAPI32.dll\"\n \"11001200d47d0a68@ADVAPI32.dll\"\n \"110012007c7e0a68@ADVAPI32.dll\"\n \"12001300cc7e0a68@ADVAPI32.dll\"\n \"12001300387f0a68@ADVAPI32.dll\"\n \"14001500e4b70a68@ADVAPI32.dll\"\n \"1400150000b80a68@ADVAPI32.dll\"\n \"140015001cb80a68@ADVAPI32.dll\"\n \"1700180038b80a68@ADVAPI32.dll\"\n \"0d000e0054b80a68@ADVAPI32.dll\"\n \"1100120064b80a68@ADVAPI32.dll\"\n \"110012007cb80a68@ADVAPI32.dll\"\n \"0d000e0090900a68@WININET.dll\"\n \"0d000e000c910a68@WININET.dll\"\n \"100011004c910a68@WININET.dll\"\n \"1000110004920a68@WININET.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"$49","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"4Ut221ym.exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"4Ut221ym.exe\" touched \"Network\" (Path: \"HKCU\\CLSID\\{208D2C60-3AEA-1069-A2D7-08002B30309D}\\SHELLFOLDER\")\n \"4Ut221ym.exe\" touched \"Property System Both Class Factory\" (Path: \"HKCU\\CLSID\\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\")\n \"4Ut221ym.exe\" touched \"Application Registration\" (Path: \"HKCU\\CLSID\\{591209C7-767B-42B2-9FBA-44EE4615F2C7}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"1Ta10aM7.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"sk2Qt47.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"ck0rG18.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"rq7SB75.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"4Ut221ym.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"2Dc2225.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"5sD6MZ0.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"FANBooster131.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\" has an executable section named \".text\"\n \"1Ta10aM7.exe\" has an executable section named \".text\"\n \"sk2Qt47.exe\" has an executable section named \".text\"\n \"ck0rG18.exe\" has an executable section named \".text\"\n \"rq7SB75.exe\" has an executable section named \".text\"\n \"4Ut221ym.exe\" has an executable section named \".text\"\n \"2Dc2225.exe\" has an executable section named \".text\"\n \"5sD6MZ0.exe\" has an executable section named \".text\"\n \"FANBooster131.exe\" has an executable section named \".text\"\n \"3vO15kf.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\" has an writable section named \".data\"\n \"1Ta10aM7.exe\" has an writable section named \".data\"\n \"1Ta10aM7.exe\" has an writable section named \".BSs\"\n \"sk2Qt47.exe\" has an writable section named \".data\"\n \"ck0rG18.exe\" has an writable section named \".data\"\n \"rq7SB75.exe\" has an writable section named \".data\"\n \"4Ut221ym.exe\" has an writable section named \".data\"\n \"2Dc2225.exe\" has an writable section named \".data\"\n \"2Dc2225.exe\" has an writable section named \".BSs\"\n \"5sD6MZ0.exe\" has an writable section named \".data\"\n \"5sD6MZ0.exe\" has an writable section named \".BSs\"\n \"FANBooster131.exe\" has an writable section named \".data\"\n \"3vO15kf.exe\" has an writable section named \".text\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$4a","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".rsrc\" is \"0x1b5800\" greater than 0x100000\n Raw size of \".BSs\" is \"0x178000\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x17fa00\" greater than 0x100000\n Raw size of \".rsrc\" is \"0x108000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".rsrc\" is \"0x1b6000\" greater than 0x100000\n Virtual size of \".BSs\" is \"0x177e0c\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x180000\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x108000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\system32\\schtasks.exe\" [Source: 00000000-00004128-00000C2B-284088226]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"sk2Qt47.exe\" (UID: 00000000-00003464) was launched with new environment variables: \"__COMPAT_LAYER=\"ElevateCreateProcess WRPMitigationLayer\", USERDNSDOMAIN=\"%OSUSER%-PC\"\"\n Process \"sk2Qt47.exe\" (UID: 00000000-00003464) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"iexplore.exe\" (UID: 00000000-00003176) was launched with modified environment variables: \"Path\"\n Process \"5sD6MZ0.exe\" (UID: 00000000-00005084) was launched with modified environment variables: \"Path\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"accounts.google.com\"\n \"accounts.youtube.com\"\n \"c.pki.goog\"\n \"crl.r2m04.amazontrust.com\"\n \"crl.rootca1.amazontrust.com\"\n \"crl.rootg2.amazontrust.com\"\n \"crt.rootg2.amazontrust.com\"\n \"fonts.googleapis.com\"\n \"fonts.gstatic.com\"\n \"js.hcaptcha.com\"\n \"o.ss2.us\"\n \"ocsp.digicert.cn\"\n \"ocsp.pki.goog\"\n \"ocsp.r2m04.amazontrust.com\"\n \"ocsp.rootca1.amazontrust.com\"\n \"ocsp.rootg2.amazontrust.com\"\n \"s.ss2.us\"\n \"ssl.gstatic.com\"\n \"static-assets-prod.unrealengine.com\"\n \"static.xx.fbcdn.net\"\n \"steamcommunity.com\"\n \"store.steampowered.com\"\n \"tracking.epicgames.com\"\n \"twitter.com\"\n \"www.epicgames.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$4b","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"4Ut221ym.exe\" searching for class \"Shell_TrayWnd\"\n \"4Ut221ym.exe\" searching for class \"IEFrame\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$4d","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$4e","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$4f","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"1Ta10aM7.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"sk2Qt47.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"ck0rG18.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"rq7SB75.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"4Ut221ym.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"2Dc2225.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"5sD6MZ0.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"FANBooster131.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"3vO15kf.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\sk2Qt47.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to create or schedule tasks using domain/system privileges","description":"Found string \"schtasks /create /f /RU \"%OSUSER%\" /tr \"%ALLUSERSPROFILE%\\OfficeTrackerNMP131\\OfficeTrackerNMP131.exe\" /tn \"OfficeTrackerNMP131 HR\" /sc HOURLY /rl HIGHEST\" (Source: \"00000000-00004036-00000C46-4689370440\")\n Found string \"schtasks /create /f /RU \"%OSUSER%\" /tr \"%ALLUSERSPROFILE%\\OfficeTrackerNMP131\\OfficeTrackerNMP131.exe\" /tn \"OfficeTrackerNMP131 LG\" /sc ONLOGON /rl HIGHEST\" (Source: \"00000000-00004036-00000C46-6796797442\")","origin":"File/Memory","mitre_attack_id":"T1053.005","relevance":1,"id":"string-675","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"AppLaunch.exe\" connecting to \"\\ThemeApiPort\"\n \"schtasks.exe\" connecting to \"\\ThemeApiPort\"\n \"4Ut221ym.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$50","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops XML files","description":"\"www.epicgames_1_.xml\" has type \"Unknown\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-39","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"~DF4F148703ECD3B47F.TMP\" has type \"Unknown\"\n \"~DF48CB1DF001E92E1C.TMP\" has type \"Unknown\"\n \"~DF4DD3A20BB8585015.TMP\" has type \"Unknown\"\n \"~DFCF337D6076FC8178.TMP\" has type \"Unknown\"\n \"~DFFFEDA6F6B4DDD716.TMP\" has type \"Unknown\"\n \"~DFB4B08E2A17CB80CB.TMP\" has type \"Unknown\"\n \"~DF14074ACA1678D782.TMP\" has type \"Unknown\"\n \"~DF9705842FDE446FC4.TMP\" has type \"Unknown\"\n \"~DF16CC35A79A665A16.TMP\" has type \"Unknown\"\n \"~DF960FE0B339D68DE0.TMP\" has type \"Unknown\"\n \"~DF802F3078ACA9FAFC.TMP\" has type \"Unknown\"\n \"~DF840139D538D1F5B6.TMP\" has type \"Unknown\"\n \"~DF57F0F235EB39CAB9.TMP\" has type \"Unknown\"\n \"~DFE9D2743F83CC4013.TMP\" has type \"Unknown\"\n \"B0IAA2Z62CUIL0WVR42L.temp\" has type \"Unknown\"\n \"rise131M9Asphalt.tmp\" has type \"Unknown\"\n \"~DF7D7D02400C057A80.TMP\" has type \"Unknown\"\n \"~DFBD72A33580E5A80C.TMP\" has type \"Unknown\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$51","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe\" queries basic process information of the \"C:\\Windows\\System32\\advpack.dll\" (UID: 4372)\n \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe\" queries basic process information of the \"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\" (UID: 4372)\n \"sk2Qt47.exe\" queries basic process information of the \"C:\\Windows\\System32\\advpack.dll\" (UID: 3464)\n \"sk2Qt47.exe\" queries basic process information of the \"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\" (UID: 3464)\n \"ck0rG18.exe\" queries basic process information of the \"C:\\Windows\\System32\\advpack.dll\" (UID: 4112)\n \"ck0rG18.exe\" queries basic process information of the \"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\" (UID: 4112)\n \"rq7SB75.exe\" queries basic process information of the \"C:\\Windows\\System32\\advpack.dll\" (UID: 3480)\n \"rq7SB75.exe\" queries basic process information of the \"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\" (UID: 3480)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$52","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$53","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$54","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$55","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$56","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$57","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\ixp000.tmp\\sk2qt47.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"PING\" (Indicator: \"ping\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found string \"ping 0, Gen\" (Indicator: \"ping \"; Source: \"00000000-00003464.00000000.81378.00240000.00000004.mdmp, 00000000-00003464.00000001.83300.00240000.00000004.mdmp, 00000000-00003464.00000002.84625.00240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"$59","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTPS web server (GET/POST requests)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-505","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")\n Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")\n Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")\n Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")\n Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"WNetGetConnectionW\" (Indicator: \"NetGetConnection\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide information and utilities for managing network resources (API string)","description":"Found reference to API \"WNetCancelConnection2W\" (Indicator: \"WNetCancelConnection\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")\n Found reference to API \"WNetUseConnectionW\" (Indicator: \"WNetUseConnection\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-113","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")\n Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")\n Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"InternetOpenUrlW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Contains references to the retrieval of internet session handle (imports API)","description":"Found InternetQueryOptionW in import section (Source: 4Ut221ym.exe)","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-206","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 142.251.45.3 on port 80\n HTTP traffic to 155.102.54.134 on port 80\n HTTP traffic to 18.238.80.31 on port 80\n HTTP traffic to 99.84.160.31 on port 80\n HTTP traffic to 18.164.123.208 on port 80\n HTTP traffic to 13.226.94.71 on port 80\n HTTP traffic to 18.238.45.26 on port 80\n HTTP traffic to 52.84.24.24 on port 80\n HTTP traffic to 162.159.142.9 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Decrypted SSL network traffic","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1573","relevance":3,"id":"string-102","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"file/memory contains long string with (Indicator: \".googleapis.com\"; File: \"supported_browsers_1_.htm\")\n Found string \"fonts.googleapis.com\" (Indicator: \".googleapis.com\"; File: \"PCAP\")\n file/memory contains long string with (Indicator: \".googleapis.com\"; File: \"SSL\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"dpmodemx.dll\" [Source: 00000000-00000848.00000001.84524.005E0000.00000004.mdmp\n 00000000-00000848.00000002.84619.005E0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"194.49.94.152\"\n \"15.9.1.22\"\n \"0.0.0.0\"\n \"255.255.255.255\"\n \"1.6.0.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$5e","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$60","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$61","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"crl.rootg2.amazontrust.com\" has high entropy\n Contacted domain: \"crl.rootca1.amazontrust.com\" has high entropy\n Contacted domain: \"ocsp.rootg2.amazontrust.com\" has high entropy\n Contacted domain: \"crl.r2m04.amazontrust.com\" has high entropy\n Contacted domain: \"ocsp.r2m04.amazontrust.com\" has high entropy\n Contacted domain: \"fonts.googleapis.com\" has high entropy\n Contacted domain: \"tracking.epicgames.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking-related APIs","description":"Observed import api \"WNetAddConnection\" which can \"make a connection to a network resource\" [Source: 4Ut221ym.exe]\n Observed import api \"WNetCancelConnection\" which can \"cancel an existing network connection\" [Source: 4Ut221ym.exe]\n Observed import api \"WNetGetConnection\" which can \"retrieve the name of the network resource associated with a local device\" [Source: 4Ut221ym.exe]\n Observed import api \"WNetUseConnection\" which can \"make a connection to a network resource\" [Source: 4Ut221ym.exe]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5182f54f9c6e99d117d9dde3fa2b4cff","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"static-assets-prod.unrealengine.com\" (5 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"accounts.google.com\" (83 days old)\n Short term registered certificate: \"accounts.youtube.com\" (83 days old)\n Short term registered certificate: \"fonts.googleapis.com\" (83 days old)\n Short term registered certificate: \"fonts.gstatic.com\" (83 days old)\n Short term registered certificate: \"js.hcaptcha.com\" (90 days old)\n Short term registered certificate: \"ssl.gstatic.com\" (83 days old)\n Short term registered certificate: \"static-assets-prod.unrealengine.com\" (90 days old)\n Short term registered certificate: \"static.xx.fbcdn.net\" (90 days old)\n Short term registered certificate: \"www.epicgames.com\" (90 days old)\n Short term registered certificate: \"www.facebook.com\" (90 days old)\n Short term registered certificate: \"www.google.com\" (83 days old)\n Short term registered certificate: \"www.youtube.com\" (83 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"142.251.163.84\" on port \"443\"\n HTTPS traffic to \"142.251.219.131\" on port \"443\"\n HTTPS traffic to \"142.251.219.46\" on port \"443\"\n HTTPS traffic to \"142.251.157.119\" on port \"443\"\n HTTPS traffic to \"157.240.11.35\" on port \"443\"\n HTTPS traffic to \"57.145.2.128\" on port \"443\"\n HTTPS traffic to \"23.45.138.131\" on port \"443\"\n HTTPS traffic to \"162.159.140.229\" on port \"443\"\n HTTPS traffic to \"23.48.8.218\" on port \"443\"\n HTTPS traffic to \"104.18.20.94\" on port \"443\"\n HTTPS traffic to \"104.18.21.177\" on port \"443\"\n HTTPS traffic to \"104.19.229.21\" on port \"443\"\n HTTPS traffic to \"3.221.26.248\" on port \"443\"\n HTTPS traffic to \"151.101.1.21\" on port \"443\"\n HTTPS traffic to \"150.171.109.72\" on port \"443\"\n HTTPS traffic to \"142.251.151.4\" on port \"443\"\n HTTPS traffic to \"142.251.108.95\" on port \"443\"\n HTTPS traffic to \"142.251.214.35\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; File: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"SHEmptyRecycleBinW\" (Indicator: \"EmptyRecycleBin\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Ransomware/Banking","name":"Imports SHEmptyRecycleBin API","description":"Observed import api \"SHEmptyRecycleBin\" which can \"empty the Recycle Bin on the specified drive\" [Source: 4Ut221ym.exe]","origin":"Static Parser","mitre_attack_id":"T1070","relevance":1,"id":"static-84","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (File: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found string \"DragQueryFileW\" (File: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found string \"GetClipboardData\" (Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found string \"DragQueryFileW\" (Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"08560,4000,3024,,RtlGetVersion,NTDLL.dll,\"252:06:47.685\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00000384.00000000.81930.00380000.00000004.mdmp\")\n Found reference to API \"9420940,4448,3024,,RtlGetVersion,NTDLL.dll,\"252:07:27.356\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00000848.00000001.84524.005E0000.00000004.mdmp, 00000000-00000848.00000002.84619.005E0000.00000004.mdmp\")\n Found reference to API \"4581624,5012,3024,,RtlGetVersion,NTDLL.dll,\"252:07:31.490\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00000848.00000001.84524.005E0000.00000004.mdmp\")\n Found reference to API \"69152,1920,3024,,RtlGetVersion,NTDLL.dll,\"252:06:42.194\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00002040.00000000.81585.00350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 1Ta10aM7.exe]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 4Ut221ym.exe]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 2Dc2225.exe]\n Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: 5sD6MZ0.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$62","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"00003544.00000DD8.675446.00402000.wprm\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00000384.00000000.81924.0110A000.00000004.mdmp\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00003464.00000000.81378.00AEA000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"GetProcessById\" (Source: \"00000000-00000384.00000000.81924.0110A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"4Ut221ym.exe\" tries to directly access volume data \"C:\"\n \"4Ut221ym.exe\" tries to directly access volume data \"Z:\"\n \"iexplore.exe\" tries to directly access volume data \"C:\"\n \"iexplore.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 72E10000\n \"sk2Qt47.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 72E10000\n \"ck0rG18.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 72E10000\n \"rq7SB75.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 72E10000\n \"1Ta10aM7.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 72E10000\n \"AppLaunch.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 72E10000\n \"2Dc2225.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 72E10000\n \"3vO15kf.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 72E10000\n \"4Ut221ym.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 72E10000\n \"iexplore.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 72E10000\n \"iexplore.exe\" loaded module \"%WINDIR%\\System32\\samlib.dll\" at 73C10000\n \"5sD6MZ0.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 72E10000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$63","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"AppLaunch.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$64","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: 4Ut221ym.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"Observed string: \"tasklist.exe\" [Source: 00000000-00000848.00000001.84524.005E0000.00000004.mdmp\n 00000000-00000848.00000002.84619.005E0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; File: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"mouse_event\" (Indicator: \"mouse_event\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current hardware profile (API string)","description":"Found reference to API \"GetCurrentHwProfileA\" (Indicator: \"GetCurrentHwProfile\"; File: \"00004036.00000FC4.489261.00537000.wprm\")\n Found reference to API \"GetCurrentHwProfileA\" (Indicator: \"GetCurrentHwProfile\"; Source: \"00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-159","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"00004036.00000FC4.489261.00537000.wprm\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Found reference to API \"DllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp, 00000000-00000848.00000001.84524.72571000.00000020.mdmp\")\n Found reference to API \"NdrDllGetClassObject\" (Indicator: \"DllGetClassObject\"; Source: \"00000000-00000848.00000000.82599.725B0000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to to enumerates the credentials (API string)","description":"Found reference to API \"CredEnumerateA\" (Indicator: \"CredEnumerate\"; File: \"00004036.00000FC4.489261.00537000.wprm\")\n Found reference to API \"CredEnumerateA\" (Indicator: \"CredEnumerate\"; Source: \"00000000-00002040.00000000.81585.00D5A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":1,"id":"string-81","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"ZIndicates if the text in the edit control should appear as the default password character.\" (Indicator: \"password\"; File: \"00003544.00000DD8.675446.00402000.wprm\")\n Found string \"ZIndicates if the text in the edit control should appear as the default password character.\" (Indicator: \"password\"; Source: \"00000000-00000384.00000000.81924.0110A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"file/memory contains long string with (Indicator: \"[F9]\"; File: \"5sD6MZ0.exe\")\n Found string \"L[f9]\" (Indicator: \"[F9]\"; Source: \"00000000-00000384.00000000.81930.010E1000.00000020.mdmp\")\n Found string \"L[f9]\" (Indicator: \"[F9]\"; Source: \"00000000-00002040.00000000.81585.00D31000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"GetMac\" (Indicator: \"getmac\"; File: \"00003544.00000DD8.675446.00402000.wprm\")\n Found string \"GetMac\" (Indicator: \"getmac\"; Source: \"00000000-00000384.00000000.81924.0110A000.00000004.mdmp\")\n Found string \"PING\" (Indicator: \"ping\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found string \"ping 0, Gen\" (Indicator: \"ping\"; Source: \"00000000-00003464.00000000.81378.00240000.00000004.mdmp, 00000000-00003464.00000001.83300.00240000.00000004.mdmp, 00000000-00003464.00000002.84625.00240000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"System Destruction","name":"Able to permanently delete files from the Recycle Bin","description":"Found string \"SHEmptyRecycleBinW\" (File: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found string \"SHEmptyRecycleBinW\" (Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-922","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: sk2Qt47.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: ck0rG18.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: rq7SB75.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: 4Ut221ym.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$65","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"System Security","name":"Contains ability to bypass UAC using COM object (API string)","description":"Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; File: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"CoGetObject\" (Indicator: \"CoGetObject\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548.002","relevance":1,"id":"string-239","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; File: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"CreateProcessWithLogonW\" (Indicator: \"CreateProcessWithLogon\"; File: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"SHUTDOWN\" (Indicator: \"shutdown\") in Source: 00000000-00000848.00000000.82599.000FC000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeAssignPrimaryTokenPrivilege\" (Indicator: \"SeAssignPrimaryTokenPrivilege\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"SeIncreaseQuotaPrivilege\" (Indicator: \"SeIncreaseQuotaPrivilege\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"00000000-00000848.00000000.82599.000FC000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"$66","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"AppLaunch.exe\" opened \"\\Device\\KsecDD\"\n \"schtasks.exe\" opened \"\\Device\\KsecDD\"\n \"4Ut221ym.exe\" opened \"\\Device\\KsecDD\"\n \"iexplore.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"WEXTRACT_CLEANUP0\"; Value: \"rundll32.exe %WINDIR%\\system32\\advpack.dll,DelNodeRunDLL32 \"%TEMP%\\IXP000.TMP\\\"\")\n \"sk2Qt47.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"WEXTRACT_CLEANUP1\"; Value: \"rundll32.exe %WINDIR%\\system32\\advpack.dll,DelNodeRunDLL32 \"%TEMP%\\IXP001.TMP\\\"\")\n \"ck0rG18.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"WEXTRACT_CLEANUP2\"; Value: \"rundll32.exe %WINDIR%\\system32\\advpack.dll,DelNodeRunDLL32 \"%TEMP%\\IXP002.TMP\\\"\")\n \"rq7SB75.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\"; Key: \"WEXTRACT_CLEANUP3\"; Value: \"rundll32.exe %WINDIR%\\system32\\advpack.dll,DelNodeRunDLL32 \"%TEMP%\\IXP003.TMP\\\"\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"$67","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"\"dinosaur_1_.png\" has type \"Unknown\" and extension \"png\"\n \"firefox_1_.png\" has type \"Unknown\" and extension \"png\"\n \"yt_logo_rgb_light_1_.png\" has type \"Unknown\" and extension \"png\"\n \"edgium_1_.png\" has type \"Unknown\" and extension \"png\"\n \"chrome_1_.png\" has type \"Unknown\" and extension \"png\"\n \"epic-favicon-96x96_1_.png\" has type \"Unknown\" and extension \"png\"\n \"googlelogo_color_74x24dp_1_.png\" has type \"Unknown\" and extension \"png\"\n \"opera_1_.png\" has type \"Unknown\" and extension \"png\"","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"Found string \"DelNodeRunDLL32\" (Source: 853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6, API is part of module: ADVPACK.DLL)\n Found string \"HeapSetInformation\" (Source: 853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6, API is part of module: KERNELBASE.DLL)\n Found string \"DecryptFileA\" (Source: 853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6, API is part of module: ADVAPI32.DLL)\n Found string \"DoInfInstall\" (Source: 853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6, API is part of module: ADVPACK.DLL)\n Found string \"SHBrowseForFolder\" (Source: 853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6, API is part of module: SHELL32.DLL)\n Found string \"SHGetPathFromIDList\" (Source: 853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6, API is part of module: SHELL32.DLL)\n Found string \"Extract\" (Source: 853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6, API is part of module: URLMON.DLL)","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\" was detected as \"Microsoft Visual C++ 8\"\n \"1Ta10aM7.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"sk2Qt47.exe\" was detected as \"Microsoft Visual C++ 8\"\n \"ck0rG18.exe\" was detected as \"Microsoft Visual C++ 8\"\n \"rq7SB75.exe\" was detected as \"Microsoft Visual C++ 8\"\n \"4Ut221ym.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"2Dc2225.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"5sD6MZ0.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"FANBooster131.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"3vO15kf.exe\" was detected as \"Safeguard v1.03 -> Simonzh\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"4Ut221ym.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6\" has section name .rsrc with entropy \"7.982856432445269\"\n \"sk2Qt47.exe\" has section name .rsrc with entropy \"7.979097084701366\"\n \"ck0rG18.exe\" has section name .rsrc with entropy \"7.96256882611597\"\n \"rq7SB75.exe\" has section name .rsrc with entropy \"7.955137692930844\"\n \"5sD6MZ0.exe\" has section name .BSs with entropy \"7.00146184600763\"\n \"3vO15kf.exe\" has section name .text with entropy \"7.047633597935999\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO TLS Handshake Failure\" (SID: 2029340, Rev: 2, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"11/26 Antivirus vendors marked sample as malicious (42% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"FindResourceA@KERNEL32.DLL at 00000000-00004112-30330-35-0025468F\n FindResourceA@KERNEL32.DLL at 00000000-00004112-30330-51-00254FE0\n LoadResource@KERNEL32.DLL at 00000000-00004112-30330-57-00256298\n FindResourceA@KERNEL32.DLL at 00000000-00004112-30330-58-00256517\n FindResourceA@KERNEL32.DLL at 00000000-00004112-30330-71-00252CAA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1005","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"$68","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"$69","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$6a","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"$6b","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE file \"3vO15kf.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.DLL at 00000000-00002040-31486-1195-00D3D113\n GetCommandLineA@KERNEL32.DLL at 00000000-00000384-41559-1195-010ED113\n GetCommandLineA@KERNEL32.DLL at 00000000-00005084-56128-1195-00EAD113","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameA@KERNEL32.DLL at 00000000-00004112-30330-42-0025202A\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00004112-30330-44-00252AAC\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00004112-30330-78-00255C9E\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00002040-31486-655-00D46927\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00000384-41559-655-010F6927\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00005084-56128-655-00EB6927","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\5sD6MZ0.exe\" for deletion\n \"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP000.TMP\\sk2Qt47.exe\" for deletion\n \"sk2Qt47.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP001.TMP\\4Ut221ym.exe\" for deletion\n \"sk2Qt47.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP001.TMP\\ck0rG18.exe\" for deletion\n \"ck0rG18.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP002.TMP\\3vO15kf.exe\" for deletion\n \"ck0rG18.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP002.TMP\\rq7SB75.exe\" for deletion\n \"rq7SB75.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP003.TMP\\2Dc2225.exe\" for deletion\n \"rq7SB75.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\IXP003.TMP\\1Ta10aM7.exe\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$6c","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"1Ta10aM7.exe\" claimed CRC 1872833 while the actual is CRC 1787221\n \"ck0rG18.exe\" claimed CRC 1636289 while the actual is CRC 1146326\n \"rq7SB75.exe\" claimed CRC 1146326 while the actual is CRC 1028967\n \"4Ut221ym.exe\" claimed CRC 1028967 while the actual is CRC 963522\n \"2Dc2225.exe\" claimed CRC 962556 while the actual is CRC 459926\n \"3vO15kf.exe\" claimed CRC 148936 while the actual is CRC 41214","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$6d","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"malicious","category":"Exploit/Shellcode","name":"Writes shellcode to a remote process","description":"$6e","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-38","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"11/26 Antivirus vendors marked sample as malicious (42% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"15/23 Antivirus vendors marked dropped file \"1Ta10aM7.exe\" as malicious (classified as \"Trojan.Agent\" with 65% detection rate)\n 17/26 Antivirus vendors marked dropped file \"2Dc2225.exe\" as malicious (classified as \"TrojanS.F23C58EC\" with 65% detection rate)\n 15/24 Antivirus vendors marked dropped file \"5sD6MZ0.exe\" as malicious (classified as \"Trojan.Agent\" with 62% detection rate)\n 17/23 Antivirus vendors marked dropped file \"3vO15kf.exe\" as malicious (classified as \"Smokeloader.b\" with 73% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"15/23 Antivirus vendors marked spawned process \"1Ta10aM7.exe\" (PID: 2040) as malicious (classified as \"Trojan.Agent\" with 65% detection rate)\n 17/26 Antivirus vendors marked spawned process \"2Dc2225.exe\" (PID: 384) as malicious (classified as \"TrojanS.F23C58EC\" with 65% detection rate)\n 17/23 Antivirus vendors marked spawned process \"3vO15kf.exe\" (PID: 3940) as malicious (classified as \"Smokeloader.b\" with 73% detection rate)\n 15/24 Antivirus vendors marked spawned process \"5sD6MZ0.exe\" (PID: 5084) as malicious (classified as \"Trojan.Agent\" with 62% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"malicious","category":"Installation/Persistence","name":"Schedules a task to be executed at a specific time and date","description":"Process \"schtasks.exe\" with commandline \"schtasks /create /f /RU \"%OSUSER%\" /tr \"%ALLUSERSPROFILE%\\\\OfficeTrackerNMP131\\\\OfficeTrackerNMP131.exe\" /tn \"OfficeTrackerNMP131 HR\" /sc HOURLY /rl HIGHEST\" (UID: 00000000-00004068)\n Process \"schtasks.exe\" with commandline \"schtasks /create /f /RU \"%OSUSER%\" /tr \"%ALLUSERSPROFILE%\\\\OfficeTrackerNMP131\\\\OfficeTrackerNMP131.exe\" /tn \"OfficeTrackerNMP131 LG\" /sc ONLOGON /rl HIGHEST\" (UID: 00000000-00004128)","origin":"Monitored Target","mitre_attack_id":"T1053.005","relevance":8,"id":"target-13","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"malicious","category":"Network Related","name":"Contacts multiple hosts","description":"Contacted 29 (or more) hosts in at least 0 different cls.countries","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"malicious","category":"Network Related","name":"Detected multiple DNS responses with a low TTL","description":"\"accounts.google.com\" with TTL 271\n \"accounts.youtube.com\" with TTL 300\n \"c.pki.goog\" with TTL 216\n \"crl.r2m04.amazontrust.com\" with TTL 60\n \"crl.rootca1.amazontrust.com\" with TTL 60\n \"crl.rootg2.amazontrust.com\" with TTL 60\n \"crt.rootg2.amazontrust.com\" with TTL 60\n \"fonts.googleapis.com\" with TTL 300\n \"fonts.gstatic.com\" with TTL 300\n \"js.hcaptcha.com\" with TTL 300\n \"o.ss2.us\" with TTL 305\n \"ocsp.digicert.cn\" with TTL 269\n \"ocsp.pki.goog\" with TTL 96\n \"ocsp.r2m04.amazontrust.com\" with TTL 60\n \"ocsp.rootca1.amazontrust.com\" with TTL 60\n \"ocsp.rootg2.amazontrust.com\" with TTL 60\n \"s.ss2.us\" with TTL 126\n \"ssl.gstatic.com\" with TTL 300\n \"static-assets-prod.unrealengine.com\" with TTL 300\n \"steamcommunity.com\" with TTL 20\n \"store.steampowered.com\" with TTL 20\n \"twitter.com\" with TTL 12\n \"www.google.com\" with TTL 93\n \"www.youtube.com\" with TTL 300","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":3,"id":"network-35","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 194.49.94.152 on port 50500\n TCP traffic to 194.49.94.152 on port 19053","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$6f","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Schedules a task to be executed at a specific time and date"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Marks file for deletion"},{"detail":"Able to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Detected multiple DNS responses with a low TTL"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 29 domains and 29 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]}],"intel_graph":{"map":{"Domain:accounts.google.com":{"type":"Domain","value":"accounts.google.com"},"Domain:accounts.youtube.com":{"type":"Domain","value":"accounts.youtube.com"},"Domain:c.pki.goog":{"type":"Domain","value":"c.pki.goog"},"Domain:crl.r2m04.amazontrust.com":{"type":"Domain","value":"crl.r2m04.amazontrust.com"},"Domain:crl.rootca1.amazontrust.com":{"type":"Domain","value":"crl.rootca1.amazontrust.com"},"Domain:crl.rootg2.amazontrust.com":{"type":"Domain","value":"crl.rootg2.amazontrust.com"},"Domain:crt.rootg2.amazontrust.com":{"type":"Domain","value":"crt.rootg2.amazontrust.com"},"Domain:fonts.googleapis.com":{"type":"Domain","value":"fonts.googleapis.com"},"Domain:fonts.gstatic.com":{"type":"Domain","value":"fonts.gstatic.com"},"Domain:js.hcaptcha.com":{"type":"Domain","value":"js.hcaptcha.com"},"Domain:o.ss2.us":{"type":"Domain","value":"o.ss2.us"},"Domain:ocsp.digicert.cn":{"type":"Domain","value":"ocsp.digicert.cn"},"Domain:ocsp.pki.goog":{"type":"Domain","value":"ocsp.pki.goog"},"Domain:ocsp.r2m04.amazontrust.com":{"type":"Domain","value":"ocsp.r2m04.amazontrust.com"},"Domain:ocsp.rootca1.amazontrust.com":{"type":"Domain","value":"ocsp.rootca1.amazontrust.com"},"Domain:ocsp.rootg2.amazontrust.com":{"type":"Domain","value":"ocsp.rootg2.amazontrust.com"},"Domain:s.ss2.us":{"type":"Domain","value":"s.ss2.us"},"Domain:ssl.gstatic.com":{"type":"Domain","value":"ssl.gstatic.com"},"Domain:static-assets-prod.unrealengine.com":{"type":"Domain","value":"static-assets-prod.unrealengine.com"},"Domain:static.xx.fbcdn.net":{"type":"Domain","value":"static.xx.fbcdn.net"},"Domain:steamcommunity.com":{"type":"Domain","value":"steamcommunity.com"},"Domain:store.steampowered.com":{"type":"Domain","value":"store.steampowered.com"},"Domain:tracking.epicgames.com":{"type":"Domain","value":"tracking.epicgames.com"},"Domain:twitter.com":{"type":"Domain","value":"twitter.com"},"Domain:www.epicgames.com":{"type":"Domain","value":"www.epicgames.com"},"Domain:www.facebook.com":{"type":"Domain","value":"www.facebook.com"},"Domain:www.google.com":{"type":"Domain","value":"www.google.com"},"Domain:www.paypal.com":{"type":"Domain","value":"www.paypal.com"},"Domain:www.youtube.com":{"type":"Domain","value":"www.youtube.com"},"File:11d9a5028ed804d35ae7f966b6b912600f3ca44208777ab74ecc43a4adaa1c81":{"type":"File","value":"11d9a5028ed804d35ae7f966b6b912600f3ca44208777ab74ecc43a4adaa1c81"},"File:14d507431171f3baeb6b07f433567a233e3b8705902a3f47ffa16f10171a898e":{"type":"File","value":"14d507431171f3baeb6b07f433567a233e3b8705902a3f47ffa16f10171a898e"},"File:15c5c62c752e14602a472b4e6ded31806ad987f363efda9f4f7826b35deb8da5":{"type":"File","value":"15c5c62c752e14602a472b4e6ded31806ad987f363efda9f4f7826b35deb8da5"},"File:25752085056fa19a5bd99801f5da1022f7f54cb92ca05c19fd5b21975bd7ca95":{"type":"File","value":"25752085056fa19a5bd99801f5da1022f7f54cb92ca05c19fd5b21975bd7ca95"},"File:33b7b7ae18f2a71c90061eaa74f38d4497d1cf882d645fe3584cc3b9e3d6551a":{"type":"File","value":"33b7b7ae18f2a71c90061eaa74f38d4497d1cf882d645fe3584cc3b9e3d6551a"},"File:464d023edd8812e0980aaee57b4241cc51021f43a7f904281ecd905ceefdfed0":{"type":"File","value":"464d023edd8812e0980aaee57b4241cc51021f43a7f904281ecd905ceefdfed0"},"File:4a2f5c24ed75965969f6fa1b581bba2190d8535a3baa6a011337e2f12cda4e17":{"type":"File","value":"4a2f5c24ed75965969f6fa1b581bba2190d8535a3baa6a011337e2f12cda4e17"},"File:521b9ca61b59188d42990a32c6bf26fd69ff9de319601ccb1475bcf5085c04a3":{"type":"File","value":"521b9ca61b59188d42990a32c6bf26fd69ff9de319601ccb1475bcf5085c04a3"},"File:5d498122b3b59717924a69dd227a0bd4e3007d454883030c6febf367c5300502":{"type":"File","value":"5d498122b3b59717924a69dd227a0bd4e3007d454883030c6febf367c5300502"},"File:75f369ea89afdff5b6fbb118afccb876e0729965aadafd1104cc2ddd5e55f785":{"type":"File","value":"75f369ea89afdff5b6fbb118afccb876e0729965aadafd1104cc2ddd5e55f785"},"File:78b6c2fb84571ba92ae2fd711801fc8da15f94143e1627cda6ddfebb5c3d463d":{"type":"File","value":"78b6c2fb84571ba92ae2fd711801fc8da15f94143e1627cda6ddfebb5c3d463d"},"File:7b492c0d9bebad18af6fee6ec2728ab9c1b4f798d60c170755a6dc8fb00b5fd2":{"type":"File","value":"7b492c0d9bebad18af6fee6ec2728ab9c1b4f798d60c170755a6dc8fb00b5fd2"},"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6":{"type":"File","value":"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat SmokeLoader"]}},"File:bcfafd55f9b5db9b656cbecd01bf17736dfcf016685c2c7ecf9b52f8c008ed5b":{"type":"File","value":"bcfafd55f9b5db9b656cbecd01bf17736dfcf016685c2c7ecf9b52f8c008ed5b"},"File:cfa7d98ad44c7fb11de5ff07da04f8fd4a3423564de05f87ba5e10bd13a1fe59":{"type":"File","value":"cfa7d98ad44c7fb11de5ff07da04f8fd4a3423564de05f87ba5e10bd13a1fe59"},"File:d8636c5d20bb7fc8d1b1e9be3508b6a2652541a1a1f67bdef84af469ecce4fb3":{"type":"File","value":"d8636c5d20bb7fc8d1b1e9be3508b6a2652541a1a1f67bdef84af469ecce4fb3"},"File:da62240afb1416d4c208393d6b11d3eeafd9830d3ca43f934178a53231803fd0":{"type":"File","value":"da62240afb1416d4c208393d6b11d3eeafd9830d3ca43f934178a53231803fd0"},"File:e48cc9b5b9edd213a0fb10cd355342ea85550096ccadf93431041b0be486b8a4":{"type":"File","value":"e48cc9b5b9edd213a0fb10cd355342ea85550096ccadf93431041b0be486b8a4"},"File:f1d4219782f76d759acb44e418d90771aed8a37b95e97ed834e7ce9ee5e54c72":{"type":"File","value":"f1d4219782f76d759acb44e418d90771aed8a37b95e97ed834e7ce9ee5e54c72"},"Ip:104.18.20.94":{"type":"Ip","value":"104.18.20.94"},"Ip:104.18.21.177":{"type":"Ip","value":"104.18.21.177"},"Ip:104.19.229.21":{"type":"Ip","value":"104.19.229.21"},"Ip:13.226.94.71":{"type":"Ip","value":"13.226.94.71"},"Ip:142.251.108.95":{"type":"Ip","value":"142.251.108.95"},"Ip:142.251.151.4":{"type":"Ip","value":"142.251.151.4"},"Ip:142.251.157.119":{"type":"Ip","value":"142.251.157.119"},"Ip:142.251.163.84":{"type":"Ip","value":"142.251.163.84"},"Ip:142.251.214.35":{"type":"Ip","value":"142.251.214.35"},"Ip:142.251.219.131":{"type":"Ip","value":"142.251.219.131"},"Ip:142.251.219.46":{"type":"Ip","value":"142.251.219.46"},"Ip:142.251.45.3":{"type":"Ip","value":"142.251.45.3"},"Ip:150.171.109.72":{"type":"Ip","value":"150.171.109.72"},"Ip:151.101.1.21":{"type":"Ip","value":"151.101.1.21"},"Ip:155.102.54.134":{"type":"Ip","value":"155.102.54.134"},"Ip:157.240.11.35":{"type":"Ip","value":"157.240.11.35"},"Ip:162.159.140.229":{"type":"Ip","value":"162.159.140.229"},"Ip:162.159.142.9":{"type":"Ip","value":"162.159.142.9"},"Ip:18.164.123.208":{"type":"Ip","value":"18.164.123.208"},"Ip:18.238.45.26":{"type":"Ip","value":"18.238.45.26"},"Ip:18.238.80.31":{"type":"Ip","value":"18.238.80.31"},"Ip:194.49.94.152":{"type":"Ip","value":"194.49.94.152"},"Ip:23.45.138.131":{"type":"Ip","value":"23.45.138.131"},"Ip:23.48.8.218":{"type":"Ip","value":"23.48.8.218"},"Ip:3.221.26.248":{"type":"Ip","value":"3.221.26.248"},"Ip:52.84.24.24":{"type":"Ip","value":"52.84.24.24"},"Ip:57.145.2.128":{"type":"Ip","value":"57.145.2.128"},"Ip:99.84.160.31":{"type":"Ip","value":"99.84.160.31"},"Threat:ada9ac3ecf1aea7a80d89fa364bc17118165a13672a8093fe8ddd6109d5d9133":{"type":"Threat","value":"SmokeLoader","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Url:/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D":{"type":"Url","value":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D"},"Url:/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D":{"type":"Url","value":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D"},"Url:/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D":{"type":"Url","value":"/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D"},"Url:/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D":{"type":"Url","value":"/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D"},"Url:/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D":{"type":"Url","value":"/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D"},"Url:/r/gsr1.crl":{"type":"Url","value":"/r/gsr1.crl"},"Url:/r/r1.crl":{"type":"Url","value":"/r/r1.crl"},"Url:/r/r4.crl":{"type":"Url","value":"/r/r4.crl"},"Url:/r2m04.crl":{"type":"Url","value":"/r2m04.crl"},"Url:/rootca1.crl":{"type":"Url","value":"/rootca1.crl"},"Url:/rootg2.cer":{"type":"Url","value":"/rootg2.cer"},"Url:/rootg2.crl":{"type":"Url","value":"/rootg2.crl"},"Url:/we1/G0k-BqpOX8k.crl":{"type":"Url","value":"/we1/G0k-BqpOX8k.crl"},"Url:/we1/pl4XiTjSDSk.crl":{"type":"Url","value":"/we1/pl4XiTjSDSk.crl"},"Url:/we1/x6Eg-8TSwUw.crl":{"type":"Url","value":"/we1/x6Eg-8TSwUw.crl"},"Url:/we2/yK5nPhtHKQs.crl":{"type":"Url","value":"/we2/yK5nPhtHKQs.crl"},"Url:/wr2/75r4ZyA3vA0.crl":{"type":"Url","value":"/wr2/75r4ZyA3vA0.crl"},"Url:/wr2/9UVbN0w5E6Y.crl":{"type":"Url","value":"/wr2/9UVbN0w5E6Y.crl"},"Url:/wr2/oBFYYahzgVI.crl":{"type":"Url","value":"/wr2/oBFYYahzgVI.crl"},"Url:/wr2/oQ6nyr8F0m0.crl":{"type":"Url","value":"/wr2/oQ6nyr8F0m0.crl"}},"chains":[{"id":"1544834100149482920","root":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["confirmed malicious file","confirmed relationship with a Threat SmokeLoader"]}},{"id":"1544834100145288615","root":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Threat:ada9ac3ecf1aea7a80d89fa364bc17118165a13672a8093fe8ddd6109d5d9133"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","edges":[{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:194.49.94.152"},{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:194.49.94.152"},{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:142.251.163.84"},{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:142.251.45.3"},{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:142.251.219.131"},{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:142.251.219.46"},{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:142.251.157.119"},{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:157.240.11.35"},{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:155.102.54.134"},{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:57.145.2.128"},{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:23.45.138.131"},{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:162.159.140.229"},{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:23.48.8.218"},{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:104.18.20.94"},{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:104.18.21.177"},{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:104.19.229.21"},{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:3.221.26.248"},{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:18.238.80.31"},{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:151.101.1.21"},{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:150.171.109.72"},{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:99.84.160.31"},{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:18.164.123.208"},{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:13.226.94.71"},{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:18.238.45.26"},{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:52.84.24.24"},{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:142.251.151.4"},{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:142.251.108.95"},{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:142.251.214.35"},{"edge_kind":"contacted_ip","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Ip:162.159.142.9"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:accounts.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:accounts.google.com","to_key":"Ip:142.251.163.84"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:accounts.youtube.com"},{"edge_kind":"resolves_to","from_key":"Domain:accounts.youtube.com","to_key":"Ip:142.251.219.46"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:c.pki.goog"},{"edge_kind":"resolves_to","from_key":"Domain:c.pki.goog","to_key":"Ip:142.251.45.3"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:crl.r2m04.amazontrust.com"},{"edge_kind":"resolves_to","from_key":"Domain:crl.r2m04.amazontrust.com","to_key":"Ip:18.238.45.26"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:crl.rootca1.amazontrust.com"},{"edge_kind":"resolves_to","from_key":"Domain:crl.rootca1.amazontrust.com","to_key":"Ip:13.226.94.71"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:crl.rootg2.amazontrust.com"},{"edge_kind":"resolves_to","from_key":"Domain:crl.rootg2.amazontrust.com","to_key":"Ip:99.84.160.31"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:crt.rootg2.amazontrust.com"},{"edge_kind":"resolves_to","from_key":"Domain:crt.rootg2.amazontrust.com","to_key":"Ip:18.238.80.31"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:fonts.googleapis.com"},{"edge_kind":"resolves_to","from_key":"Domain:fonts.googleapis.com","to_key":"Ip:142.251.108.95"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:fonts.gstatic.com"},{"edge_kind":"resolves_to","from_key":"Domain:fonts.gstatic.com","to_key":"Ip:142.251.214.35"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:js.hcaptcha.com"},{"edge_kind":"resolves_to","from_key":"Domain:js.hcaptcha.com","to_key":"Ip:104.19.229.21"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:o.ss2.us"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:ocsp.digicert.cn"},{"edge_kind":"resolves_to","from_key":"Domain:ocsp.digicert.cn","to_key":"Ip:155.102.54.134"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:ocsp.pki.goog"},{"edge_kind":"resolves_to","from_key":"Domain:ocsp.pki.goog","to_key":"Ip:142.251.45.3"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:ocsp.r2m04.amazontrust.com"},{"edge_kind":"resolves_to","from_key":"Domain:ocsp.r2m04.amazontrust.com","to_key":"Ip:52.84.24.24"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:ocsp.rootca1.amazontrust.com"},{"edge_kind":"resolves_to","from_key":"Domain:ocsp.rootca1.amazontrust.com","to_key":"Ip:18.164.123.208"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:ocsp.rootg2.amazontrust.com"},{"edge_kind":"resolves_to","from_key":"Domain:ocsp.rootg2.amazontrust.com","to_key":"Ip:18.164.123.208"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:s.ss2.us"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:ssl.gstatic.com"},{"edge_kind":"resolves_to","from_key":"Domain:ssl.gstatic.com","to_key":"Ip:142.251.219.131"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:static-assets-prod.unrealengine.com"},{"edge_kind":"resolves_to","from_key":"Domain:static-assets-prod.unrealengine.com","to_key":"Ip:104.18.21.177"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:static.xx.fbcdn.net"},{"edge_kind":"resolves_to","from_key":"Domain:static.xx.fbcdn.net","to_key":"Ip:57.145.2.128"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:steamcommunity.com"},{"edge_kind":"resolves_to","from_key":"Domain:steamcommunity.com","to_key":"Ip:23.48.8.218"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:store.steampowered.com"},{"edge_kind":"resolves_to","from_key":"Domain:store.steampowered.com","to_key":"Ip:23.45.138.131"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:tracking.epicgames.com"},{"edge_kind":"resolves_to","from_key":"Domain:tracking.epicgames.com","to_key":"Ip:3.221.26.248"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:twitter.com"},{"edge_kind":"resolves_to","from_key":"Domain:twitter.com","to_key":"Ip:162.159.140.229"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:www.epicgames.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.epicgames.com","to_key":"Ip:104.18.20.94"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:www.facebook.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.facebook.com","to_key":"Ip:157.240.11.35"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:www.google.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.google.com","to_key":"Ip:142.251.157.119"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:www.paypal.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.paypal.com","to_key":"Ip:151.101.1.21"},{"edge_kind":"contacted_domain","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Domain:www.youtube.com"},{"edge_kind":"resolves_to","from_key":"Domain:www.youtube.com","to_key":"Ip:142.251.151.4"},{"edge_kind":"contacted_url","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Url:/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D"},{"edge_kind":"contacted_url","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Url:/r/r1.crl"},{"edge_kind":"contacted_url","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Url:/wr2/oBFYYahzgVI.crl"},{"edge_kind":"contacted_url","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Url:/wr2/75r4ZyA3vA0.crl"},{"edge_kind":"contacted_url","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Url:/wr2/9UVbN0w5E6Y.crl"},{"edge_kind":"contacted_url","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Url:/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D"},{"edge_kind":"contacted_url","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Url:/r/gsr1.crl"},{"edge_kind":"contacted_url","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Url:/r/r4.crl"},{"edge_kind":"contacted_url","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Url:/we1/pl4XiTjSDSk.crl"},{"edge_kind":"contacted_url","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Url:/we1/G0k-BqpOX8k.crl"},{"edge_kind":"contacted_url","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Url:/we1/x6Eg-8TSwUw.crl"},{"edge_kind":"contacted_url","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Url:/rootg2.cer"},{"edge_kind":"contacted_url","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Url:/rootg2.crl"},{"edge_kind":"contacted_url","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Url:/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D"},{"edge_kind":"contacted_url","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Url:/rootca1.crl"},{"edge_kind":"contacted_url","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Url:/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D"},{"edge_kind":"contacted_url","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Url:/r2m04.crl"},{"edge_kind":"contacted_url","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Url:/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D"},{"edge_kind":"contacted_url","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Url:/we2/yK5nPhtHKQs.crl"},{"edge_kind":"contacted_url","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"Url:/wr2/oQ6nyr8F0m0.crl"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","edges":[{"edge_kind":"extracted","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"File:5d498122b3b59717924a69dd227a0bd4e3007d454883030c6febf367c5300502"},{"edge_kind":"extracted","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"File:11d9a5028ed804d35ae7f966b6b912600f3ca44208777ab74ecc43a4adaa1c81"},{"edge_kind":"extracted","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"File:25752085056fa19a5bd99801f5da1022f7f54cb92ca05c19fd5b21975bd7ca95"},{"edge_kind":"extracted","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"File:e48cc9b5b9edd213a0fb10cd355342ea85550096ccadf93431041b0be486b8a4"},{"edge_kind":"extracted","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"File:4a2f5c24ed75965969f6fa1b581bba2190d8535a3baa6a011337e2f12cda4e17"},{"edge_kind":"extracted","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"File:14d507431171f3baeb6b07f433567a233e3b8705902a3f47ffa16f10171a898e"},{"edge_kind":"extracted","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"File:464d023edd8812e0980aaee57b4241cc51021f43a7f904281ecd905ceefdfed0"},{"edge_kind":"extracted","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"File:f1d4219782f76d759acb44e418d90771aed8a37b95e97ed834e7ce9ee5e54c72"},{"edge_kind":"extracted","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"File:cfa7d98ad44c7fb11de5ff07da04f8fd4a3423564de05f87ba5e10bd13a1fe59"},{"edge_kind":"extracted","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"File:cfa7d98ad44c7fb11de5ff07da04f8fd4a3423564de05f87ba5e10bd13a1fe59"},{"edge_kind":"extracted","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"File:cfa7d98ad44c7fb11de5ff07da04f8fd4a3423564de05f87ba5e10bd13a1fe59"},{"edge_kind":"extracted","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"File:33b7b7ae18f2a71c90061eaa74f38d4497d1cf882d645fe3584cc3b9e3d6551a"},{"edge_kind":"extracted","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"File:7b492c0d9bebad18af6fee6ec2728ab9c1b4f798d60c170755a6dc8fb00b5fd2"},{"edge_kind":"extracted","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"File:d8636c5d20bb7fc8d1b1e9be3508b6a2652541a1a1f67bdef84af469ecce4fb3"},{"edge_kind":"extracted","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"File:78b6c2fb84571ba92ae2fd711801fc8da15f94143e1627cda6ddfebb5c3d463d"},{"edge_kind":"extracted","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"File:15c5c62c752e14602a472b4e6ded31806ad987f363efda9f4f7826b35deb8da5"},{"edge_kind":"extracted","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"File:bcfafd55f9b5db9b656cbecd01bf17736dfcf016685c2c7ecf9b52f8c008ed5b"},{"edge_kind":"extracted","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"File:da62240afb1416d4c208393d6b11d3eeafd9830d3ca43f934178a53231803fd0"},{"edge_kind":"extracted","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"File:521b9ca61b59188d42990a32c6bf26fd69ff9de319601ccb1475bcf5085c04a3"},{"edge_kind":"extracted","from_key":"File:853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","to_key":"File:75f369ea89afdff5b6fbb118afccb876e0729965aadafd1104cc2ddd5e55f785"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":22,"spawned_processes_count":22,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":22,"imported_dlls_count":214,"dropped_files_count":0,"extracted_files_count":20,"files_written_count":12,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":4,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":29,"dns_resolutions_count":29,"contacted_urls_count":20,"http_requests_count":20},"behavior_tags":["commodity","risepro","backdoor","smokeloader","credentialharvesting","redlinestealer","criminal","informationstealer","downloader","suspicious"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"sandbox_reports":[{"id":"6a98a0dbd3c0be9b3002bf97","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Heur.Crifi","contacted_countries":["BGR","USA"],"submit_name":"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","analysis_start_time":"2026-09-02T22:19:09+00:00","indicators_count":{"informative":289,"suspicious":68,"malicious":11},"tags":["Multi-Process","Network Traffic","Extracted Files","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"194.49.94.152","port":50500,"protocol":"TCP","country":"Bulgaria","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"address":"194.49.94.152","port":19053,"protocol":"TCP","country":"Bulgaria","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"address":"142.251.163.84","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"address":"142.251.45.3","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"address":"142.251.219.131","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"address":"142.251.219.46","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"address":"142.251.157.119","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"address":"157.240.11.35","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"address":"155.102.54.134","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"address":"57.145.2.128","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"address":"23.45.138.131","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"address":"162.159.140.229","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"address":"23.48.8.218","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"address":"104.18.20.94","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"address":"104.18.21.177","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"address":"104.19.229.21","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"address":"3.221.26.248","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"address":"18.238.80.31","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"address":"151.101.1.21","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"address":"150.171.109.72","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"address":"99.84.160.31","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"address":"18.164.123.208","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"address":"13.226.94.71","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"address":"18.238.45.26","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"address":"52.84.24.24","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"address":"142.251.151.4","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"address":"142.251.108.95","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"address":"142.251.214.35","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"address":"162.159.142.9","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]}],"dns_resolutions":[{"domain":"accounts.google.com","address":"142.251.163.84","ttl":271,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"domain":"accounts.youtube.com","address":"142.251.219.46","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"domain":"c.pki.goog","address":"142.251.45.3","ttl":216,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"domain":"crl.r2m04.amazontrust.com","address":"18.238.45.26","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"domain":"crl.rootca1.amazontrust.com","address":"13.226.94.71","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"domain":"crl.rootg2.amazontrust.com","address":"99.84.160.31","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"domain":"crt.rootg2.amazontrust.com","address":"18.238.80.31","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"domain":"fonts.googleapis.com","address":"142.251.108.95","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"domain":"fonts.gstatic.com","address":"142.251.214.35","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"domain":"js.hcaptcha.com","address":"104.19.229.21","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"domain":"o.ss2.us","ttl":305,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"domain":"ocsp.digicert.cn","address":"155.102.54.134","ttl":269,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"domain":"ocsp.pki.goog","address":"142.251.45.3","ttl":96,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"domain":"ocsp.r2m04.amazontrust.com","address":"52.84.24.24","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"domain":"ocsp.rootca1.amazontrust.com","address":"18.164.123.208","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"domain":"ocsp.rootg2.amazontrust.com","address":"18.164.123.208","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"domain":"s.ss2.us","ttl":126,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"domain":"ssl.gstatic.com","address":"142.251.219.131","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"domain":"static-assets-prod.unrealengine.com","address":"104.18.21.177","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"domain":"static.xx.fbcdn.net","address":"57.145.2.128","ttl":601,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"domain":"steamcommunity.com","address":"23.48.8.218","ttl":20,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"domain":"store.steampowered.com","address":"23.45.138.131","ttl":20,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"domain":"tracking.epicgames.com","address":"3.221.26.248","ttl":2750,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"domain":"twitter.com","address":"162.159.140.229","ttl":12,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"domain":"www.epicgames.com","address":"104.18.20.94","ttl":3600,"country":"-","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"domain":"www.facebook.com","address":"157.240.11.35","ttl":3591,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"domain":"www.google.com","address":"142.251.157.119","ttl":93,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"domain":"www.paypal.com","address":"151.101.1.21","ttl":1446,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"domain":"www.youtube.com","address":"142.251.151.4","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]}],"http_requests":[{"host":"ocsp.pki.goog","host_ip":"142.251.45.3:80","url":"/gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /gsr1/MFEwTzBNMEswSTAJBgUrDgMCGgUABBS3V7W2nAf4FiMTjpDJKg6%2BMgGqMQQUYHtmGkUNl8qJUC99BM00qP%2F8%2FUsCEHe9DWzbNvka6iEPxPBY0w0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"host":"c.pki.goog","host_ip":"142.251.45.3:80","url":"/r/r1.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /r/r1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"host":"c.pki.goog","host_ip":"142.251.45.3:80","url":"/wr2/oBFYYahzgVI.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wr2/oBFYYahzgVI.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"host":"c.pki.goog","host_ip":"142.251.45.3:80","url":"/wr2/75r4ZyA3vA0.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wr2/75r4ZyA3vA0.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"host":"c.pki.goog","host_ip":"142.251.45.3:80","url":"/wr2/9UVbN0w5E6Y.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wr2/9UVbN0w5E6Y.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"host":"ocsp.digicert.cn","host_ip":"155.102.54.134:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTfqhLjKLEJQZPin0KCzkdAQpVYowQUsT7DaQP4v0cB1JgmGggC72NkK8MCEA59dSNcqDdhV39MzSTNbR0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.digicert.cn","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"host":"c.pki.goog","host_ip":"142.251.45.3:80","url":"/r/gsr1.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /r/gsr1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"host":"c.pki.goog","host_ip":"142.251.45.3:80","url":"/r/r4.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /r/r4.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"host":"c.pki.goog","host_ip":"142.251.45.3:80","url":"/we1/pl4XiTjSDSk.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /we1/pl4XiTjSDSk.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"host":"c.pki.goog","host_ip":"142.251.45.3:80","url":"/we1/G0k-BqpOX8k.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /we1/G0k-BqpOX8k.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"host":"c.pki.goog","host_ip":"142.251.45.3:80","url":"/we1/x6Eg-8TSwUw.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /we1/x6Eg-8TSwUw.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"host":"crt.rootg2.amazontrust.com","host_ip":"18.238.80.31:80","url":"/rootg2.cer","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /rootg2.cer HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crt.rootg2.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"host":"crl.rootg2.amazontrust.com","host_ip":"99.84.160.31:80","url":"/rootg2.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /rootg2.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.rootg2.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"host":"ocsp.rootca1.amazontrust.com","host_ip":"18.164.123.208:80","url":"/MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBRPWaOUU8%2B5VZ5%2Fa9jFTaU9pkK3FAQUhBjMhTTsvAyUlC4IWZzHshBOCggCEwdzEk8qlS4%2B0YpYvbhdG8DOXyc%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.rootca1.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"host":"crl.rootca1.amazontrust.com","host_ip":"13.226.94.71:80","url":"/rootca1.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /rootca1.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.rootca1.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"host":"ocsp.rootg2.amazontrust.com","host_ip":"18.164.123.208:80","url":"/MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFQwUjBQME4wTDAJBgUrDgMCGgUABBSIfaREXmfqfJR3TkMYnD7O5MhzEgQUnF8A36oB1zArOIiiuG1KnPIRkYMCEwZ%2FlEoqJ83z%2BsKuKwH5CO65xMY%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.rootg2.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"host":"crl.r2m04.amazontrust.com","host_ip":"18.238.45.26:80","url":"/r2m04.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /r2m04.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: crl.r2m04.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"host":"ocsp.r2m04.amazontrust.com","host_ip":"52.84.24.24:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBTihuFvpmFDw5hOcIp918Jm5B3CQgQUH1KSYVaCVH%2BBZtgdPQqqMlyH3QgCEA3N2p7AWhpIo7uTRZjDirs%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.r2m04.amazontrust.com","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"host":"c.pki.goog","host_ip":"142.251.45.3:80","url":"/we2/yK5nPhtHKQs.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /we2/yK5nPhtHKQs.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"host":"c.pki.goog","host_ip":"142.251.45.3:80","url":"/wr2/oQ6nyr8F0m0.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wr2/oQ6nyr8F0m0.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}],"processes":[{"pid":4372,"ppid":0,"name":"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe","command_line":"","sha256":"853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6","normalized_path":"C:\\853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6.exe","uid":"00000000-00004372","icon":"$70"},{"pid":3464,"ppid":4372,"name":"sk2Qt47.exe","command_line":"","sha256":"33b7b7ae18f2a71c90061eaa74f38d4497d1cf882d645fe3584cc3b9e3d6551a","normalized_path":"%TEMP%\\IXP000.TMP\\sk2Qt47.exe","parent_uid":"00000000-00004372","uid":"00000000-00003464"},{"pid":4112,"ppid":3464,"name":"ck0rG18.exe","command_line":"","sha256":"25752085056fa19a5bd99801f5da1022f7f54cb92ca05c19fd5b21975bd7ca95","normalized_path":"%TEMP%\\IXP001.TMP\\ck0rG18.exe","parent_uid":"00000000-00003464","uid":"00000000-00004112"},{"pid":3480,"ppid":4112,"name":"rq7SB75.exe","command_line":"","sha256":"4a2f5c24ed75965969f6fa1b581bba2190d8535a3baa6a011337e2f12cda4e17","normalized_path":"%TEMP%\\IXP002.TMP\\rq7SB75.exe","parent_uid":"00000000-00004112","uid":"00000000-00003480"},{"pid":2040,"ppid":3480,"name":"1Ta10aM7.exe","command_line":"","sha256":"14d507431171f3baeb6b07f433567a233e3b8705902a3f47ffa16f10171a898e","normalized_path":"%TEMP%\\IXP003.TMP\\1Ta10aM7.exe","parent_uid":"00000000-00003480","uid":"00000000-00002040"},{"pid":4036,"ppid":2040,"name":"AppLaunch.exe","command_line":"","sha256":"cfa7d98ad44c7fb11de5ff07da04f8fd4a3423564de05f87ba5e10bd13a1fe59","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe","parent_uid":"00000000-00002040","uid":"00000000-00004036"},{"pid":4068,"ppid":4036,"name":"schtasks.exe","command_line":"schtasks /create /f /RU \"%OSUSER%\" /tr \"%ALLUSERSPROFILE%\\OfficeTrackerNMP131\\OfficeTrackerNMP131.exe\" /tn \"OfficeTrackerNMP131 HR\" /sc HOURLY /rl HIGHEST","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00004036","uid":"00000000-00004068"},{"pid":4128,"ppid":4036,"name":"schtasks.exe","command_line":"schtasks /create /f /RU \"%OSUSER%\" /tr \"%ALLUSERSPROFILE%\\OfficeTrackerNMP131\\OfficeTrackerNMP131.exe\" /tn \"OfficeTrackerNMP131 LG\" /sc ONLOGON /rl HIGHEST","sha256":"15018d0093befabba8b927743191030d1f8c17bb97fdb48c2fc3eab20e2d4b3d","normalized_path":"%WINDIR%\\system32\\schtasks.exe","parent_uid":"00000000-00004036","uid":"00000000-00004128"},{"pid":384,"ppid":3480,"name":"2Dc2225.exe","command_line":"","sha256":"464d023edd8812e0980aaee57b4241cc51021f43a7f904281ecd905ceefdfed0","normalized_path":"%TEMP%\\IXP003.TMP\\2Dc2225.exe","parent_uid":"00000000-00003480","uid":"00000000-00000384"},{"pid":3544,"ppid":384,"name":"AppLaunch.exe","command_line":"","sha256":"cfa7d98ad44c7fb11de5ff07da04f8fd4a3423564de05f87ba5e10bd13a1fe59","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe","parent_uid":"00000000-00000384","uid":"00000000-00003544"},{"pid":3940,"ppid":4112,"name":"3vO15kf.exe","command_line":"","sha256":"e48cc9b5b9edd213a0fb10cd355342ea85550096ccadf93431041b0be486b8a4","normalized_path":"%TEMP%\\IXP002.TMP\\3vO15kf.exe","parent_uid":"00000000-00004112","uid":"00000000-00003940"},{"pid":848,"ppid":3464,"name":"4Ut221ym.exe","command_line":"","sha256":"11d9a5028ed804d35ae7f966b6b912600f3ca44208777ab74ecc43a4adaa1c81","normalized_path":"%TEMP%\\IXP001.TMP\\4Ut221ym.exe","parent_uid":"00000000-00003464","uid":"00000000-00000848"},{"pid":3176,"ppid":848,"name":"iexplore.exe","command_line":"https://accounts.google.com/","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00000848","uid":"00000000-00003176"},{"pid":1868,"ppid":3176,"name":"iexplore.exe","command_line":"SCODEF:3176 CREDAT:275457 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00003176","uid":"00000000-00001868"},{"pid":3252,"ppid":3176,"name":"iexplore.exe","command_line":"SCODEF:3176 CREDAT:209939 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00003176","uid":"00000000-00003252"},{"pid":4104,"ppid":3176,"name":"iexplore.exe","command_line":"SCODEF:3176 CREDAT:734215 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00003176","uid":"00000000-00004104"},{"pid":3744,"ppid":3176,"name":"iexplore.exe","command_line":"SCODEF:3176 CREDAT:603154 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00003176","uid":"00000000-00003744"},{"pid":2148,"ppid":3176,"name":"iexplore.exe","command_line":"SCODEF:3176 CREDAT:996372 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00003176","uid":"00000000-00002148"},{"pid":2900,"ppid":3176,"name":"iexplore.exe","command_line":"SCODEF:3176 CREDAT:2307092 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00003176","uid":"00000000-00002900"},{"pid":4768,"ppid":3176,"name":"iexplore.exe","command_line":"SCODEF:3176 CREDAT:406598 /prefetch:2","sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00000000-00003176","uid":"00000000-00004768"},{"pid":5084,"ppid":4372,"name":"5sD6MZ0.exe","command_line":"","sha256":"5d498122b3b59717924a69dd227a0bd4e3007d454883030c6febf367c5300502","normalized_path":"%TEMP%\\IXP000.TMP\\5sD6MZ0.exe","parent_uid":"00000000-00004372","uid":"00000000-00005084"},{"pid":5108,"ppid":5084,"name":"AppLaunch.exe","command_line":"","sha256":"cfa7d98ad44c7fb11de5ff07da04f8fd4a3423564de05f87ba5e10bd13a1fe59","normalized_path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe","parent_uid":"00000000-00005084","uid":"00000000-00005108"}],"all_imported_dlls":["userenv.dll","mpr.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","api-ms-win-core-synch-l1-2-0.dll","api-ms-win-crt-filesystem-l1-1-0.dll","ole32.dll","logoncli.dll","taskschd.dll","api-ms-win-core-xstate-l2-1-0.dll","System.Configuration.ni.dll","rsaenh.dll","System.Runtime.Serialization.ni.dll","System.ServiceModel.Internals.dll","imm32.dll","psapi.dll","System.IdentityModel.ni.dll","schannel.dll","d3d11.dll","jp2ssv.dll","AcGenral.dll","api-ms-win-downlevel-version-l1-1-0.dll","mscoree.dll","System.Transactions.ni.dll","diasymreader.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","ieproxy.dll","oleaccrc.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-crt-environment-l1-1-0.dll","ntdsapi.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","FWPUCLNT.DLL","d3d10level9.dll","d3d10warp.dll","wininet.dll","rpcss.dll","linkinfo.dll","wkscli.dll","msvcr90.dll","advapi32.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-crt-heap-l1-1-0.dll","secur32.dll","mscoreei.dll","nlssorting.dll","cryptsp.dll","oleacc.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","authz.dll","System.Transactions.dll","nlaapi.dll","ExplorerFrame.dll","msimg32.dll","dhcpcsvc6.dll","dxgi.dll","iertutil.dll","msctf.dll","api-ms-win-core-processthreads-l1-1-1.dll","ntmarta.dll","dhcpcsvc.dll","credssp.dll","msvcr100.dll","sfc.dll","setupapi.dll","api-ms-win-downlevel-user32-l1-1-0.dll","cscapi.dll","WindowsCodecs.dll","jscript9.dll","vm3dum_loader.dll","user32.dll","apphelp.dll","api-ms-win-crt-runtime-l1-1-0.dll","api-ms-win-crt-locale-l1-1-0.dll","ucrtbase_clr0400.dll","msvcp140_clr0400.dll","Wpc.dll","samlib.dll","dwmapi.dll","vcruntime140.dll","shdocvw.dll","winhttp.dll","System.ni.dll","DWrite.dll","PresentationNative_v0400.dll","wsock32.dll","samcli.dll","netapi32.dll","System.Xml.ni.dll","SMDiagnostics.ni.dll","IEShims.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","mscorwks.dll","sqmapi.dll","ntdll.dll","lpk.dll","vcruntime140_clr0400.dll","dnsapi.dll","ncrypt.dll","cryptnet.dll","msimtf.dll","deploy.dll","gdi32.dll","usp10.dll","api-ms-win-crt-utility-l1-1-0.dll","System.ServiceModel.dll","dui70.dll","crypt32.dll","gpedit.dll","activeds.dll","dsuiext.dll","shlwapi.dll","msacm32.dll","urlmon.dll","api-ms-win-crt-stdio-l1-1-0.dll","rpcrt4.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-core-localization-l1-2-0.dll","clbcatq.dll","dssec.dll","PresentationCore.ni.dll","IPHLPAPI.DLL","winnsi.dll","slc.dll","webio.dll","wpfgfx_v0400.dll","wship6.dll","comdlg32.dll","RpcRtRemote.dll","duser.dll","imagehlp.dll","msvcrt.dll","WSHTCPIP.DLL","netprofm.dll","mshtml.dll","URLREDIR.DLL","sechost.dll","sfc_os.dll","mswsock.dll","SensApi.dll","d2d1.dll","vm3dum_10.dll","KernelBase.dll","oleaut32.dll","ucrtbase.dll","advpack.dll","SwDir_1231201.dll","shell32.dll","GdiPlus.dll","System.Windows.Forms.dll","WindowsBase.ni.dll","comctl32.dll","AcLayers.dll","sspicli.dll","winmm.dll","api-ms-win-core-timezone-l1-1-0.dll","api-ms-win-crt-math-l1-1-0.dll","gpapi.dll","ktmw32.dll","VxSSL32.dll","version.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","cryptbase.dll","netutils.dll","ieframe.dll","npmproxy.dll","kernel32.dll","uxtheme.dll","normaliz.dll","msvcp140.dll","propsys.dll","xmllite.dll","bcryptprimitives.dll","vm3dum.dll","profapi.dll","nsi.dll","atl.dll","framedynos.dll","ntshrui.dll","System.Core.ni.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","Wldap32.dll","srvcli.dll","System.Drawing.ni.dll","PresentationFramework.ni.dll","mlang.dll","wevtapi.dll","MSOHEV.DLL","ws2_32.dll","api-ms-win-crt-string-l1-1-0.dll","msasn1.dll","dfscli.dll","ieui.dll","npctrl.dll","UIAutomationCore.dll","devobj.dll","dsrole.dll","clr.dll","System.Windows.Forms.ni.dll","powrprof.dll","cfgmgr32.dll","mscorlib.ni.dll","wintrust.dll","adsldpc.dll","clrjit.dll","bcrypt.dll","rasadhlp.dll","wshqos.dll","sxs.dll","actxprxy.dll","ssv.dll","feclient.dll","fltLib.dll","cabinet.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"5sD6MZ0.exe","sha256":"5d498122b3b59717924a69dd227a0bd4e3007d454883030c6febf367c5300502","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"4Ut221ym.exe","sha256":"11d9a5028ed804d35ae7f966b6b912600f3ca44208777ab74ecc43a4adaa1c81","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"ck0rG18.exe","sha256":"25752085056fa19a5bd99801f5da1022f7f54cb92ca05c19fd5b21975bd7ca95","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"3vO15kf.exe","sha256":"e48cc9b5b9edd213a0fb10cd355342ea85550096ccadf93431041b0be486b8a4","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"rq7SB75.exe","sha256":"4a2f5c24ed75965969f6fa1b581bba2190d8535a3baa6a011337e2f12cda4e17","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"1Ta10aM7.exe","sha256":"14d507431171f3baeb6b07f433567a233e3b8705902a3f47ffa16f10171a898e","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"2Dc2225.exe","sha256":"464d023edd8812e0980aaee57b4241cc51021f43a7f904281ecd905ceefdfed0","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"FANBooster131.lnk","sha256":"f1d4219782f76d759acb44e418d90771aed8a37b95e97ed834e7ce9ee5e54c72","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"OfficeTrackerNMP131.exe","sha256":"cfa7d98ad44c7fb11de5ff07da04f8fd4a3423564de05f87ba5e10bd13a1fe59","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"MaxLoonaFest131.exe","sha256":"cfa7d98ad44c7fb11de5ff07da04f8fd4a3423564de05f87ba5e10bd13a1fe59","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"FANBooster131.exe","sha256":"cfa7d98ad44c7fb11de5ff07da04f8fd4a3423564de05f87ba5e10bd13a1fe59","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"sk2Qt47.exe","sha256":"33b7b7ae18f2a71c90061eaa74f38d4497d1cf882d645fe3584cc3b9e3d6551a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"index-Es9wMzhK_1_.js","sha256":"7b492c0d9bebad18af6fee6ec2728ab9c1b4f798d60c170755a6dc8fb00b5fd2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"7F163155784C838E248DC76B973A1804","sha256":"d8636c5d20bb7fc8d1b1e9be3508b6a2652541a1a1f67bdef84af469ecce4fb3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"FFjvfhElzS5Q3BEGcIBxzIxgo-3469oiGT9DWDYPz6DhfgQe914iiBfD-GevAmvU9KONMKn3YhINqU49pVNahkCkeiF2w9Hlit1WpaE_brMCJG_1_.css","sha256":"78b6c2fb84571ba92ae2fd711801fc8da15f94143e1627cda6ddfebb5c3d463d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"identifier_2_.htm","sha256":"15c5c62c752e14602a472b4e6ded31806ad987f363efda9f4f7826b35deb8da5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"identifier_1_.htm","sha256":"bcfafd55f9b5db9b656cbecd01bf17736dfcf016685c2c7ecf9b52f8c008ed5b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"login_1_.htm","sha256":"da62240afb1416d4c208393d6b11d3eeafd9830d3ca43f934178a53231803fd0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"api_1_.js","sha256":"521b9ca61b59188d42990a32c6bf26fd69ff9de319601ccb1475bcf5085c04a3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"F1EYIM3X.htm","sha256":"75f369ea89afdff5b6fbb118afccb876e0729965aadafd1104cc2ddd5e55f785","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]}],"files_written":[{"path":"%TEMP%\\IXP000.TMP\\TMP4351$.TMP","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"path":"%TEMP%\\IXP000.TMP\\sk2Qt47.exe","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"path":"%TEMP%\\IXP000.TMP\\5sD6MZ0.exe","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"path":"%TEMP%\\IXP001.TMP\\TMP4351$.TMP","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"path":"%TEMP%\\IXP001.TMP\\ck0rG18.exe","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"path":"%TEMP%\\IXP001.TMP\\4Ut221ym.exe","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"path":"%TEMP%\\IXP002.TMP\\TMP4351$.TMP","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"path":"%TEMP%\\IXP002.TMP\\rq7SB75.exe","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"path":"%TEMP%\\IXP002.TMP\\3vO15kf.exe","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"path":"%TEMP%\\IXP003.TMP\\TMP4351$.TMP","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"path":"%TEMP%\\IXP003.TMP\\1Ta10aM7.exe","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"path":"%TEMP%\\IXP003.TMP\\2Dc2225.exe","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\WEXTRACT_CLEANUP0\\WEXTRACT_CLEANUP0","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\WEXTRACT_CLEANUP1\\WEXTRACT_CLEANUP1","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\WEXTRACT_CLEANUP2\\WEXTRACT_CLEANUP2","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUNONCE\\WEXTRACT_CLEANUP3\\WEXTRACT_CLEANUP3","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_c68_IESQMMUTEX_0_519","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\UpdatingNewTabPageData","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3176","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_c68_IE_EarlyTabStart_0x1118_Mutex","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_c68_ConnHashTable<3176>_HashTable_Mutex","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_c68_IESQMMUTEX_0_303","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_c68_IESQMMUTEX_0_331","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_c68_IESQMMUTEX_0_274","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\_!SHMSFTHISTORY!_","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\https://www.epicgames.com/","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\InternetExplorerDOMStoreQuota","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_c68_IESQMMUTEX_0_506","sources":[{"report_type":"sandbox","report_id":"6a98a0dbd3c0be9b3002bf97"}]}]}},"report_ids":{"sandbox_job_ids":["6a98a0dbd3c0be9b3002bf97"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 853fc7d70995… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 853fc7d70995…. Malware family: Trojan.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 13 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 853fc7d70995… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 853fc7d70995…. Malware family: Trojan.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 13 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/853fc7d709954581b64b381f2c51fd68628ebc03dbcad593d04266947f6efdb6"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 853fc7d70995… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 853fc7d70995…. Malware family: Trojan.Generic. Threat score 100/100. 12/27 AV engines flagged this file. 13 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L71","11",{}]]