26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4e0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win64/ShellcodeRunner.AID trojan Sample 8ac3f3a5bd3b… — Score 85/100 — Hybrid Analysis","description":"Malicious verdict for sample 8ac3f3a5bd3b…. Malware family: Win64/ShellcodeRunner.AID trojan. Threat score 85/100. 6/25 AV engines flagged this file. 2 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8ac3f3a5bd3ba1cb8490cf1c69c364a39feac66ee084cf218f3dd11e9be3ac92","keywords":["Malicious","Win64/ShellcodeRunner.AID trojan","malware analysis","sandbox report","threat intelligence","8ac3f3a5bd3ba1cb8490cf1c69c364a39feac66ee084cf218f3dd11e9be3ac92"],"about":{"@type":"SoftwareApplication","name":"CEAP???????????????????.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"8ac3f3a5bd3ba1cb8490cf1c69c364a39feac66ee084cf218f3dd11e9be3ac92","additionalType":"Malicious sample"},"threatScore":85,"malwareFamily":"Win64/ShellcodeRunner.AID trojan","antivirusDetections":{"malicious":6,"total":25},"behavioralIndicators":{"malicious":2,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T41a,Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp")28:T75a,"CEAP.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00011260) "CEAP.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00011260) "CEAP.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00011260)29:T96d,"CEAP.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "CEAP.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "CEAP.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "CEAP.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "CEAP.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "CEAP.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "CEAP.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "CEAP.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "CEAP.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "CEAP.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "CEAP.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "CEAP.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "CEAP.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "CEAP.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "CEAP.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "CEAP.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "CEAP.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "CEAP.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "CEAP.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "CEAP.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "CEAP.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "CEAP.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "CEAP.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "CEAP.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "CEAP.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")2a:T576,"CEAP.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "CEAP.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "CEAP.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "CEAP.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "CEAP.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "CEAP.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "CEAP.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "CEAP.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB") "CEAP.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\D559A586669B08F46A30A133F8A9ED3D038E2EA8"; Key: "BLOB") "CEAP.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\FEE449EE0E3965A5246F000E87FDE2A065FD89D4"; Key: "BLOB") "CEAP.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "CEAP.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS\A377D1B1C0538833035211F4083D00FECC414DAB"; Key: "BLOB") "CEAP.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "CEAP.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "")2b:T5c2,"CEAP.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00011260) "CEAP.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00011260) "CEAP.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00011260) "CEAP.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00011260) "CEAP.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00011260) "CEAP.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00011260) "CEAP.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0.dll (UID: 00000000-00011260) "CEAP.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00011260) "CEAP.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00011260) "CEAP.exe" called "LoadLibrary" with a parameter msvcrt.dll (UID: 00000000-00011260) "CEAP.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00011260) "CEAP.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00011260) "CEAP.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00011260) "CEAP.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00011260) "CEAP.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00011260) "CEAP.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00011260)2c:T7bcc,"CEAP.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetFileInformationByHandle (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetFinalPathNameByHandleW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetModuleHandleW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetStartupInfoA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter HeapFree (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter HeapReAlloc (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter InitOnceBeginInitialize (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter InitOnceComplete (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter Module32FirstW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter Module32NextW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter MultiByteToWideChar (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter RtlCaptureContext (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter RtlLookupFunctionEntry (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter SetHandleInformation (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter SetLastError (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter SetThreadStackGuarantee (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter TlsFree (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter TlsGetValue (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter TlsSetValue (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter DeleteCriticalSection (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter EnterCriticalSection (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter InitializeCriticalSection (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter LeaveCriticalSection (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter RtlUnwindEx (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter __C_specific_handler (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WaitOnAddress (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WakeByAddressAll (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WakeByAddressSingle (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CertAddCertificateContextToStore (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CertEnumCertificatesInStore (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter __getmainargs (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter __initenv (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter __iob_func (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter __lconv_init (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter __set_app_type (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter __setusermatherr (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter _acmdln (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter _amsg_exit (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter _cexit (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter _commode (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter _fmode (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter _fpreset (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter _initterm (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter _onexit (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter abort (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter calloc (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter exit (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter fprintf (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter fwrite (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter memcmp (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter memcpy (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter memmove (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter memset (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter signal (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter strlen (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter strncmp (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter vfprintf (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter NtCancelIoFileEx (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter NtCreateFile (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter NtDeviceIoControlFile (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter NtWriteFile (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter RtlNtStatusToDosError (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter AcceptSecurityContext (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter ApplyControlToken (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter DecryptMessage (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter EncryptMessage (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter FreeCredentialsHandle (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter InitializeSecurityContextW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter QueryContextAttributesW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WSACleanup (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WSAGetLastError (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter connect (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter getpeername (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter getsockname (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter getsockopt (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter ioctlsocket (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter recv (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter send (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter shutdown (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CreateNamedPipeA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetFullPathNameA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter SystemTimeToTzSpecificLocalTime (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter FileTimeToSystemTime (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter FindFirstFileA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter FindNextFileA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CopyFileA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter MoveFileA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter Thread32First (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter Thread32Next (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter Wow64GetThreadContext (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter Wow64SetThreadContext (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter SetNamedPipeHandleState (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter PeekNamedPipe (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WaitNamedPipeA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetComputerNameA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetVersionExA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetOEMCP (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter DeleteProcThreadAttributeList (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter UpdateProcThreadAttribute (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter ProcessIdToSessionId (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter Process32First (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter Process32Next (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetComputerNameExA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter VirtualAllocEx (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter VirtualProtectEx (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CreateRemoteThread (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter OpenThread (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WriteProcessMemory (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter ExitThread (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter DisconnectNamedPipe (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CreatePipe (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetLocalTime (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter HeapDestroy (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter HeapCreate (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter SetEndOfFile (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter SetStdHandle (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter HeapSize (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter LCMapStringW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CompareStringW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetStringTypeW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter OutputDebugStringW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter RemoveDirectoryW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter ReadConsoleW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WideCharToMultiByte (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetStartupInfoW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter ReadProcessMemory (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter EncodePointer (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetSystemTimeAsFileTime (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetCommandLineA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter IsDebuggerPresent (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter IsProcessorFeaturePresent (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter IsValidCodePage (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetCPInfo (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionAndSpinCount (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter UnhandledExceptionFilter (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CryptGenRandom (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter LogonUserA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter LookupAccountSidA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter ImpersonateNamedPipeClient (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter RevertToSelf (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CreateProcessWithTokenW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CreateProcessWithLogonW (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter CreateProcessAsUserA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter ImpersonateLoggedOnUser (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WinHttpQueryDataAvailable (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WinHttpSetOption (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WinHttpSetStatusCallback (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WinHttpAddRequestHeaders (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WinHttpSetCredentials (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WinHttpQueryAuthSchemes (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter WSASocketA (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetLogicalProcessorInformation (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter SetDefaultDllDirectories (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00011260) "CEAP.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00011260)2d:T5ed6,Found reference to API (Indicator: "RegCloseKey"; File: "CEAP???????????????????.exe") Found reference to API (Indicator: "VirtualProtect"; File: "CEAP???????????????????.exe") Found reference to API (Indicator: "GetProcAddress"; File: "CEAP???????????????????.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "CEAP???????????????????.exe") Found reference to API (Indicator: "CopyContext"; File: "CEAP???????????????????.exe") Found reference to API (Indicator: "CertOpenStore"; File: "CEAP???????????????????.exe") Found reference to API (Indicator: "NtWriteFile"; File: "CEAP???????????????????.exe") Found reference to API (Indicator: "DecryptMessage"; File: "CEAP???????????????????.exe") Found reference to API (Indicator: "RtlUserThreadStart"; Source: "00000000-00011260.00000000.184549.07FA0000.00000004.mdmp, 00000000-00011260.00000001.186472.07FA0000.00000004.mdmp, 00000000-00011260.00000002.188390.07FA0000.00000004.mdmp") Found reference to API (Indicator: "IsWow64Process"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "NtQueueApcThread"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "NtMapViewOfSection"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "RtlCreateUserThread"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "SetThreadStackGuarantee"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000000.184549.C3E91000.00000040.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "GetLogicalProcessorInformation"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "CreateFile2"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000000.184549.C3E91000.00000040.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000000.184549.C3E91000.00000040.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000000.184549.C3E91000.00000040.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API (Indicator: "SetThreadDescription"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "AddVectoredExceptionHandler"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "InitOnceBeginInitialize"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "InitOnceComplete"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "Module32FirstW"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "Module32NextW"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "SetHandleInformation"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "CertCloseStore"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "CertDuplicateCertificateChain"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "CertDuplicateCertificateContext"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "CertDuplicateStore"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "CertEnumCertificatesInStore"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "CertFreeCertificateChain"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "CertGetCertificateChain"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "CertOpenStore"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "NtCreateFile"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "NtWriteFile"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "AcceptSecurityContext"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "AcquireCredentialsHandleA"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "ApplyControlToken"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "DecryptMessage"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "DeleteSecurityContext"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "EncryptMessage"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "FreeContextBuffer"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "FreeCredentialsHandle"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "InitializeSecurityContextW"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "QueryContextAttributesW"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "WSAGetLastError"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "WSAIoctl"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "WSASend"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "closesocket"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "getpeername"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "getsockname"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "getsockopt"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "ioctlsocket"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "CopyContext"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp")2e:T8eb,"CEAP.exe" loaded module "KERNEL32" at base 7ffc4bd00000 "CEAP.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffc4a280000 "CEAP.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffc4a280000 "CEAP.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffc4a280000 "CEAP.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 2a107f60000 "CEAP.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffc4a280000 "CEAP.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffc4a280000 "CEAP.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffc4a280000 "CEAP.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffc2d0a0000 "CEAP.exe" loaded module "KERNEL32.DLL" at base 7ffc4bd00000 "CEAP.exe" loaded module "ADVAPI32.DLL" at base 7ffc4be90000 "CEAP.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0.DLL" at base 7ffc4a280000 "CEAP.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ffc4a630000 "CEAP.exe" loaded module "CRYPT32.DLL" at base 7ffc4a840000 "CEAP.exe" loaded module "MSVCRT.DLL" at base 7ffc4c050000 "CEAP.exe" loaded module "NTDLL.DLL" at base 7ffc4cbb0000 "CEAP.exe" loaded module "SECUR32.DLL" at base 7ffc3e360000 "CEAP.exe" loaded module "WS2_32.DLL" at base 7ffc4bc40000 "CEAP.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffc49490000 "CEAP.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffc40c80000 "CEAP.exe" loaded module "RPCRT4.DLL" at base 7ffc4c780000 "CEAP.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffc41fe0000 "CEAP.exe" loaded module "SSPICLI.DLL" at base 7ffc49270000 "CEAP.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 7ffc48e90000 "CEAP.exe" loaded module "%WINDIR%\SYSTEM32\NCRYPTSSLP.DLL" at base 7ffc37a30000 "CEAP.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffc4a630000 "CEAP.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffc48f90000 "CEAP.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 7ffc36bd0000 "CEAP.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffc4a840000 "CEAP.exe" loaded module "WINHTTP.DLL" at base 7ffc42f60000 "CEAP.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ffc2b9900002f:T8fd,"CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\CONTAINERS"; Key: "SECUREAUTOPROXY"; Value: "") "CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\CONTAINERS"; Key: "SENDDNSTOHOST"; Value: "") "CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2024"; Value: "") "CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")30:T43a,"CEAP.exe" trying to touch file "C:\Windows\System32\apphelp.dll" "CEAP.exe" trying to touch file "C:\CEAP.exe" "CEAP.exe" trying to touch file "C:\Windows\System32\ntdll.dll" "CEAP.exe" trying to touch file "C:\Windows\System32\kernel32.dll" "CEAP.exe" trying to touch file "C:\Windows\System32\KernelBase.dll" "CEAP.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "CEAP.exe" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "CEAP.exe" trying to touch file "C:\Windows\System32\secur32.dll" "CEAP.exe" trying to touch file "C:\Windows\System32\sspicli.dll" "CEAP.exe" trying to touch file "C:\Windows\System32\msvcrt.dll" "CEAP.exe" trying to touch file "C:\Windows\System32\sechost.dll" "CEAP.exe" trying to touch file "C:\Windows\System32\rpcrt4.dll" "CEAP.exe" trying to touch file "C:\Windows\System32\advapi32.dll" "CEAP.exe" trying to touch file "C:\Windows\System32\bcryptprimitives.dll" "CEAP.exe" trying to touch file "C:\Windows\System32\ucrtbase.dll" "CEAP.exe" trying to touch file "C:\Windows\System32\crypt32.dll"31:T631,Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00011260-00000C29-1888692023") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00011260-00000C29-1888692081") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00011260-00000C29-1891347952") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00011260-00000C29-1891347983") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00011260-00000C29-1891348074") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00011260-00000C29-1891348074") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00011260-00000C29-1891348074") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00011260-00000C29-1891348138") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00011260-00000C29-1891348138") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00011260-00000C29-1891348261") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00011260-00000C29-1891348291") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp")32:T40b,"1.0.0.0" "202.175.7.146" Potential IP "202.175.7.146" found in string "s://202.175.7.146:10203/" Potential IP "202.175.7.146" found in string "Host: 202.175.7.146" Potential IP "202.175.7.146" found in string "ttps://202.175.7.146:10203/bfs/svg-next/BDC/playdata_square_line/v1.json" "02.175.7.146" "02.175.7.146:10203" Potential IP "202.175.7.146" found in string "ttps://202.175.7.146:10203/" Potential IP "202.175.7.146" found in string "https://202.175.7.146:10203/bfs/svg-next/BDC/playdata_square_line/v1.json" "2.5.29.1" "2.5.29.15" "2.5.29.31" "2.5.29.19" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.17" "2.5.29.32" Potential IP "202.175.7.146" found in string "202.175.7.146,/bfs/svg-next/BDC/playdata_square_line/v1.json" "2.5.29.14" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.4.3" "2.5.29.10" "127.0.0.1:34254/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\collections\btree\navigate.rs" Potential IP "202.175.7.146" found in string "/202.175.7.146:"33:T7398,Pattern match: "https://github.com/dosx-dev/upx-patcher$" Heuristic match: "l`kl.il" Heuristic match: "@z.ae" Heuristic match: "&zq.in" Heuristic match: "&0.cc" Heuristic match: "tg.gh" Heuristic match: "k.{..az" Heuristic match: "leganse.oss-cn-hangzhou.aliyuncs.com" Heuristic match: "get /update.json http/1.1accept: */*host: leganse.oss-cn-hangzhou.aliyuncs.com" Pattern match: "http://code.liveapi.com/accept-encoding" Pattern match: "http://code.liveapi.com/" Pattern match: "https://202.175.7.146:10203/bfs/svg-next/bdc/playdata_square_line/v1.json" Pattern match: "https://leganse.oss-cn-hangzhou.aliyuncs.com/update.json" Pattern match: "https://leganse.oss-cn-hangzhou.aliyuncs.com/update.jsone" Heuristic match: "cn-hangzhou.oss.aliyuncs.com" Heuristic match: "*.oss-cn-hangzhou.aliyuncs.com" Heuristic match: "'*.img-cn-hangzhou-internal.aliyuncs.com" Heuristic match: "&*.oss-cn-hzjbp-a-internal.aliyuncs.com" Heuristic match: "'*.oss-cn-hangzhou-internal.aliyuncs.com" Heuristic match: ",*.oss-cn-hangzhou-diku-internal.aliyuncs.com" Heuristic match: "*.cn-hangzhou.oss.aliyuncs.com" Heuristic match: "*.oss-enet-cm.aliyuncs.com" Heuristic match: "/*.cn-hangzhou.oss-internal-cross.aliyun-inc.com" Heuristic match: "$*.oss-cn-hangzhou-am101.aliyuncs.com" Heuristic match: "*.oss-internal.aliyuncs.com" Heuristic match: "*.oss-accelerate.aliyuncs.com" Heuristic match: "&*.oss-cn-hzjbp-b-internal.aliyuncs.com" Heuristic match: "*.img-cn-hangzhou.aliyuncs.com" Heuristic match: "&*.oss-accelerate-overseas.aliyuncs.com" Heuristic match: "*.oss-cn-hangzhou-zmf.aliyuncs.com" Heuristic match: "*.oss-cn-hangzhou-hsa.aliyuncs.com" Heuristic match: "*.aliyuncs.com" Heuristic match: "*.oss.aliyuncs.com" Heuristic match: "$*.oss-cn-hangzhou-cross.aliyuncs.com" Heuristic match: "%*.vpc100-oss-cn-hangzhou.aliyuncs.com" Heuristic match: "*.oss-cn-hzfinance.aliyuncs.com" Heuristic match: "*.oss-enet.aliyuncs.com" Heuristic match: "'*.cn-hangzhou.oss-internal.aliyuncs.com" Heuristic match: "*.oss-enet-cu.aliyuncs.com" Heuristic match: "*.oss-enet-ct.aliyuncs.com" Heuristic match: "+*.oss-cn-hangzhou-zmf-internal.aliyuncs.com" Heuristic match: "(*.oss-cn-hzfinance-internal.aliyuncs.com" Heuristic match: "&*.cn-hangzhou-finance.oss.aliyuncs.com" Heuristic match: "%*.oss-cn-hzjbp-b-console.aliyuncs.com" Heuristic match: "&*.oss-cache-cn-hangzhou-j.aliyuncs.com" Heuristic match: ",*.oss-cache-cn-hangzhou-j-cross.aliyuncs.com" Heuristic match: "*.oss-enet-cn-east.aliyuncs.com" Heuristic match: "*.cn-hangzhou-vpc.oss.aliyuncs.com" Heuristic match: "*.oss-accesspoint.aliyuncs.com" Heuristic match: ".*.oss-cn-hangzhou.oss-accesspoint.aliyuncs.com" Heuristic match: "7*.oss-cn-hangzhou-internal.oss-accesspoint.aliyuncs.com" Heuristic match: "&*.cn-hangzhou.oss-console.aliyuncs.com" Heuristic match: "!*.s3.oss-cn-hangzhou.aliyuncs.com" Heuristic match: "**.s3.oss-cn-hangzhou-internal.aliyuncs.com" Heuristic match: "*.cn-hangzhou.mgw.aliyuncs.com" Heuristic match: "**.oss.cn-hangzhou.privatelink.aliyuncs.com" Heuristic match: "1*.oss-cn-hangzhou.oss-object-process.aliyuncs.com" Heuristic match: ":*.oss-cn-hangzhou-internal.oss-object-process.aliyuncs.com" Heuristic match: "*.s3.oss-accelerate.aliyuncs.com" Heuristic match: ")*.s3.oss-accelerate-overseas.aliyuncs.com" Heuristic match: "$*.cn-hangzhou-cross.mgw.aliyuncs.com" Pattern match: "http://stream.liveapi.com/" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com1+0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "www.digicert.com1!0" Pattern match: "www.digicert.com1" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicjxz" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Heuristic match: "uncs.com" Heuristic match: "g%cs.com" Heuristic match: "cs.com" Heuristic match: "s.com" Heuristic match: "ncs.com" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Heuristic match: "gzhou.aliyuncs.com" Heuristic match: "?alz.bf" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/cipher-0.4.4/src/stream_core.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/generic-array-0.14.7/src/lib.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/universal-hash-0.5.1/src/lib.rs" Heuristic match: "streamciphererror/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/aes-gcm-0.10.3/src/lib.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/ctr-0.9.2/src/flavors/ctr32.rs" Heuristic match: "src/main.rs" Heuristic match: "jt6ctlcueb72gzkjklp3d0rxni6z5wwwh26ml9rrxe0=:w2qxqtbyrbj/resl:\/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/aes-0.8.4/src/soft/fixslice64.rs" Heuristic match: "alloc\src\raw_vec.rs" Heuristic match: "alloc\src\ffi\c_str.rs" Heuristic match: "alloc\src\fmt.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/base64-0.22.0/src/engine/general_purpose/decode.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/base64-0.22.0/src/engine/general_purpose/decode_suffix.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/base64-0.21.7/src/engine/general_purpose/mod.rs" Heuristic match: "core\src\net\ip_addr.rs" Heuristic match: "core\src\net\display_buffer.rs" Heuristic match: "core\src\net\parser.rs" Heuristic match: "called `option::unwrap()` on a `none` valuecore\src\panicking.rs" Heuristic match: "core\src\fmt\num.rs" Heuristic match: "core\src\fmt\mod.rs" Heuristic match: "core\src\slice\memchr.rs" Heuristic match: "core\src\slice\sort\shared\smallsort.rs" Heuristic match: "core\src\str\pattern.rs" Heuristic match: "core\src\str\mod.rs" Heuristic match: "core\src\unicode\printable.rs" Heuristic match: "core\src\unicode\unicode_data.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/futures-core-0.3.30/src/task/__internal/atomic_waker.rs" Heuristic match: "/rust/deps\gimli-0.29.0\src\read\abbrev.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/indexmap-2.2.5/src/map.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/indexmap-2.2.5/src/map/core.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/indexmap-2.2.5/src/map/core/raw.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/indexmap-2.2.5/src/map/core/entry.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/h2-0.3.24/src/hpack/decoder.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/h2-0.3.24/src/hpack/header.rs" Heuristic match: ":authority:method:scheme:path:protocol:status/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/h2-0.3.24/src/hpack/huffman/mod.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/h2-0.3.24/src/hpack/table.rs" Heuristic match: "assertion failed: !id.is_zero()/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/h2-0.3.24/src/proto/peer.rs" Heuristic match: "invalid initial receive window/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/h2-0.3.24/src/proto/streams/stream.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/h2-0.3.24/src/frame/head.rs" Heuristic match: "not a result of an errorunspecific protocol error detectedunexpected internal error encounteredflow-control protocol violatedsettings ack not received in timely mannerreceived frame when stream half-closedframe with invalid sizerefused stream before proces" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/h2-0.3.24/src/frame/stream_id.rs" Heuristic match: "reservedlocalreservedremotelocalremotehalfclosedlocalhalfclosedremoteawaitingheadersstreamingendstreamscheduledlibraryreset/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/hashbrown-0.14.3/src/raw/mod.rs" Heuristic match: "/rust/deps\hashbrown-0.14.5\src\raw\mod.rs" Heuristic match: "invalidstatuscodeinvalid status code/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/http-0.2.12/src/uri/authority.rs" Heuristic match: "invalid uri characterinvalid schemeinvalid authorityinvalid portinvalid formatscheme missingauthority missingpath missinguri too longempty stringscheme too longhttp/0.9http/2.0http/3.0/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/h" Heuristic match: "switching protocolsprocessingokcreatedacceptednon authoritative informationno contentreset contentpartial contentmulti-statusalready reportedim usedmultiple choicesmoved permanentlyfoundsee othernot modifieduse proxytemporary redirectpermanent redirectbad " Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/httparse-1.8.0/src/lib.rs" Heuristic match: "[internal exception] blocking task ran twice./home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/runtime/blocking/task.rs" Heuristic match: "/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\std\src\io\impls.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/sync/watch.rs" Heuristic match: "chunkedoriginal header value plus ascii is valid/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/hyper-0.14.28/src/headers.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/hyper-0.14.28/src/proto/h2/ping.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/hyper-0.14.28/src/proto/h1/role.rs" Heuristic match: "checked out connection was closedhttps required but uri was not https/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/unicode-normalization-0.1.23/src/decompose.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tinyvec-1.6.0/src/arrayvec.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/idna-0.5.0/src/punycode.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/idna-0.5.0/src/uts46.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/ipnet-2.9.0/src/parser.rs" Heuristic match: "afdpollinfoiostatusblock/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/mio-0.8.11/src/sys/windows/iocp.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/mio-0.8.11/src/sys/windows/selector.rs" Heuristic match: "h/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/mio-0.8.11/src/sys/windows/mod.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/once_cell-1.19.0/src/imp_std.rs" Heuristic match: "panic_abort\src\lib.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/futures-util-0.3.30/src/future/future/map.rs" Heuristic match: "future polled after completion/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-native-tls-0.3.1/src/lib.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/hyper-tls-0.5.0/src/client.rs" Heuristic match: "unable to find any user-specified roots in the final cert chain/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-util-0.7.10/src/util/poll_buf.rs" Heuristic match: "bytes remaining on streamout of bounds accesspolling streamfuture twice/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/futures-util-0.3.30/src/stream/stream/into_future.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/hyper-0.14.28/src/proto/h2/mod.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/hyper-0.14.28/src/client/connect/http.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/futures-channel-0.3.30/src/mpsc/mod.rs" Heuristic match: "assertion failed: slot.is_none()/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/futures-channel-0.3.30/src/oneshot.rs" Heuristic match: "flatten polled after completion/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/futures-util-0.3.30/src/future/future/flatten.rs" Heuristic match: "tryflatten polled after completion/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/futures-util-0.3.30/src/future/try_future/try_flatten.rs" Heuristic match: "assertion failed: default_max_frame_size as usize <= val && val <= max_max_frame_size as usize/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/h2-0.3.24/src/codec/framed_read.rs" Heuristic match: "assertion failed: self.has_capacity()/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/h2-0.3.24/src/codec/framed_write.rs" Heuristic match: "assertion failed: dst.remaining_mut() >= len/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/h2-0.3.24/src/frame/data.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/h2-0.3.24/src/proto/streams/store.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/h2-0.3.24/src/proto/streams/buffer.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/h2-0.3.24/src/proto/streams/streams.rs" Heuristic match: "too_many_internal_resetsassertion failed: self.remote.is_none()/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/h2-0.3.24/src/proto/settings.rs" Heuristic match: "/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\std\src\io\mod.rs" Heuristic match: "assertion failed: buf.len() <= u32::max as usize/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\std\src\sys\pal\windows\io.rs" Heuristic match: "/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\core\src\char\methods.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/http-0.2.12/src/uri/path.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/http-0.2.12/src/uri/scheme.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/http-0.2.12/src/header/value.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/hyper-0.14.28/src/body/body.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/hyper-0.14.28/src/body/to_bytes.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/hyper-0.14.28/src/proto/h1/io.rs" Heuristic match: "invalid chunk size line: missing size digitinvalid chunk size: overflowunexpected eof during chunk size lineinvalid chunk end lfinvalid chunk body crinvalid chunk body lf (invalid chunk size lfinvalid chunk size linear white spaceinvalid chunk extension co" Heuristic match: "connection error/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/hyper-0.14.28/src/proto/h2/client.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/hyper-0.14.28/src/client/conn.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/hyper-0.14.28/src/client/pool.rs" Heuristic match: "http/2 connection in progressalpn upgraded to http/2/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/hyper-0.14.28/src/client/client.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/hyper-0.14.28/src/client/connect/dns.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/hyper-0.14.28/src/common/exec.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/net/tcp/socket.rs" Heuristic match: "assertion failed: self.inner.semaphore.is_idle()/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/sync/mpsc/chan.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/sync/mpsc/list.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/sync/mpsc/unbounded.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/util/sharded_list.rs" Heuristic match: "http2idleinactivestreamidunexpectedframetypepayloadtoobigrejectedreleasecapacitytoobigoverflowedstreamidmalformedheadersmissingurischemeandauthoritypollresetaftersendresponsesendpingwhilependingsendsettingswhilependingpeerdisabledserverpushuserlibraryremot" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/base64-0.21.7/src/encode.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/base64-0.21.7/src/engine/mod.rs" Heuristic match: "poisoned/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/schannel-0.1.23/src/tls_stream.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/hyper-0.14.28/src/common/buf.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/bytes-1.5.0/src/buf/chain.rs" Heuristic match: "pool is disabled/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/hyper-0.14.28/src/common/lazy.rs" Heuristic match: "ready polled after completion/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/futures-util-0.3.30/src/future/ready.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/io/util/write_all.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/hyper-0.14.28/src/service/oneshot.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/futures-util-0.3.30/src/future/select.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/reqwest-0.11.25/src/async_impl/request.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/reqwest-0.11.25/src/async_impl/response.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/reqwest-0.11.25/src/blocking/body.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/reqwest-0.11.25/src/connect.rs" Heuristic match: "base64 is always valid headervalue/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/reqwest-0.11.25/src/util.rs" Heuristic match: "toomanyredirects/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\core\src\ops\function.rs" Heuristic match: "_znzn__zn/rust/deps\rustc-demangle-0.1.24\src\legacy.rs" Heuristic match: "_r__r/rust/deps\rustc-demangle-0.1.24\src\v0.rs" Heuristic match: ".llvm./rust/deps\rustc-demangle-0.1.24\src/lib.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/schannel-0.1.23/src/alpn_list.rs" Heuristic match: "/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\std\src\sync\once.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/socket2-0.5.6/src/sys/windows.rs" Heuristic match: "127.0.0.1:34254/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\collections\btree\navigate.rs" Heuristic match: "/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\core\src\cell\once.rs" Heuristic match: "/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\core\src\time.rs" Heuristic match: "/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\core\src\slice\sort\unstable\heapsort.rs" Heuristic match: "/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\core\src\slice\sort\unstable\quicksort.rs" Heuristic match: "/rust/deps\gimli-0.29.0\src\read\line.rs" Heuristic match: "/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\core\src\num\wrapping.rs" Heuristic match: "/rust/deps\addr2line-0.22.0\src\lib.rs" Heuristic match: "/rust/deps\addr2line-0.22.0\src\function.rs" Heuristic match: "std\src\rt.rs" Heuristic match: "std\src\thread\scoped.rs" Heuristic match: "accesserrorstd\src\thread\local.rs" Heuristic match: "use of std::thread::current() is not possible after the thread's local data has been destroyedstd\src\thread\mod.rs" Heuristic match: "std\src\io\stdio.rs" Heuristic match: ": std\src\io\mod.rs" Heuristic match: "std\src\sys\pal\windows\io.rs" Heuristic match: "fullstd\src\path.rs" Heuristic match: "std\src\sync\once.rs" Heuristic match: "overflow when adding duration to instantstd\src\time.rs" Heuristic match: "std\src\sys_common\wtf8.rs" Heuristic match: "std\src\sys_common\mod.rs" Heuristic match: "std\src\..\..\backtrace\src\symbolize\mod.rs" Heuristic match: "std\src\sys\pal\windows\net.rs" Heuristic match: "std\src\sys\pal\windows\os.rs" Heuristic match: "std\src\sys\pal\windows\stdio.rs" Heuristic match: "std\src\sys\pal\windows\thread.rs" Heuristic match: "std\src\sys\pal\windows\time.rs" Heuristic match: "std\src\sys\path\windows.rs" Heuristic match: "std\src\sys\sync\rwlock\futex.rs" Heuristic match: "std\src\sys\thread_local\key\windows.rs" Heuristic match: "assertion failed: len >= mem::size_of::()std\src\sys_common\net.rs" Heuristic match: ".debug_abbrev.dwo.debug_info.dwo.debug_line.dwo.debug_loc.dwo.debug_loclists.dwo.debug_rnglists.dwo.debug_str.dwo.debug_str_offsets.dwo.debug_types.dwostd\src\..\..\backtrace\src\symbolize\gimli.rs" Heuristic match: "std\src\..\..\backtrace\src\symbolize\gimli\coff.rs" Heuristic match: "/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\std\src\thread\mod.rs" Heuristic match: "cannot access a thread local storage value during or after destruction/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\std\src\thread\local.rs" Heuristic match: "/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\core\src\slice\mod.rs" Heuristic match: "/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\core\src\slice\sort\stable\drift.rs" Heuristic match: "/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\core\src\slice\sort\stable\quicksort.rs" Heuristic match: "/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\collections\vec_deque\mod.rsnonesometryfrominterror/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/io/read_buf.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/util/wake_list.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/util/linked_list.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/io/poll_evented.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/net/tcp/stream.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/runtime/park.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/runtime/context/current.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/runtime/scheduler/current_thread/mod.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/runtime/scheduler/defer.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/runtime/io/driver.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/runtime/io/registration.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/runtime/time/entry.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/runtime/time/wheel/level.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/runtime/time/wheel/mod.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/runtime/time/mod.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/runtime/task/core.rs" Heuristic match: "assertion failed: snapshot.is_complete()/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/runtime/task/harness.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/runtime/task/list.rs" Heuristic match: "assertion failed: next.is_notified()/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/runtime/task/state.rs" Heuristic match: "assertion failed: shared.shutdown_tx.is_some()/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/runtime/blocking/pool.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/runtime/blocking/schedule.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/runtime/handle.rs" Heuristic match: "there is no reactor running, must be called from the context of a tokio 1.x runtimeid/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/sync/notify.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/sync/oneshot.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/time/sleep.rs" Heuristic match: "assertion failed: value <= self.max_value()/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/util/bit.rs" Heuristic match: "rng seed generator is internally corrupt/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/tokio-1.36.0/src/util/rand/rt.rs" Heuristic match: "description() is deprecated; use display/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/bytes-1.5.0/src/buf/buf_mut.rs/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/bytes-1.5.0/src/buf/buf_impl.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/bytes-1.5.0/src/bytes.rs" Heuristic match: "/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\sync.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/once_cell-1.19.0/src/lib.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/unicode-bidi-0.3.15/src/char_data/mod.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/unicode-normalization-0.1.23/src/lookups.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/unicode-normalization-0.1.23/src/perfect_hash.rs" Heuristic match: "a display implementation returned an error unexpectedly/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\string.rs" Heuristic match: "error/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\alloc\src\vec\mod.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/url-2.5.0/src/host.rs" Heuristic match: "ftphttphttpswswssfile:///home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/url-2.5.0/src/parser.rs" Heuristic match: "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/url-2.5.0/src/lib.rs" Heuristic match: "/rustc/f6e511eec7342f59a25f7c0534f1dbea00d01b14\library\core\src\str\pattern.rs"34:T3407,Found URL "http://code.liveapi.com/accept-encoding:" - Source: "00000000-00011260.00000000.184549.07FA0000.00000004.mdmp") Found URL "https://202.175.7.146:10203/bfs/svg-next/bdc/playdata_square_line/v1.json202.175.7.146rpc" - Source: "00000000-00011260.00000000.184549.07FA0000.00000004.mdmp") Found URL "https://leganse.oss-cn-hangzhou.aliyuncs.com/update.json!scfiles(x89x86)\aut5consolesslkeyloitemdrivemhttps://leganse.oss-cn-hangzhou.aliyuncs.com/update.jsoneqkmmplymicrosoft" - Source: "00000000-00011260.00000000.184549.07FA0000.00000004.mdmp") Found URL "https://leganse.oss-cn-hangzhou.aliyuncs.com/update.json0000000000000000000000000000000000000000000000000000000000000lrpc-3c5username=vqkmmplokio-runegotiatenegoextenderhomedrive=c:homepath=\users\vqkmmplmicrosoft" - Source: "00000000-00011260.00000000.184549.07FA0000.00000004.mdmp") Found URL "http://stream.liveapi.com/accept-encoding:" - Source: "00000000-00011260.00000000.184549.07FA0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00011260.00000000.184549.07FA0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl02.5.29.14" - Source: "00000000-00011260.00000000.184549.07FA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00011260.00000000.184549.07FA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm89_o38[7wm[c" - Source: "00000000-00011260.00000000.184549.07FA0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00011260.00000000.184549.07FA0000.00000004.mdmp") Found URL "http://code.liveapi.com/onedrive=c:\users\hapubws\onedriveuserprofile=c:\users\vqkmmplg%cs.comcs.comcs.coms.comncs.comtmp=c:\users\vqkmmpl\appdata\local\tempprocessor_architecture=amd64comspec=c:\windows\system32\cmd.exe*a^h" - Source: "00000000-00011260.00000000.184549.07FA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00011260.00000000.184549.07FA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00011260.00000000.184549.07FA0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00011260.00000000.184549.07FA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00011260.00000000.184549.07FA0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00011260.00000000.184549.07FA0000.00000004.mdmp") Found URL "https://leganse.oss-cn-hangzhou.aliyuncs.com/update.jsonjt6ctlcueb72gzkjklp3d0rxni6z5wwwh26ml9rrxe0=:w2qxqtbyrbj/resl:\/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/aes-0.8.4/src/soft/fixslice64.rscapacity" - Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found URL "http:///home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/reqwest-0.11.25/src/proxy.rsno_proxyno_proxyunknown" - Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found URL "https://should" - Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found URL "https://202.175.7.146:10203/bfs/svg-next/bdc/playdata_square_line/v1.jsonlp.dlllatform" - Source: "00000000-00011260.00000001.186472.07FA0000.00000004.mdmp") Found URL "http://code.liveapi.com/accept-encoding:" - Source: "00000000-00011260.00000001.186472.07FA0000.00000004.mdmp") Found URL "https://leganse.oss-cn-hangzhou.aliyuncs.com/update.json!scfiles(x89x86)\aut5consolesslkeyloitemdrivemhttps://leganse.oss-cn-hangzhou.aliyuncs.com/update.jsoneqkmmplymicrosoft" - Source: "00000000-00011260.00000001.186472.07FA0000.00000004.mdmp") Found URL "https://leganse.oss-cn-hangzhou.aliyuncs.com/update.json0000000000000000000000000000000000000000000000000000000000000lrpc-3c5username=vqkmmplokio-runegotiatenegoextenderhomedrive=c:homepath=\users\vqkmmplmicrosoft" - Source: "00000000-00011260.00000001.186472.07FA0000.00000004.mdmp") Found URL "https://202.175.7.146:10203/bfs/svg-next/bdc/playdata_square_line/v1.jsonmvvi," - Source: "00000000-00011260.00000001.186472.07FA0000.00000004.mdmp") Found URL "http://stream.liveapi.com/accept-encoding:" - Source: "00000000-00011260.00000001.186472.07FA0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00011260.00000001.186472.07FA0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl02.5.29.14" - Source: "00000000-00011260.00000001.186472.07FA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00011260.00000001.186472.07FA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm89_o38[7wm[c" - Source: "00000000-00011260.00000001.186472.07FA0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00011260.00000001.186472.07FA0000.00000004.mdmp") Found URL "http://code.liveapi.com/g%cs.comthrdtaccept-encodinggzip," - Source: "00000000-00011260.00000001.186472.07FA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00011260.00000001.186472.07FA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00011260.00000001.186472.07FA0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00011260.00000001.186472.07FA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00011260.00000001.186472.07FA0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00011260.00000001.186472.07FA0000.00000004.mdmp") Found URL "http://code.liveapi.com/accept-encoding:" - Source: "00000000-00011260.00000002.188390.07FA0000.00000004.mdmp") Found URL "https://202.175.7.146:10203/bfs/svg-next/bdc/playdata_square_line/v1.json.dllttps://202.175.7.146:10203/ws\system32\rsaenh.dll:\windows\system32\rsaenh.dllsystemroot%\system32\rsaenh.dll:\windows\system32\wshqos.dll??\c:\windows\system32\wshqos.dll:\windows\system32\webio.dll:\windows\system32\winnsi.dllecurity=impersonation" - Source: "00000000-00011260.00000002.188390.07FA0000.00000004.mdmp") Found URL "https://leganse.oss-cn-hangzhou.aliyuncs.com/update.json!scfiles(x89x86)\aut5consolesslkeyloitemdrivemhttps://leganse.oss-cn-hangzhou.aliyuncs.com/update.jsoneqkmmplymicrosoft" - Source: "00000000-00011260.00000002.188390.07FA0000.00000004.mdmp") Found URL "https://leganse.oss-cn-hangzhou.aliyuncs.com/update.json0000000000000000000000000000000000000000000000000000000000000lrpc-3c5aeee" - Source: "00000000-00011260.00000002.188390.07FA0000.00000004.mdmp") Found URL "https://202.175.7.146:10203/bfs/svg-next/bdc/playdata_square_line/v1.jsonuser-agentmozilla/5.0" - Source: "00000000-00011260.00000002.188390.07FA0000.00000004.mdmp") Found URL "http://stream.liveapi.com/accept-encoding:" - Source: "00000000-00011260.00000002.188390.07FA0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00011260.00000002.188390.07FA0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl02.5.29.14" - Source: "00000000-00011260.00000002.188390.07FA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00011260.00000002.188390.07FA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htm89_o38[7wm[c" - Source: "00000000-00011260.00000002.188390.07FA0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00011260.00000002.188390.07FA0000.00000004.mdmp") Found URL "http://code.liveapi.com/tmp=c:\users\vqkmmpl\appdata\local\tempprocessor_architecture=amd64comspec=c:\windows\system32\cmd.exe*a^h" - Source: "00000000-00011260.00000002.188390.07FA0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00011260.00000002.188390.07FA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00011260.00000002.188390.07FA0000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00011260.00000002.188390.07FA0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00011260.00000002.188390.07FA0000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00011260.00000002.188390.07FA0000.00000004.mdmp")35:T6ab,Found string "GET /update.json HTTP/1.1accept: */*host: leganse.oss-cn-hangzhou.aliyuncs.com" (Indicator: "HTTP/1.1"; File: "SSL") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "SSL") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00011260.00000000.184549.07FA0000.00000004.mdmp, 00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.07FA0000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.07FA0000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") file/memory contains long string with (Indicator: "HTTP/1.1"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found string "HTTP/1.0HTTP/1.1unexpected request version:" (Indicator: "HTTP/1.1"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found string "HTTP/1.0HTTP/1.1unexpected request version:" (Indicator: "HTTP/1.0"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found string "keep-aliveHTTP/1.1 100 Continue" (Indicator: "HTTP/1.1"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found string "CONNECT HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found string "HTTP/1.1 200HTTP/1.0 200HTTP/1.1 407unsuccessful tunnelproxy authentication required" (Indicator: "HTTP/1.1"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found string "HTTP/1.1 200HTTP/1.0 200HTTP/1.1 407unsuccessful tunnelproxy authentication required" (Indicator: "HTTP/1.0"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp")36:Tbf2,Found string "aes-g" (Indicator: "aes"; File: "CEAP???????????????????.exe") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00011260.00000000.184549.07FA0000.00000004.mdmp, 00000000-00011260.00000001.186472.07FA0000.00000004.mdmp, 00000000-00011260.00000002.188390.07FA0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00011260.00000000.184549.07FA0000.00000004.mdmp, 00000000-00011260.00000001.186472.07FA0000.00000004.mdmp, 00000000-00011260.00000002.188390.07FA0000.00000004.mdmp") Found string "rijndael" (Indicator: "rijndael"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found string "InvalidByteInvalidLengthInvalidLastSymbolInvalidPadding/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/base64-0.22.0/src/engine/mod.rsVec is sized conservativelyM" (Indicator: "base64"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found string "StreamCipherError/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/aes-gcm-0.10.3/src/lib.rs" (Indicator: "aes"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found string "jT6cTLcUEB72GzKjkLp3d0RXNI6z5wwWh26ml9rrXe0=:W2QxQTByRbJ/reSL:\/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/aes-0.8.4/src/soft/fixslice64.rs" (Indicator: "aes"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found string "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/base64-0.22.0/src/engine/general_purpose/decode.rs" (Indicator: "base64"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found string "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/base64-0.22.0/src/engine/general_purpose/decode_suffix.rs" (Indicator: "base64"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found string "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/base64-0.21.7/src/engine/general_purpose/mod.rs" (Indicator: "base64"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") file/memory contains long string with (Indicator: "base64"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found string "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/base64-0.21.7/src/encode.rs" (Indicator: "base64"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found string "/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/base64-0.21.7/src/engine/mod.rs" (Indicator: "base64"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found string "base64 is always valid HeaderValue/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/reqwest-0.11.25/src/util.rs" (Indicator: "base64"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp")37:T469,Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API "Module32FirstW" (Indicator: "Module32First"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found reference to API "Module32NextW" (Indicator: "Module32Next"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp")38:T51c,Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "\drivers\"; Source: "00000000-00011260.00000000.184549.07FA0000.00000004.mdmp, 00000000-00011260.00000000.184549.08150000.00000004.mdmp, 00000000-00011260.00000001.186472.07FA0000.00000004.mdmp, 00000000-00011260.00000002.188390.07FA0000.00000004.mdmp, 00000000-00011260.00000002.188390.08150000.00000004.mdmp") Found string "DriverData=C:\Windows\System32\Drivers\DriverData" (Indicator: "system32\drivers"; Source: "00000000-00011260.00000000.184549.07FA0000.00000004.mdmp, 00000000-00011260.00000000.184549.08150000.00000004.mdmp, 00000000-00011260.00000001.186472.07FA0000.00000004.mdmp, 00000000-00011260.00000002.188390.07FA0000.00000004.mdmp, 00000000-00011260.00000002.188390.08150000.00000004.mdmp") Found string "\Device\HarddiskVolume3\CEAP.exe" (Indicator: "\Device\"; Source: "00000000-00011260.00000000.184549.07FA0000.00000004.mdmp, 00000000-00011260.00000001.186472.07FA0000.00000004.mdmp, 00000000-00011260.00000002.188390.07FA0000.00000004.mdmp") Found string "\Device\Afd\Mio" (Indicator: "\Device\"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp") Found string "Failed to open \Device\Afd\Mio:" (Indicator: "\Device\"; Source: "00000000-00011260.00000000.184549.C3E91000.00000040.mdmp")39:T8da,"CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") "CEAP.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "")3a:Tacb,"CEAP.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "CEAP.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "CEAP.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "CEAP.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "CEAP.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "CEAP.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "CEAP.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "CEAP.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "CEAP.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "CEAP.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "CEAP.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "CEAP.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "CEAP.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "CEAP.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "CEAP.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "CEAP.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "CEAP.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "CEAP.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "CEAP.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "CEAP.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "CEAP.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "CEAP.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES") "CEAP.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS") "CEAP.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS") "CEAP.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE")3b:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAd3d3d3d3d3d3d3d3dwAAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3AHd3d3d3dwB3d3cAAHd3dwAHd3d3d3AAd3d3AAB3d3cAAHd3d3cAAHd3dwAAd3d3AAAHd3dwAAB3d3cAAHd3dwBwAHd3AAcAd3d3AAB3d3cAdwAHcAB3AHd3dwAAd3d3AHdwAAAHdwB3d3cAAHd3dwB3dwAAd3cAd3d3AAB3d3cAd3d3d3d3AHd3dwAAd3d3AHd3d3d3dwB3d3cAAHd3dwB3d3d3d3cAd3d3AAB3d3cAd3d3d3d3AHd3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3d3d3d3d3d3cAAAd3d3d3d3d3d3d3d3dwAAAHd3d3d3d3d3d3d3d3AAAAB3d3d3d3d3d3d3d3cAAAAAd3d3d3d3d3d3d3dwAAAAAHd3d3d3d3d3d3d3AAAAAAAHd3d3d3d3d3d3cAAAAADAAAABwAAAAcAAAAHAAAABwAAAAcAAAAHAAAABwAAAAcBAAQHAYAMBwHAHAcBICQHARBEBwEIhAcBBwQHAQAEBwEABAcBAAQHAQAEBwAAAAcAAAAHAAAABwAAAAcAAAAHAAAADwAAAB8AAAAfAAAAPwAAAP8AAAH/AAAB/4AAA/w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"8ac3f3a5bd3ba1cb8490cf1c69c364a39feac66ee084cf218f3dd11e9be3ac92","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":85,"unified_at_epoch_ms":1790275688598,"unified_at":"2026-09-24T18:48:08.598Z","metadata":{"hashes":{"sha256":"8ac3f3a5bd3ba1cb8490cf1c69c364a39feac66ee084cf218f3dd11e9be3ac92","sha1":"744a3590531665487bf22bc7df7b45663a30790f","md5":"7d6748d103f78d1a8ddab5646c5cb1a3","sha512":"f701291cc808db5f2cfb756d7d4e1ec45ddf416b3ea0e2791bf516d544c51c73091bc11aa13aa605cdef3eb5589de06f7c27723af3d92bbe11b60b57d5e58116","ssdeep":"12288:LkSJ9QlQees48K16BqxLARYHBKbkHZchG3tggAWvg0w7K4OwThyy:wDmqIMGH+kj3CgA50wNthyy","ssdeep_chunks":["12288:LkSJ9Ql","12288:kSJ9QlQ","12288:SJ9QlQe","12288:J9QlQee","12288:9QlQees","12288:QlQees4","12288:lQees48","12288:Qees48K","12288:ees48K1","12288:es48K16","12288:s48K16B","12288:48K16Bq","12288:8K16Bqx","12288:K16BqxL","12288:16BqxLA","12288:6BqxLAR","12288:BqxLARY","12288:qxLARYH","12288:xLARYHB","12288:LARYHBK","12288:ARYHBKb","12288:RYHBKbk","12288:YHBKbkH","12288:HBKbkHZ","12288:BKbkHZc","12288:KbkHZch","12288:bkHZchG","12288:kHZchG3","12288:HZchG3t","12288:ZchG3tg","12288:chG3tgg","12288:hG3tggA","12288:G3tggAW","12288:3tggAWv","12288:tggAWvg","12288:ggAWvg0","12288:gAWvg0w","12288:AWvg0w7","12288:Wvg0w7K","12288:vg0w7K4","12288:g0w7K4O","12288:0w7K4Ow","12288:w7K4OwT","12288:7K4OwTh","12288:K4OwThy","12288:4OwThyy","24576:LkSJ9Ql","24576:kSJ9QlQ","24576:SJ9QlQe","24576:J9QlQee","24576:9QlQees","24576:QlQees4","24576:lQees48","24576:Qees48K","24576:ees48K1","24576:es48K16","24576:s48K16B","24576:48K16Bq","24576:8K16Bqx","24576:K16BqxL","24576:16BqxLA","24576:6BqxLAR","24576:BqxLARY","24576:qxLARYH","24576:xLARYHB","24576:LARYHBK","24576:ARYHBKb","24576:RYHBKbk","24576:YHBKbkH","24576:HBKbkHZ","24576:BKbkHZc","24576:KbkHZch","24576:bkHZchG","24576:kHZchG3","24576:HZchG3t","24576:ZchG3tg","24576:chG3tgg","24576:hG3tggA","24576:G3tggAW","24576:3tggAWv","24576:tggAWvg","24576:ggAWvg0","24576:gAWvg0w","24576:AWvg0w7","24576:Wvg0w7K","24576:vg0w7K4","24576:g0w7K4O","24576:0w7K4Ow","24576:w7K4OwT","24576:7K4OwTh","24576:K4OwThy","24576:4OwThyy","12288:wDmqIMG","12288:DmqIMGH","12288:mqIMGH+","12288:qIMGH+k","12288:IMGH+kj","12288:MGH+kj3","12288:GH+kj3C","12288:H+kj3Cg","12288:+kj3CgA","12288:kj3CgA5","12288:j3CgA50","12288:3CgA50w","12288:CgA50wN","12288:gA50wNt","12288:A50wNth","12288:50wNthy","12288:0wNthyy"],"imphash":"dc9212f457632d496b253cd0ecc2dd4d"},"file_info":{"file_name":"CEAP???????????????????.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":604672,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1733374877000,"last_seen":1733394235000,"last_multi_scan":1733394235000}},"detections":{"summary":{"verdict":"malicious","score":85,"tags":null},"stats":{"av":{"malicious_count":6,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":45},"sandbox_signatures":{"informative_count":102,"suspicious_count":9,"malicious_count":2,"total":113},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/Win32.Cobalt","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Program_Win32_Wacapew_C_ml","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/ShellcodeRunner.AID trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_47.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win64/ShellcodeRunner.AID trojan","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Imports suspicious APIs"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"},{"type":"informative","value":"Contains ability to create a remote thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match - AES encryption"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads information about supported languages"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Decrypted SSL network traffic"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Communicates with HTTPS webserver (GET/POST requests)"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to create a remote thread (API string)","description":"Found reference to API \"RtlCreateUserThread\" (Indicator: \"RtlCreateUserThread\"; Source: \"00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-79","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")\n Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"CEAP???????????????????.exe\")\n Found reference to API \"FreeLibraryWhenCallbackReturns\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000000.184549.C3E91000.00000040.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000000.184549.C3E91000.00000040.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"CDSA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00011260.00000000.184549.07FA0000.00000004.mdmp, 00000000-00011260.00000001.186472.07FA0000.00000004.mdmp, 00000000-00011260.00000002.188390.07FA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".dosx\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; File: \"CEAP???????????????????.exe\")\n Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00011260.00000000.184549.07FA0000.00000004.mdmp, 00000000-00011260.00000001.186472.07FA0000.00000004.mdmp, 00000000-00011260.00000002.188390.07FA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.726439725283899","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Decrypted SSL network traffic\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains ability to encrypt/encode message (API string)\n Matched sigs: Calls an API typically used to decrypt a block of data\n Matched sigs: Calls an API typically used to encrypt a block of data\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Contacts server\n Matched sigs: Spawned process connects to a network\n Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00011260-00000C29-1891147785\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"CEAP.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00011260)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"CEAP.exe\" called \"GetVersionExA\" with parameter 940000000600000002000000f0230000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00011260)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"CEAP.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp\")\n Found reference to API \"RtlNtStatusToDosError\" (Indicator: \"RtlNtStatusToDosError\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"CEAP.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"CEAP.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA UDPv4 invalid checksum\" (SID: 2200075, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$29","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2c","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"118.31.219.225:443\"\n \"202.175.7.146:10203\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"NtDeviceIoControlFile\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")\n Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFile2\" (Indicator: \"CreateFile\"; Source: \"00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp\")\n Found reference to API \"CreateFileMappingA\" (Indicator: \"CreateFile\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")\n Found reference to API \"NtCreateFile\" (Indicator: \"CreateFile\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")\n Found reference to API \"NtCreateFile\" (Indicator: \"NtCreateFile\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"CEAP???????????????????.exe\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000000.184549.C3E91000.00000040.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: CEAP???????????????????.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"SOFTWARE\\Wow6432Node\\Microsoft\\VisualStudio\\11.0\\Setup\\VC\" in Source: 00000000-00011260.00000000.184549.09E70000.00000004.mdmp\n 00000000-00011260.00000001.186472.09E70000.00000004.mdmp\n 00000000-00011260.00000002.188390.09E70000.00000004.mdmp\n \"HTTP_PROXYhttp_proxyHTTPS_PROXYhttps_proxyALL_PROXYall_proxyREQUEST_METHODSoftware\\Microsoft\\Windows\\CurrentVersion\\Internet SettingsProxyEnableProxyServer=\" in Source: 00000000-00011260.00000000.184549.C3E91000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:11260:304:WilStaging_02\"\n \"Local\\SM0:11260:304:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"CEAP???????????????????.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00011260.00000000.184549.07FA0000.00000004.mdmp, 00000000-00011260.00000001.186472.07FA0000.00000004.mdmp, 00000000-00011260.00000002.188390.07FA0000.00000004.mdmp\")\n Found string \"User-Agent: Proxy-Authorization:\" (Indicator: \"user-agent: \"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"!https://github.com/DosX-dev/UPX-Patcher$\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"CEAP.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 4A630000\n \"CEAP.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 498B0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"CEAP.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 4C780000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"CEAP???????????????????.exe\" has an executable section named \".dosx\"\n \"CEAP???????????????????.exe\" has an executable section named \".fish\"\n \"CEAP???????????????????.exe\" has an executable section named \".rsrc\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"CEAP???????????????????.exe\" has an writable section named \".dosx\"\n \"CEAP???????????????????.exe\" has an writable section named \".fish\"\n \"CEAP???????????????????.exe\" has an writable section named \".rsrc\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"CEAP???????????????????.exe\" file has an entrypoint instructions - \"push\trbx,push\trsi,push\trdi,push\trbp,lea\trsi, [rip - 0x876a6],lea\trdi, [rsi - 0xb9025],lea\trax, [rdi + 0x12b16c],push\tqword ptr [rax],mov\tdword ptr [rax], 0x254b0a9a,push\trax,push\trdi,xor\tebx, ebx,xor\tecx, ecx,or\trbp, 0xffffffffffffffff,call\t0x140141740,add\tebx, ebx,je\t0x1401416f6,ret\t,mov\tebx, dword ptr [rsi],sub\trsi, -4,adc\tebx, ebx,mov\tdl, byte ptr [rsi],ret\t,lea\trax, [rdi + rbp],cmp\tecx, 5,mov\tdl, byte ptr [rax],jbe\t0x14014172e,cmp\trbp, -4,ja\t0x14014172e,sub\tecx, 4,mov\tedx, dword ptr [rax],add\trax, 4,sub\tecx, 4,mov\tdword ptr [rdi], edx,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"CEAP???????????????????.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"leganse.oss-cn-hangzhou.aliyuncs.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"CEAP.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"CEAP.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=GlobalSign Organization Validation CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE\" (SHA1: BA:B1:7D:10:E5:EF:BD:A3:65:22:81:6E:73:E8:F1:B9:DB:ED:27:15; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE\" (SHA1: 20:D1:EB:AB:5A:71:58:7B:91:16:E4:C7:44:15:D1:A8:5B:0D:DD:A5; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"CEAP???????????????????.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to queue an Asynchronous Procedure Call (APC) in a remote process (API string)","description":"Found reference to API \"NtQueueApcThread\" (Indicator: \"QueueApcThread\"; Source: \"00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.004","relevance":1,"id":"string-255","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"CEAP.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"\"CEAP.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\CONTAINERS\"; Key: \"\"; Value: \"\")\n \"CEAP.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\DNSCACHE\\PARAMETERS\\DNSCACHE\"; Key: \"\"; Value: \"\")\n \"CEAP.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\LANGUAGEOVERLAY\\OVERLAYPACKAGES\\EN-US\"; Key: \"\"; Value: \"\")\n \"CEAP.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\"; Key: \"\"; Value: \"\")\n \"CEAP.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TIME ZONES\\PACIFIC STANDARD TIME\\DYNAMIC DST\"; Key: \"\"; Value: \"\")\n \"CEAP.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CODEPAGE\"; Key: \"\"; Value: \"\")\n \"CEAP.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\"; Key: \"\"; Value: \"\")\n \"CEAP.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SESSION MANAGER\\SEGMENT HEAP\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"CEAP.exe\" queries basic process information of the \"C:\\CEAP.exe\" (UID: 11260)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$30","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"CEAP.exe\" trying to access non-existent file \"C:\\ncrypt.dll\"\n \"CEAP.exe\" trying to access non-existent file \"C:\\NTASN1.dll\"\n \"CEAP.exe\" trying to access non-existent file \"C:\\bcrypt.dll\"\n \"CEAP.exe\" trying to access non-existent file \"C:\\MSASN1.dll\"\n \"CEAP.exe\" trying to access non-existent file \"C:\\CRYPTBASE.dll\"\n \"CEAP.exe\" trying to access non-existent file \"C:\\WINHTTP.dll\"\n \"CEAP.exe\" trying to access non-existent file \"C:\\webio.dll\"\n \"CEAP.exe\" trying to access non-existent file \"C:\\winnlsres.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"CEAP.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"2a1080516f0\"\n \"lpszHeaders\": \"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Referer: http://code.liveapi.com/Accept-Encoding: gzip,\"\n \"dwHeadersLength\": \"353\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"2890684925124\"\n \"$error\": \"2ee2\"}\n \"CEAP.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"2a107ffa4e0\"\n \"lpszHeaders\": \"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Referer: http://code.liveapi.com/Accept-Encoding: gzip,\"\n \"dwHeadersLength\": \"353\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"2890684925124\"\n \"$error\": \"2ee2\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTPS webserver (GET/POST requests)","description":"Found requests in header \"GET /update.json HTTP/1.1accept: */*host: leganse.oss-cn-hangzhou.aliyuncs.com\"; in File: \"SSL\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-505","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Network Related","name":"Decrypted SSL network traffic","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1573","relevance":3,"id":"string-102","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$32","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$33","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$34","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$35","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /update.json HTTP/1.1accept: */*\n host: leganse.oss-cn-hangzhou.aliyuncs.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 46f5131e766d248db0248a86c494b71c\n Observed JA3 fingerprint: 6a5d235ee78c6aede6a61448b4e9ff1e\n Observed JA3 fingerprint: 65005c9d9ae0f0ebeaf22c210571d482\n Observed JA3 fingerprint: 2b8da9e558fef05fabfa78758281c38c","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://github.com\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://leganse.oss-cn-hangzhou.aliyuncs.com/update.json","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"118.31.219.225\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00011260\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"CEAP.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"CEAP.exe\" called \"GetComputerNameA\" (UID: 00000000-00011260)\n \"CEAP.exe\" called \"GetComputerNameW\" (UID: 00000000-00011260)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"CEAP.exe\" called \"GetUserNameA\" (UID: 00000000-00011260)\n \"CEAP.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$36","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000000.184549.C3E91000.00000040.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp\")\n Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000000.184549.C3E91000.00000040.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"CEAP???????????????????.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")\n Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")\n Found reference to API \"GetFileInformationByHandleEx\" (Indicator: \"GetFileInformationByHandle\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"Urlschemecannot_be_a_baseusernamepasswordhostportqueryfragment\" (Indicator: \"password\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")\n Found string \"has_authority means set_password shouldn't fail\" (Indicator: \"password\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$38","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00011260-00000C29-1888692468\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00011260.00000000.184549.C3E91000.00000040.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00011260.00000000.184549.09E70000.00000004.mdmp, 00000000-00011260.00000001.186472.09E70000.00000004.mdmp, 00000000-00011260.00000002.188390.09E70000.00000004.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; File: \"CEAP???????????????????.exe\")\n Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"CEAP.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$39","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00011260.00000000.184549.07FA0000.00000004.mdmp, 00000000-00011260.00000001.186472.07FA0000.00000004.mdmp, 00000000-00011260.00000002.188390.07FA0000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\"CEAP.exe\" queried SystemProcessInformation at 00000000-00011260-00000C13-1887939184 [PID: 11260]\n \"CEAP.exe\" queried SystemProcessInformation at 00000000-00011260-00000C13-1887945690 [PID: 11260]\n \"CEAP.exe\" queried SystemProcessInformation at 00000000-00011260-00000C13-1888290200 [PID: 11260]\n \"CEAP.exe\" queried SystemProcessInformation at 00000000-00011260-00000C13-1888297234 [PID: 11260]\n \"CEAP.exe\" queried SystemProcessInformation at 00000000-00011260-00000C13-1890444771 [PID: 11260]\n \"CEAP.exe\" queried SystemProcessInformation at 00000000-00011260-00000C13-1890451175 [PID: 11260]\n \"CEAP.exe\" queried SystemProcessInformation at 00000000-00011260-00000C13-1891207646 [PID: 11260]\n \"CEAP.exe\" queried SystemProcessInformation at 00000000-00011260-00000C13-1891214171 [PID: 11260]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"section contains high entropy","description":"\"CEAP???????????????????.exe\" has section name .fish with entropy \"7.90743698825\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"w@2.rqp\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 118.31.219.225 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\".skype.com1&0\" (Indicator: \"skype.com\")\n \"community-stage.skype.com1\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"received unexpected shutdown ping\" (Indicator: \"ping\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")\n Found string \"/home/airevan/.cargo/registry/src/mirrors.ustc.edu.cn-4affec411d11e50f/h2-0.3.24/src/proto/ping_pong.rsinvalid ping frame\" (Indicator: \"ping\"; Source: \"00000000-00011260.00000000.184549.C3E91000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"CEAP???????????????????.exe\" has an entrypoint in section \".fish\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n VirtualProtect\n GetProcAddress\n LoadLibraryA\n bind","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 202.175.7.146 on port 10203","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":46,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Decrypted SSL traffic"],"sandbox_reports":[{"id":"67517f3bc029eaaab10ff1fd","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":85,"contacted_countries":["CHN","MAC"],"submit_name":"CEAP???????????????????.exe","analysis_start_time":"2024-12-05T10:23:55+00:00","indicators_count":{"informative":102,"suspicious":21,"malicious":2},"tags":["Network Traffic","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"118.31.219.225","port":443,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"address":"202.175.7.146","port":10203,"protocol":"TCP","country":"Macau","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]}],"dns_resolutions":[{"domain":"leganse.oss-cn-hangzhou.aliyuncs.com","address":"118.31.219.225","ttl":60,"country":"China","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Zhejiang Alibaba Cloud Computing Ltd. (浙江阿里巴巴云计算有限公司)","registrar_name_servers":"NS3.ALIYUN.COM","registrar_creation_date":"2012-04-01T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}],"processes":[{"pid":11260,"ppid":0,"name":"CEAP.exe","command_line":"","sha256":"8ac3f3a5bd3ba1cb8490cf1c69c364a39feac66ee084cf218f3dd11e9be3ac92","normalized_path":"C:\\CEAP.exe","uid":"00000000-00011260","icon":"$3b"}],"all_imported_dlls":["nsi.dll","msasn1.dll","sechost.dll","cryptsp.dll","mswsock.dll","ncrypt.dll","bcrypt.dll","webio.dll","crypt32.dll","advapi32.dll","win32u.dll","oleaut32.dll","ncryptsslp.dll","cryptbase.dll","winhttp.dll","winnsi.dll","OnDemandConnRouteHelper.dll","KernelBase.dll","ucrtbase.dll","ws2_32.dll","secur32.dll","gdi32full.dll","msvcp_win.dll","rasadhlp.dll","gpapi.dll","ntdll.dll","apphelp.dll","msvcrt.dll","rpcrt4.dll","VxSSL64.dll","fltLib.dll","user32.dll","sspicli.dll","dnsapi.dll","FWPUCLNT.DLL","ntasn1.dll","rsaenh.dll","cryptnet.dll","kernel32.dll","gdi32.dll","ole32.dll","combase.dll","imm32.dll","schannel.dll","bcryptprimitives.dll","IPHLPAPI.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:11260:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]},{"name":"Local\\SM0:11260:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"67517f3bc029eaaab10ff1fd"}]}]}},"report_ids":{"sandbox_job_ids":["67517f3bc029eaaab10ff1fd"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win64/ShellcodeRunner.AID trojan Sample 8ac3f3a5bd3b… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8ac3f3a5bd3b…. Malware family: Win64/ShellcodeRunner.AID trojan. Threat score 85/100. 6/25 AV engines flagged this file. 2 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8ac3f3a5bd3ba1cb8490cf1c69c364a39feac66ee084cf218f3dd11e9be3ac92"}],["$","meta","4",{"property":"og:title","content":"Malicious Win64/ShellcodeRunner.AID trojan Sample 8ac3f3a5bd3b… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8ac3f3a5bd3b…. Malware family: Win64/ShellcodeRunner.AID trojan. Threat score 85/100. 6/25 AV engines flagged this file. 2 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8ac3f3a5bd3ba1cb8490cf1c69c364a39feac66ee084cf218f3dd11e9be3ac92"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win64/ShellcodeRunner.AID trojan Sample 8ac3f3a5bd3b… — Score 85/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8ac3f3a5bd3b…. Malware family: Win64/ShellcodeRunner.AID trojan. Threat score 85/100. 6/25 AV engines flagged this file. 2 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L3c","11",{}]]