26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 55:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4bb,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Genie.8DN.Generic Sample 8b94f5fa94f3… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 8b94f5fa94f3…. Malware family: Genie.8DN.Generic. Threat score 100/100. 15/28 AV engines flagged this file. 13 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8b94f5fa94f35e5ba47ce260b009b34401c5c54042d7b7252c8c7d13bf8d9f05","keywords":["Malicious","Genie.8DN.Generic","malware analysis","sandbox report","threat intelligence","8b94f5fa94f35e5ba47ce260b009b34401c5c54042d7b7252c8c7d13bf8d9f05"],"about":{"@type":"SoftwareApplication","name":"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe","applicationCategory":["peexe","executable"],"identifier":"8b94f5fa94f35e5ba47ce260b009b34401c5c54042d7b7252c8c7d13bf8d9f05","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Genie.8DN.Generic","antivirusDetections":{"malicious":15,"total":28},"behavioralIndicators":{"malicious":13,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T95f,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00000312.00000000.277562.06100000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00000312.00000000.277562.06100000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00000312.00000000.277562.06100000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00000312.00000000.277562.06100000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp")28:Ta09,"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\TREATAS") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCSERVER32") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCSERVER32") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCHANDLER32") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCHANDLER32") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCHANDLER") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCHANDLER") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPX") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\APPX") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODELUNLOCK") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APPMODELUNLOCK") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "OPEN"; Path: "HKCU\APPID\SECURITEINFO.COM.WIN32.SALATSTEALER-A.44876682.EXE") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\APPID\SECURITEINFO.COM.WIN32.SALATSTEALER-A.44876682.EXE") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\APPCOMPAT") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\APPCOMPAT")29:Tc54,"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" queried SystemProcessInformation at 00000000-00007752-00000C15-3248569673 [PID: 7752] "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" queried SystemProcessInformation at 00000000-00007752-00000C15-3248578392 [PID: 7752] "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" queried SystemProcessInformation at 00000000-00007752-00000C15-3248801403 [PID: 7752] "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" queried SystemProcessInformation at 00000000-00007752-00000C15-3248810633 [PID: 7752] "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" queried SystemProcessInformation at 00000000-00007752-00000C15-3249395417 [PID: 7752] "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" queried SystemProcessInformation at 00000000-00007752-00000C15-3249404747 [PID: 7752] "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" queried SystemProcessInformation at 00000000-00007752-00000C15-3249686458 [PID: 7752] "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" queried SystemProcessInformation at 00000000-00007752-00000C15-3249695251 [PID: 7752] "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" queried SystemProcessInformation at 00000000-00007752-00000C15-3249923736 [PID: 7752] "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" queried SystemProcessInformation at 00000000-00007752-00000C15-3249932551 [PID: 7752] "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" queried SystemProcessInformation at 00000000-00007752-00000C15-3250112723 [PID: 7752] "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" queried SystemProcessInformation at 00000000-00007752-00000C15-3250123924 [PID: 7752] "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" queried SystemProcessInformation at 00000000-00007752-00000C15-3251572099 [PID: 7752] "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" queried SystemProcessInformation at 00000000-00007752-00000C15-3251580051 [PID: 7752] "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" queried SystemProcessInformation at 00000000-00007752-00000C15-3253327681 [PID: 7752] "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" queried SystemProcessInformation at 00000000-00007752-00000C15-3253335948 [PID: 7752] "WmiPrvSE.exe" queried SystemProcessInformation at 00000000-00005128-00000C15-3254713821 [PID: 5128] "WmiPrvSE.exe" queried SystemProcessInformation at 00000000-00005128-00000C15-3254721267 [PID: 5128] "WmiPrvSE.exe" queried SystemProcessInformation at 00000000-00005128-00000C15-3254901785 [PID: 5128] "WmiPrvSE.exe" queried SystemProcessInformation at 00000000-00005128-00000C15-3254909057 [PID: 5128] "WmiPrvSE.exe" queried SystemProcessInformation at 00000000-00005128-00000C15-3255495513 [PID: 5128] "WmiPrvSE.exe" queried SystemProcessInformation at 00000000-00005128-00000C15-3255503058 [PID: 5128] "WmiPrvSE.exe" queried SystemProcessInformation at 00000000-00005128-00000C15-3255779284 [PID: 5128] "WmiPrvSE.exe" queried SystemProcessInformation at 00000000-00005128-00000C15-3255787772 [PID: 5128] "WmiPrvSE.exe" queried SystemProcessInformation at 00000000-00005128-00000C15-3256015710 [PID: 5128]2a:T7355,Contains base64 string in header "json" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "edge" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "consumer" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "like" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "0Sec" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Mode" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Site" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "nonePriority" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Encoding" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "gzip" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Dest" in header "GET /mouse-gesture/config.json HTTP/2Host: edge-consumer-static.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: nonePriority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "5EAxlKa5ZzBahtzgxEuNigzgslrK" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "clients2" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "like" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "0Sec" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "Mode" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "Site" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "Language" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "9Sec" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "Mesh" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "Arch" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "iSec" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "Edge" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "3800" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "stableAccept" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "Encoding" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "gzip" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "16299Sec" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "Dest" in header "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2Host: clients2.googleusercontent.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Sec-Mesh-Client-Arch: x86_64Sec-Mesh-Client-Os: WindowsPriority: u=4, iSec-Mesh-Client-Edge-Version: 145.0.3800.58Sec-Mesh-Client-Edge-Channel: stableAccept-Encoding: gzip, deflate, br, zstdSec-Mesh-Client-Os-Version: 10.0.16299Sec-Mesh-Client-Webview: 0Sec-Fetch-Dest: empty" Contains base64 string in header "priority" in header "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "edgeassetservice" in header "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "like" in header "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "0Sec" in header "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Mode" in header "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "corsEdge" in header "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Site" in header "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Language" in header "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Encoding" in header "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "gzip" in header "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Dest" in header "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2Host: edgeassetservice.azureedge.netUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Sec-Fetch-Mode: no-corsEdge-Asset-Group: ArbitrationServiceSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "POST" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "like" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "0Content" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Type" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Mode" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Site" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Language" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Encoding" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "gzip" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty" Contains base64 string in header "Dest" in header "POST /chromewebstore/v1.1/items/verify HTTP/2Host: www.googleapis.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0Content-Type: application/jsonSec-Fetch-Mode: no-corsSec-Fetch-Storage-Access: activeSec-Fetch-Site: noneAccept-Language: en-US,en;q=0.9Priority: u=4, iAccept-Encoding: gzip, deflate, br, zstdSec-Fetch-Dest: empty"2b:Tce1e,Found XOR loop in file "OSPPSVC.EXE" at offset 1241; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 40590; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 117871; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 119850; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 129765; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 288110; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 289931; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 344627; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 372362; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 405970; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 448427; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 453975; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 496339; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 527194; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 579359; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 597174; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 607543; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 644832; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 658267; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 749798; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 760292; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 769640; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 787213; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 913779; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1020444; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1147521; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1150234; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1183661; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1193265; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1229575; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1230227; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1243565; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1282952; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1340728; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1473803; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1495218; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1547809; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1553432; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1612326; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1783011; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1826726; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1888246; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1926528; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 1979304; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2049238; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2129746; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2165241; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2204833; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2311887; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2374277; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2386672; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2410877; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2412379; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2613778; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2661215; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2669461; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2677120; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2715601; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2742302; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2743066; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2784580; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 2832594; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 3055551; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 3131015; code bytes = 30d0 Found XOR loop in file "OSPPSVC.EXE" at offset 30826; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 102607; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 108106; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 114722; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 188173; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 201497; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 240058; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 261180; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 315490; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 320415; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 593731; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 611902; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 616804; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 696131; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 697924; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 728171; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 769784; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 864989; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 935662; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 948988; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 967077; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 968460; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1080167; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1082305; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1084485; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1167573; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1181213; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1181252; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1183409; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1216685; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1261637; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1416530; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1531517; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1537742; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1602003; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1648915; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1788797; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1839823; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1847539; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1865346; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1911414; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1923948; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1930250; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 1945868; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2022592; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2070997; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2101482; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2161392; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2192780; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2299953; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2326146; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2328968; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2346117; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2352350; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2368798; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2416603; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2501959; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2608945; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2696766; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2782908; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2803715; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2878253; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2891457; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2901123; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2984021; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 3059191; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 3174572; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 3235897; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 3239961; code bytes = 33c1 Found XOR loop in file "OSPPSVC.EXE" at offset 2581088; code bytes = 30040e Found XOR loop in file "OSPPSVC.EXE" at offset 3856; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 245521; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 269554; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 290479; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 344988; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 348974; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 474321; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 479022; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 536751; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 568068; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 578011; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 620013; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 658266; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 736063; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 825369; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 867215; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 970319; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 986630; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 988837; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 1008638; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 1008875; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 1030199; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 1038898; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 1278487; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 1383705; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 1435416; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 1444345; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 1488192; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 1577296; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 1593457; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 1698180; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 1936480; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2031594; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2053631; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2082541; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2108653; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2261135; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2264183; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2343489; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2528377; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2552337; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2617713; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 2887118; code bytes = 8030 Found XOR loop in file "OSPPSVC.EXE" at offset 3024457; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 1241; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 40590; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 117871; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 119850; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 129765; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 288110; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 289931; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 344627; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 372362; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 405970; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 448427; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 453975; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 496339; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 527194; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 579359; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 597174; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 607543; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 644832; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 658267; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 749798; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 760292; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 769640; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 787213; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 913779; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 1020444; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 1147521; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 1150234; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 1183661; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 1193265; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 1229575; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 1230227; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 1243565; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 1282952; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 1340728; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 1473803; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 1495218; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 1547809; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 1553432; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 1612326; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 1783011; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 1826726; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 1888246; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 1926528; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 1979304; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 2049238; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 2129746; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 2165241; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 2204833; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 2311887; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 2374277; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 2386672; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 2410877; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 2412379; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 2613778; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 2661215; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 2669461; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 2677120; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 2715601; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 2742302; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 2743066; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 2784580; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 2832594; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 3055551; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 3131015; code bytes = 30d0 Found XOR loop in file "WmiPrvSE.exe" at offset 30826; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 102607; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 108106; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 114722; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 188173; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 201497; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 240058; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 261180; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 315490; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 320415; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 593731; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 611902; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 616804; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 696131; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 697924; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 728171; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 769784; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 864989; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 935662; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 948988; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 967077; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 968460; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 1080167; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 1082305; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 1084485; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 1167573; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 1181213; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 1181252; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 1183409; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 1216685; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 1261637; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 1416530; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 1531517; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 1537742; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 1602003; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 1648915; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 1788797; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 1839823; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 1847539; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 1865346; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 1911414; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 1923948; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 1930250; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 1945868; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 2022592; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 2070997; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 2101482; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 2161392; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 2192780; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 2299953; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 2326146; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 2328968; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 2346117; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 2352350; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 2368798; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 2416603; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 2501959; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 2608945; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 2696766; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 2782908; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 2803715; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 2878253; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 2891457; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 2901123; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 2984021; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 3059191; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 3174572; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 3235897; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 3239961; code bytes = 33c1 Found XOR loop in file "WmiPrvSE.exe" at offset 2581088; code bytes = 30040e Found XOR loop in file "WmiPrvSE.exe" at offset 3856; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 245521; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 269554; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 290479; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 344988; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 348974; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 474321; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 479022; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 536751; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 568068; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 578011; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 620013; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 658266; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 736063; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 825369; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 867215; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 970319; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 986630; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 988837; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 1008638; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 1008875; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 1030199; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 1038898; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 1278487; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 1383705; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 1435416; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 1444345; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 1488192; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 1577296; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 1593457; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 1698180; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 1936480; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 2031594; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 2053631; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 2082541; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 2108653; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 2261135; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 2264183; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 2343489; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 2528377; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 2552337; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 2617713; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 2887118; code bytes = 8030 Found XOR loop in file "WmiPrvSE.exe" at offset 3024457; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1241; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 40590; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 117871; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 119850; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 129765; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 288110; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 289931; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 344627; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 372362; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 405970; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 448427; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 453975; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 496339; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 527194; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 579359; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 597174; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 607543; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 644832; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 658267; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 749798; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 760292; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 769640; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 787213; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 913779; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1020444; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1147521; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1150234; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1183661; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1193265; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1229575; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1230227; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1243565; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1282952; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1340728; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1473803; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1495218; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1547809; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1553432; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1612326; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1783011; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1826726; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1888246; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1926528; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 1979304; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2049238; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2129746; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2165241; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2204833; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2311887; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2374277; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2386672; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2410877; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2412379; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2613778; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2661215; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2669461; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2677120; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2715601; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2742302; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2743066; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2784580; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 2832594; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 3055551; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 3131015; code bytes = 30d0 Found XOR loop in file "csrss.exe" at offset 30826; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 102607; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 108106; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 114722; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 188173; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 201497; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 240058; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 261180; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 315490; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 320415; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 593731; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 611902; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 616804; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 696131; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 697924; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 728171; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 769784; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 864989; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 935662; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 948988; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 967077; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 968460; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1080167; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1082305; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1084485; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1167573; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1181213; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1181252; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1183409; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1216685; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1261637; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1416530; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1531517; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1537742; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1602003; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1648915; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1788797; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1839823; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1847539; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1865346; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1911414; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1923948; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1930250; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 1945868; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2022592; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2070997; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2101482; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2161392; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2192780; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2299953; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2326146; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2328968; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2346117; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2352350; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2368798; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2416603; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2501959; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2608945; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2696766; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2782908; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2803715; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2878253; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2891457; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2901123; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2984021; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 3059191; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 3174572; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 3235897; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 3239961; code bytes = 33c1 Found XOR loop in file "csrss.exe" at offset 2581088; code bytes = 30040e Found XOR loop in file "csrss.exe" at offset 3856; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 245521; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 269554; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 290479; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 344988; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 348974; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 474321; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 479022; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 536751; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 568068; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 578011; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 620013; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 658266; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 736063; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 825369; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 867215; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 970319; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 986630; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 988837; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1008638; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1008875; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1030199; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1038898; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1278487; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1383705; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1435416; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1444345; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1488192; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1577296; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1593457; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1698180; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 1936480; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 2031594; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 2053631; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 2082541; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 2108653; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 2261135; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 2264183; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 2343489; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 2528377; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 2552337; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 2617713; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 2887118; code bytes = 8030 Found XOR loop in file "csrss.exe" at offset 3024457; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1241; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 40590; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 117871; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 119850; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 129765; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 288110; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 289931; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 344627; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 372362; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 405970; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 448427; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 453975; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 496339; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 527194; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 579359; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 597174; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 607543; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 644832; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 658267; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 749798; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 760292; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 769640; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 787213; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 913779; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1020444; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1147521; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1150234; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1183661; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1193265; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1229575; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1230227; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1243565; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1282952; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1340728; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1473803; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1495218; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1547809; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1553432; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1612326; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1783011; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1826726; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1888246; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1926528; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1979304; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2049238; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2129746; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2165241; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2204833; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2311887; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2374277; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2386672; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2410877; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2412379; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2613778; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2661215; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2669461; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2677120; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2715601; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2742302; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2743066; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2784580; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2832594; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3055551; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3131015; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 30826; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 102607; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 108106; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 114722; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 188173; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 201497; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 240058; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 261180; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 315490; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 320415; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 593731; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 611902; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 616804; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 696131; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 697924; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 728171; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 769784; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 864989; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 935662; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 948988; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 967077; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 968460; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1080167; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1082305; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1084485; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1167573; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1181213; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1181252; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1183409; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1216685; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1261637; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1416530; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1531517; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1537742; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1602003; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1648915; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1788797; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1839823; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1847539; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1865346; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1911414; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1923948; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1930250; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1945868; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2022592; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2070997; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2101482; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2161392; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2192780; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2299953; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2326146; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2328968; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2346117; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2352350; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2368798; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2416603; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2501959; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2608945; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2696766; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2782908; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2803715; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2878253; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2891457; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2901123; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2984021; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3059191; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3174572; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3235897; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3239961; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2581088; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 3856; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 245521; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 269554; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 290479; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 344988; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 348974; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 474321; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 479022; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 536751; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 568068; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 578011; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 620013; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 658266; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 736063; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 825369; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 867215; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 970319; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 986630; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 988837; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1008638; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1008875; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1030199; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1038898; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1278487; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1383705; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1435416; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1444345; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1488192; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1577296; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1593457; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1698180; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1936480; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2031594; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2053631; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2082541; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2108653; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2261135; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2264183; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2343489; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2528377; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2552337; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2617713; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2887118; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3024457; code bytes = 80302c:T4de,Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00007752-00000C2C-3249784965") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00007752-00000C2C-3249785001") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00007752-00000C2C-3249785055") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000312.00000000.277562.06000000.00000004.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00000312.00000000.277562.06100000.00000004.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00000312.00000000.277562.06100000.00000004.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp")2d:T328e,"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000000000000000000000000000000000000000000000000000000000001800000088e4b1ce64e0257778e88801687d077678f08801a018b9723cf283bdfeffffff94ef8801227db77238ef88010000f37330f088013b7db772e0df257708000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000c0ef88010000000008000000000000000000000000000000000000000000000000000000b0e4b1ce0000000000f0880169921577ffffffff34000000c0ef880108000000000000000000f37330f0880127941577c8ef88010b0000000000000018f08801 (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000717600000000d0b16d7618e9e5265cbc6d7630569503000000003dbc6d765f21ca6074ab7576fddb7476df21ca600000000060db747652616d7620cd95034886857600000000932eca602ceae526c7966e760000000020cd950348868576011800002ceae526d2966e76d82f6776501e6e76f9966e7600000000d82f67760ce095039ceae52620cd950320e9e5260000000078f0e52600a875760f04ab30fefffffffddb7476b7026e762483857630569503e05a75766dfa6d7664ece52630569503ccfa6d76734964003056950378eee526000000005037677600000000000000000000010000000000e8a9950300000000000000040000000100000000 (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000717600000000d0b16d7630e6e5265cbc6d76f0549503000000003dbc6d76772eca6074ab7576fddb7476f72eca600000000060db747652616d7670b795034886857600000000ab2bca6044e7e526c7966e760000000070b79503488685760118000044e7e526d2966e76d82f6776501e6e76f9966e7600000000d82f67764cdc9503b4e7e52670b7950338e6e5260000000090ede52600a875760f04ab30fefffffffddb7476b7026e7624838576f0549503e05a75766dfa6d767ce9e526f0549503ccfa6d76d069f500f054950390ebe526000000005037677600000000300000000000000076000000888c940300000000390000000000000000000000 (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000717600000000d0b16d76e8ebe5265cbc6d76c0529503000000003dbc6d76af23ca6074ab7576fddb74762f24ca600000000060db747652616d76d09396034886857600000000e321ca60fcece526c7966e7600000000d09396034886857601180000fcece526d2966e76d82f6776501e6e76f9966e7600000000d82f67760cdd95036cede526d0939603f0ebe5260000000048f3e52600a875760f04ab30fefffffffddb7476b7026e7624838576c0529503e05a75766dfa6d7634efe526c0529503ccfa6d76d069f500c052950348f1e5260000000050376776000000003000000000000000690000001016970300000000980000000000000000000000 (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000717600000000d0b16d7638ebe5265cbc6d76a0549503000000003dbc6d767f23ca6074ab7576fddb7476ff23ca600000000060db747652616d76602b94034886857600000000b320ca604cece526c7966e7600000000602b940348868576011800004cece526d2966e76d82f6776501e6e76f9966e7600000000d82f67764ce19503bcece526602b940340ebe5260000000098f2e52600a875760f04ab30fefffffffddb7476b7026e7624838576a0549503e05a75766dfa6d7684eee526a0549503ccfa6d76d069f500a054950398f0e5260000000050376776000000003000000000000000610000001016970300000000270000000000000000000000 (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007752) "WmiPrvSE.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000018000000cf5157dd64e0257758eb5c00687d077658f35c00a018b9729b59b1affeffffff74f25c00227db77218f25c000000f37310f35c003b7db772e0df257708000000000000000000000000000000000000000000000000000000000000000100000000000000ffffffffffffffff3400000000000000a0f25c000000000008000000000000000000000000000000000000000000000000000000375257dd00000000e0f25c0069921577ffffffff34000000a0f25c0008000000000000000000f37310f35c0027941577a8f25c000b00000000000000f8f25c00 (UID: 00000000-00005128) "WmiPrvSE.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005128) "WmiPrvSE.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005128) "WmiPrvSE.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000717600000000d0b16d7698ec9d265cbc6d76807e6a03000000003dbc6d76adb3468374ab7576fddb74762db246830000000060db747652616d76c8bf6a03488685760000000061b54683aced9d26c7966e7600000000c8bf6a034886857601180000aced9d26d2966e76d82f6776501e6e76f9966e7600000000d82f6776acda6a031cee9d26c8bf6a03a0ec9d2600000000f8f39d2600a875767d935fd3fefffffffddb7476b7026e7624838576807e6a03e05a75766dfa6d76e4ef9d26807e6a03ccfa6d7673496400807e6a03f8f19d2600000000503767760000000000000000000001000000000000966a0300000000000000040000000100000000 (UID: 00000000-00005128) "WmiPrvSE.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000717600000000d0b16d76a0ec9d265cbc6d76707a6a03000000003dbc6d7695b3468374ab7576fddb747615b246830000000060db747652616d76e0716903488685760000000069b54683b4ed9d26c7966e7600000000e07169034886857601180000b4ed9d26d2966e76d82f6776501e6e76f9966e7600000000d82f67762cd76a0324ee9d26e0716903a8ec9d260000000000f49d2600a875767d935fd3fefffffffddb7476b7026e7624838576707a6a03e05a75766dfa6d76ecef9d26707a6a03ccfa6d76d069f500707a6a0300f29d2600000000503767760000000030000000000000005a000000f8ef6a0300000000130000000000000000000000 (UID: 00000000-00005128) "WmiPrvSE.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000717600000000d0b16d7608e79d265cbc6d76987a6a03000000003dbc6d763db8468374ab7576fddb7476bdb846830000000060db747652616d76a0bd68034886857600000000f1bb46831ce89d26c7966e7600000000a0bd680348868576011800001ce89d26d2966e76d82f6776501e6e76f9966e7600000000d82f6776ecdb6a038ce89d26a0bd680310e79d260000000068ee9d2600a875767d935fd3fefffffffddb7476b7026e7624838576987a6a03e05a75766dfa6d7654ea9d26987a6a03ccfa6d76d069f500987a6a0368ec9d26000000005037677600000000300000000000000014000000c0ee6b0300000000634e00000000000000000000 (UID: 00000000-00005128) "WmiPrvSE.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000717600000000d0b16d7600ec9d265cbc6d76c07a6a03000000003dbc6d7635b3468374ab7576fddb7476b5b346830000000060db747652616d76a0186903488685760000000089b6468314ed9d26c7966e7600000000a0186903488685760118000014ed9d26d2966e76d82f6776501e6e76f9966e7600000000d82f6776ecda6a0384ed9d26a018690308ec9d260000000060f39d2600a875767d935fd3fefffffffddb7476b7026e7624838576c07a6a03e05a75766dfa6d764cef9d26c07a6a03ccfa6d76d069f500c07a6a0360f19d2600000000503767760000000030000000000000006d000000f8ef6a0300000000251600000000000000000000 (UID: 00000000-00005128) "WmiPrvSE.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00005128) "WmiPrvSE.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000038e89f25dce79f25226e81740000b803000000002d6e81743699eba32d000000ecb7907460e89f2500005f000896670378b166030f00000080000000a0e79f2500005f0024e89f2570c88274120ff3f2feffffff2d000000d0cc9f7427000000f4e79f25856a83741c23887434e89f25f85f837408000000bb698274b2698274de96eba32d000000ecb7907427000000d0cc9f7408e89f252d000000d0cc9f742700000038e89f25856a83741c23887480e89f257e8a9e74ee8c9e74738a9e74ae4947c22d000000ecb7907427000000d0cc9f74c46bb803586bb803ae4947c248e89f25fc52dc7434e99f25e0849e7416500293feffffff738a9e74 (UID: 00000000-00005128) "WmiPrvSE.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff0000000000e19f2538cf5177e43766036ce19f250100000098376603e437660398376603040000000400000000e01f77001000006ce19f250100000098376603cd9751779c975177e6f5fa61b50f16779837660300005177000000008c0180510000000080ee1c770100000000000000f8e21f77000000000400000080a9e67348401e77f8e21f7770e19f2580e89c76382c6c0380e89c766ce19f250000000080e89c76fce0f9fefeffffff000000000000000000000000130000001401a626020000000200000018000000e800a6261401a62600000000d35045bff0e39f25ddf31377e4e19f2500000000e800a62618000000f8f31377e800a626 (UID: 00000000-00005128) "WmiPrvSE.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000690300000000e7c09a7600000000270000004c606903640000002282529c68e09f253587a17600000000f018690346000000e8b1690368e09f254c87a1765c87a1765282529c48606903f0186903787b6a03787b6a030000000048606903e8b169030ce49f2500000000c86cb8035c87a176c884a176f0186903787b6a030000000000000000807fa176b485a17600000000f0e09f250000000000000000607b6a03f018690348606903c86cb80330e59f250ce59f2581f1e175c86cb80348ea9f25d8e69f25c5f1e175000066039834517728ca6a0338e59f251c60de750400000030e59f255c839176c06cb803a090e575000000000400000004000000 (UID: 00000000-00005128) "WmiPrvSE.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000b4e09f253300000008e29f2540ca6a038ce29f2514e29f25889a9f76f0b46803854aa976aa9a9f762e80529c00000000c86cb8038ce29f25134194f868e09f258564a37600000000000000000000b1affeffffff90e19f25222ac273f000000000000000000000000000000068e19f2554e19f255243547743000000a8e19f2573f61377eae19f255c00000000000000fdfeff7f82f8137700000000c4e0f9fefeffffff000000000000000000000000130000004c01a6260200000002000000180000002001a6264c01a62600000000d35045bff0e39f25ddf31377e4e19f25000000002001a62618000000f8f313772001a626 (UID: 00000000-00005128)2e:Tea5,"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")2f:Tf80,"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" queries volume information of "C:\Program Files (x86)" at 00000000-00007752-00000C17-3253357489 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local" at 00000000-00007752-00000C17-3253358071 "WmiPrvSE.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Packages" at 00000000-00005128-00000C17-3259188709 "WmiPrvSE.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data" at 00000000-00005128-00000C17-3259243820 "WmiPrvSE.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" at 00000000-00005128-00000C17-3259246437 "WmiPrvSE.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Last Browser" at 00000000-00005128-00000C17-3259479877 "WmiPrvSE.exe" queries volume information of "C:\Program Files (x86)\Adobe\WmiPrvSE.exe" at 00000000-00005128-00000C17-3259480790 "WmiPrvSE.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Ad Blocking" at 00000000-00005128-00000C17-3264961948 "WmiPrvSE.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent" at 00000000-00005128-00000C17-3264962728 "WmiPrvSE.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Autofill" at 00000000-00005128-00000C17-3264963410 "WmiPrvSE.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\BrowserMetrics" at 00000000-00005128-00000C17-3264964091 "WmiPrvSE.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation" at 00000000-00005128-00000C17-3264965517 "WmiPrvSE.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Crashpad" at 00000000-00005128-00000C17-3264966264 "WmiPrvSE.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default" at 00000000-00005128-00000C17-3264967713 "WmiPrvSE.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" at 00000000-00005128-00000C17-3265029248 "WmiPrvSE.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" at 00000000-00005128-00000C17-3265462662 "WmiPrvSE.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" at 00000000-00005128-00000C17-3265572469 "WmiPrvSE.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\DeferredBrowserMetrics" at 00000000-00005128-00000C17-3265878776 "WmiPrvSE.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Domain Actions" at 00000000-00005128-00000C17-3265879757 "WmiPrvSE.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\EADPData Component" at 00000000-00005128-00000C17-3265880699 "WmiPrvSE.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config" at 00000000-00005128-00000C17-3265881390 "WmiPrvSE.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Data Protection Lists" at 00000000-00005128-00000C17-3265883183 "WmiPrvSE.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Notifications" at 00000000-00005128-00000C17-3265883897 "WmiPrvSE.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Shopping" at 00000000-00005128-00000C17-3265884574 "WmiPrvSE.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Edge Travel" at 00000000-00005128-00000C17-326588524030:T1f4e,"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00007752) "WmiPrvSE.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005128) "WmiPrvSE.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005128) "WmiPrvSE.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005128) "WmiPrvSE.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005128) "WmiPrvSE.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00005128) "WmiPrvSE.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00005128) "WmiPrvSE.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005128) "WmiPrvSE.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00005128) "WmiPrvSE.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005128) "WmiPrvSE.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00005128) "WmiPrvSE.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005128) "WmiPrvSE.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005128) "WmiPrvSE.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005128) "WmiPrvSE.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00005128) "WmiPrvSE.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00005128) "WmiPrvSE.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00005128) "WmiPrvSE.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005128) "WmiPrvSE.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00005128) "WmiPrvSE.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00005128) "WmiPrvSE.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00005128) "WmiPrvSE.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00005128) "WmiPrvSE.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00005128) "WmiPrvSE.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00005128) "WmiPrvSE.exe" called "LoadLibrary" with a parameter Crypt32.dll (UID: 00000000-00005128) "WmiPrvSE.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00005128) "WmiPrvSE.exe" called "LoadLibrary" with a parameter rstrtmgr.dll (UID: 00000000-00005128) "WmiPrvSE.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004840) "WmiPrvSE.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004840) "WmiPrvSE.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004840) "WmiPrvSE.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004840) "WmiPrvSE.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00004840) "WmiPrvSE.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00004840) "WmiPrvSE.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004840) "WmiPrvSE.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00004840) "WmiPrvSE.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004840) "WmiPrvSE.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00004840) "WmiPrvSE.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004840) "WmiPrvSE.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004840) "WmiPrvSE.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004840) "WmiPrvSE.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004840) "WmiPrvSE.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00000312) "WmiPrvSE.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00000312) "WmiPrvSE.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00000312) "WmiPrvSE.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00000312) "WmiPrvSE.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00000312) "WmiPrvSE.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00000312) "WmiPrvSE.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00000312) "WmiPrvSE.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00000312) "WmiPrvSE.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00000312) "WmiPrvSE.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00000312) "WmiPrvSE.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00000312) "WmiPrvSE.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00000312) "WmiPrvSE.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00000312) "WmiPrvSE.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00000312)31:T119cd,"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter WerGetFlags (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter SuspendThread (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter SetProcessPriorityBoost (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter RaiseFailFastException (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetErrorMode (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetCursorInfo (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetComputerNameExW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter getsockname (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter getsockopt (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter WSARecvFrom (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter WSASendTo (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter NetGetJoinInformation (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter NetUserGetInfo (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CLSIDFromProgID (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetUserDefaultLCID (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter VariantInit (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter SysAllocStringLen (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter VariantClear (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetLastInputInfo (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetVolumeInformationByHandleW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter UpdateProcThreadAttribute (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00007752) "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "GetProcAddress" with a parameter DeleteProcThreadAttributeList (UID: 00000000-00007752) "WmiPrvSE.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WerGetFlags (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SuspendThread (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetProcessPriorityBoost (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter RaiseFailFastException (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetErrorMode (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetCursorInfo (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetComputerNameExW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter getsockname (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter getsockopt (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WSARecvFrom (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WSASendTo (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter LookupAccountSidW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter NetGetJoinInformation (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter NetApiBufferFree (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter NetUserGetInfo (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CLSIDFromProgID (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetUserDefaultLCID (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter VariantInit (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SysAllocStringLen (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SysFreeString (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter VariantClear (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SysStringLen (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetLastInputInfo (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetWindowTextLengthW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetWindowTextW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WTSEnableChildSessions (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GlobalUnlock (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GlobalFree (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetVolumeInformationByHandleW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetFileInformationByHandle (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CryptUnprotectData (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreatePipe (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter InitializeProcThreadAttributeList (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter UpdateProcThreadAttribute (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter DeleteProcThreadAttributeList (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CancelIoEx (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter RtlAdjustPrivilege (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter RemoveDirectoryW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter RmStartSession (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter RmRegisterResources (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter RmGetList (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter RmEndSession (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetFilePointerEx (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00005128) "WmiPrvSE.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WerGetFlags (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SuspendThread (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetProcessPriorityBoost (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter RaiseFailFastException (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetErrorMode (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetCursorInfo (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetComputerNameExW (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00004840) "WmiPrvSE.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WerGetFlags (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SuspendThread (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetProcessPriorityBoost (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter RaiseFailFastException (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetErrorMode (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter RtlGetNtVersionNumbers (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetCursorInfo (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetComputerNameExW (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00000312) "WmiPrvSE.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00000312)32:T1728,"Select Name from Win32_VideoController" (Source: 00000000-00007752-00002717-3252010364, Indicator: "select name from win32_videocontroller") "select Name from Win32_Processor" (Source: 00000000-00007752-00002717-3252377505, Indicator: "select name from win32_processor") "select * from Win32_OperatingSystem" (Source: 00000000-00007752-00002717-3252731308, Indicator: "select * from win32_operatingsystem") "select TotalPhysicalMemory from Win32_ComputerSystem" (Source: 00000000-00007752-00002717-3252995152, Indicator: "select totalphysicalmemory from win32_computersystem") "select TotalPhysicalMemory from Win32_ComputerSystem" (Source: 00000000-00005128.00000000.276808.03660000.00000004.mdmp, 00000000-00005128.00000001.278728.03660000.00000004.mdmp, 00000000-00005128.00000002.280646.03660000.00000004.mdmp, Indicator: "select totalphysicalmemory from win32_computersystem") "Select Name from Win32_VideoController" (Source: 00000000-00005128.00000001.278728.036A0000.00000004.mdmp, 00000000-00005128.00000002.280646.036A0000.00000004.mdmp, Indicator: "select name from win32_videocontroller") "CREATE TABLE x" (Source: 00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp, Indicator: "create table x") "CREATE TABLE %Q.'%q_%q'(%s)%s" (Source: 00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp, Indicator: "create table %q.'%q_%q'(%s)%s"), "SELECT word rank NULL langid id FROM "%w"."%w_vocab"%s" (Source: 00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp, Indicator: "select word rank null langid id from "%w"."%w_vocab"%s"), "SELECT rowid rank FROM %Q.%Q ORDER BY %s("%w"%s%s) %s" (Source: 00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp, Indicator: "select rowid rank from %q.%q order by %s("%w"%s%s) %s"), "INSERT INTO"%w"."%w_rowid"(rowid,nodeno)VALUES(?1,?2)ON CONFLICT(rowid)DO UPDATE SET nodeno=excluded.nodeno" (Source: 00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp, Indicator: "insert into"%w"."%w_rowid"(rowid,nodeno)values(?1,?2)on conflict(rowid)do update set nodeno=excluded.nodeno"), "CREATE TABLE "%w"."%w_rowid"(rowid INTEGER PRIMARY KEY,nodeno" (Source: 00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp, Indicator: "create table "%w"."%w_rowid"(rowid integer primary key,nodeno") "SELECT iLang, cFrom, cTo, iCost FROM "%w" WHERE iLang>=0 ORDER BY iLang" (Source: 00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp, Indicator: "select ilang, cfrom, cto, icost from "%w" where ilang>=0 order by ilang") "SELECT idx,count(*) FROM %Q.sqlite_stat4 GROUP BY idx COLLATE nocase" (Source: 00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp, Indicator: "select idx,count(*) from %q.sqlite_stat4 group by idx collate nocase"), "CREATE TABLE x(_shape" (Source: 00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp, Indicator: "create table x(_shape") "UPDATE OR %s "%w"."%w_vocab" SET id=%lld, rank=%d, langid=%d, word=%Q, k1=nullif(%Q,%Q), k2=%Q WHERE id=%lld" (Source: 00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp, Indicator: "update or %s "%w"."%w_vocab" set id=%lld, rank=%d, langid=%d, word=%q, k1=nullif(%q,%q) k2=%q where id=%lld"), "DELETE FROM "%w"."%w_vocab" WHERE id=%lld" (Source: 00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp, Indicator: "delete from "%w"."%w_vocab" where id=%lld"), "SELECT*FROM"%w".%s ORDER BY rowid" (Source: 00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp, Indicator: "select*from"%w".%s order by rowid"), "SELECT*FROM"%w".%s WHERE %s ORDER BY rowid" (Source: 00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp, Indicator: "select*from"%w".%s where %s order by rowid"), "UPDATE %Q.sqlite_master SET rootpage=%d WHERE #%d AND rootpage=#%d" (Source: 00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp, Indicator: "update %q.sqlite_master set rootpage=%d where #%d and rootpage=#%d"), "UPDATE %Q.sqlite_master SET type='%s' name=%Q tbl_name=%Q rootpage=#%d sql=%Q WHERE rowid=#%d" (Source: 00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp, Indicator: "update %q.sqlite_master set type='%s' name=%q tbl_name=%q rootpage=#%d sql=%q where rowid=#%d"), "UPDATE %Q.sqlite_master SET type='table' name=%Q tbl_name=%Q rootpage=0 sql=%Q WHERE rowid=#%d" (Source: 00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp, Indicator: "update %q.sqlite_master set type='table' name=%q tbl_name=%q rootpage=0 sql=%q where rowid=#%d"), "CREATE TABLE x(%.*s INT" (Source: 00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp, Indicator: "create table x(%.*s int") "SELECT %s FROM %s AS T" (Source: 00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp, Indicator: "select %s from %s as t") "DELETE FROM %Q.%s WHERE %s=%Q" (Source: 00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp, Indicator: "delete from %q.%s where %s=%q")33:T1c5e,Found reference to API (Indicator: "VirtualProtect"; File: "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe") Found reference to API (Indicator: "ExitProcess"; File: "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe") Found reference to API (Indicator: "GetProcAddress"; File: "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00000312.00000000.277562.06000000.00000004.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00000312.00000000.277562.06000000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00000312.00000000.277562.06000000.00000004.mdmp") Found reference to API (Indicator: "GetCursorInfo"; Source: "00000000-00000312.00000000.277562.06000000.00000004.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00000312.00000000.277562.06000000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00000312.00000000.277562.06000000.00000004.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00000312.00000000.277562.06000000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00000312.00000000.277562.06000000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00000312.00000000.277562.06000000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00000312.00000000.277562.06000000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00000312.00000000.277562.06000000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00000312.00000000.277562.06000000.00000004.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00000312.00000000.277562.06000000.00000004.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000312.00000000.277562.06000000.00000004.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00000312.00000000.277562.06000000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00000312.00000000.277562.06000000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00000312.00000000.277562.06000000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00000312.00000000.277562.06000000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00000312.00000000.277562.06000000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00000312.00000000.277562.06000000.00000004.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00000312.00000000.277562.06000000.00000004.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00000312.00000000.277562.06000000.00000004.mdmp") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; Source: "00000000-00000312.00000000.277562.06000000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00000312.00000000.277562.06100000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00000312.00000000.277562.06100000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00000312.00000000.277562.06100000.00000004.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00000312.00000000.277562.06100000.00000004.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00000312.00000000.277562.06100000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API (Indicator: "GetCursorInfo"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API (Indicator: "FreeSid"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp")34:T77e,"\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00000312.00000000.277562.03A10000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00000312.00000000.277562.06000000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004840.00000000.277160.00A20000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00004840.00000000.277160.05C00000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005128.00000000.276808.036A4000.00000004.mdmp "??\c:\users\hapubws\appdata\local\bravesoftware\brave-browser\user data\web data" in Source: 00000000-00005128.00000000.276808.036A4000.00000004.mdmp "th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0" in Source: 00000000-00005128.00000000.276808.036A4000.00000004.mdmp 00000000-00005128.00000001.278728.036A0000.00000004.mdmp 00000000-00005128.00000002.280646.036A0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00005128.00000001.278728.03660000.00000004.mdmp 00000000-00005128.00000002.280646.03660000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Web Data" in Source: 00000000-00005128.00000001.278728.036A0000.00000004.mdmp 00000000-00005128.00000002.280646.036A0000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00007752.00000000.276410.03984000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00007752.00000000.276410.03984000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007752.00000001.276494.03953000.00000004.mdmp35:T7df,Process SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe created mutex with name "\BaseNamedObjects\WEBR_GWC8KGSIHIAP" Process SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe created mutex with name "SM0:7752:168:WilStaging_02" Process SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7752:168:WilStaging_02" Process WmiPrvSE.exe created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process WmiPrvSE.exe created mutex with name "\Sessions\1\BaseNamedObjects\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process WmiPrvSE.exe created mutex with name "SM0:5128:168:WilStaging_02" Process WmiPrvSE.exe created mutex with name "Local\SM0:5128:64:WilError_01" Process WmiPrvSE.exe created mutex with name "RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511" Process WmiPrvSE.exe created mutex with name "RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000" Process WmiPrvSE.exe created mutex with name "Local\SM0:5128:168:WilStaging_02" Process WmiPrvSE.exe created mutex with name "SM0:5128:64:WilError_01" Process WmiPrvSE.exe created mutex with name "\BaseNamedObjects\WEBR_GWC8KGSIHIAP" Process WmiPrvSE.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5128:168:WilStaging_02" Process WmiPrvSE.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5128:64:WilError_01" Process WmiPrvSE.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:5128:64:WilError_01" Process WmiPrvSE.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:5128:168:WilStaging_02" Process WmiPrvSE.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:4840:168:WilStaging_02" Process WmiPrvSE.exe created mutex with name "SM0:4840:168:WilStaging_02" Process WmiPrvSE.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:312:168:WilStaging_02" Process WmiPrvSE.exe created mutex with name "SM0:312:168:WilStaging_02"36:T9e1,"\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00000312.00000000.277562.03A10000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00000312.00000000.277562.06000000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004840.00000000.277160.00A20000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00004840.00000000.277160.05C00000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00005128.00000000.276808.036A4000.00000004.mdmp "??\c:\users\hapubws\appdata\local\bravesoftware\brave-browser\user data\web data" in Source: 00000000-00005128.00000000.276808.036A4000.00000004.mdmp "th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0" in Source: 00000000-00005128.00000000.276808.036A4000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00005128.00000001.278728.03660000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Web Data" in Source: 00000000-00005128.00000001.278728.036A0000.00000004.mdmp "th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0" in Source: 00000000-00005128.00000001.278728.036A0000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable" in Source: 00000000-00005128.00000002.280646.03660000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Opera Software\Opera Stable\Web Data" in Source: 00000000-00005128.00000002.280646.036A0000.00000004.mdmp "th=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0" in Source: 00000000-00005128.00000002.280646.036A0000.00000004.mdmp "Win32Registry|Software\Microsoft\Windows\CurrentVersion|CurrentType" in Source: 00000000-00007752.00000000.276410.03984000.00000004.mdmp "Win32Registry|SYSTEM\CurrentControlSet\Control\PriorityControl|Win32PrioritySeparation" in Source: 00000000-00007752.00000000.276410.03984000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00007752.00000001.276494.03953000.00000004.mdmp37:Td3a,"GET /mouse-gesture/config.json HTTP/2 Host: edge-consumer-static.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Storage-Access: active Sec-Fetch-Site: none Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/json Date: Thu 30 Apr 2026 02:03:51 GMT X-Azure-Ref: 20260430T020351Z-177fd759dc8jd5j8hC1SJC3q5g00000003vg0000000032ae X-Ms-Version: 2009-09-19 X-Ms-Lease-Status: unlocked X-Ms-Blob-Type: BlockBlob Access-Control-Expose-Headers: x-ms-request-id Server x-ms-version Content-Type ETag Last-Modified x-ms-lease-status x-ms-blob-type Content-Length Date Transfer-Encoding Access-Control-Allow-Origin: * Last-Modified: Tue 24 Oct 2023 08:27:00 GMT X-Fd-Int-Roxy-Purgeid: 83583309 Etag: 0x8DBD46AFE482320 X-Cache: TCP_HIT Cache-Control: public max-age=432000 Accept-Ranges: bytes X-Ms-Request-Id: d03f4500-301e-0074-4f0b-d78687000000 with no response body "GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2 Host: clients2.googleusercontent.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Sec-Mesh-Client-Arch: x86_64 Sec-Mesh-Client-Os: Windows Priority: u=4, i Sec-Mesh-Client-Edge-Version: 145.0.3800.58 Sec-Mesh-Client-Edge-Channel: stable Accept-Encoding: gzip, deflate, br, zstd Sec-Mesh-Client-Os-Version: 10.0.16299 Sec-Mesh-Client-Webview: 0 Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/x-chrome-extension X-Guploader-Uploadid: AAVLpEhqNQJWrXO7Pmnga2ts7AlJNYA3YFOhXqbHYLKi-2pkzNOtRq65a7zNAelR0O2Y1oMQMkSUbEc Date: Wed 29 Apr 2026 22:35:29 GMT Server: UploadServer Last-Modified: Tue 14 Apr 2026 15:03:12 GMT Expires: Thu 29 Apr 2027 22:35:29 GMT Etag: 1db0e9cf_2cf27c25_ffe43034_bc33e3f0_b05b60af Accept-Ranges: bytes Cache-Control: public max-age=31536000 Alt-Svc: h3=":443"; ma=2592000 h3-29=":443"; ma=2592000 Age: 12507 X-Goog-Hash: crc32c=939wAg== with response body ==>BINARY_CONTENT....... "GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2 Host: edgeassetservice.azureedge.net User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0 Sec-Fetch-Mode: no-cors Edge-Asset-Group: ArbitrationService Sec-Fetch-Site: none Accept-Language: en-US,en;q=0.9 Priority: u=4, i Accept-Encoding: gzip, deflate, br, zstd Sec-Fetch-Dest: empty" Response ==> HTTP/2 200 OK Content-Type: application/octet-stream Date: Thu 30 Apr 2026 02:03:57 GMT Last-Modified: Wed 08 Apr 2026 16:21:07 GMT X-Azure-Ref: 20260430T020357Z-1676997bc64lwrlqhC1CHId5t80000000ds0000000007a23 X-Ms-Version: 2009-09-19 X-Ms-Lease-Status: unlocked X-Fd-Int-Roxy-Purgeid: 0 Vary: Accept-Encoding Content-Encoding: br X-Cache: TCP_HIT Cache-Control: public max-age=604800 X-Ms-Request-Id: 770f9d35-501e-001c-526b-d198a1000000 X-Ms-Blob-Type: BlockBlob with no response body38:T1dd7,"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "KERNEL32" at base 74620000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 77050000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 77050000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 77050000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 747a0000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77050000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77050000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77050000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72aa0000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "KERNEL32.DLL" at base 74620000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 76330000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "NTDLL.DLL" at base 774d0000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "WINMM.DLL" at base 72a40000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "WS2_32.DLL" at base 75e70000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "POWRPROF.DLL" at base 77000000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "USER32.DLL" at base 77350000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "ADVAPI32.DLL" at base 74390000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 72bf0000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "IPHLPAPI.DLL" at base 73e10000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "RPCRT4.DLL" at base 76260000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72a00000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 729b0000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "USERENV.DLL" at base 72980000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "NETAPI32.DLL" at base 72960000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "OLE32.DLL" at base 76ea0000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 739a0000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77050000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 728e0000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74390000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 72860000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 74480000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "OLEAUT32.DLL" at base 74480000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 727b0000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 727a0000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 726e0000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 77050000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 77050000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "%WINDIR%\SYSWOW64\TASKSCHD.DLL" at base 733b0000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "SSPICLI.DLL" at base 73ef0000 "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73e40000 "WmiPrvSE.exe" loaded module "KERNEL32" at base 74620000 "WmiPrvSE.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 77050000 "WmiPrvSE.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 77050000 "WmiPrvSE.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 77050000 "WmiPrvSE.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 747a0000 "WmiPrvSE.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 77050000 "WmiPrvSE.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 77050000 "WmiPrvSE.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 77050000 "WmiPrvSE.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72aa0000 "WmiPrvSE.exe" loaded module "KERNEL32.DLL" at base 74620000 "WmiPrvSE.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 76330000 "WmiPrvSE.exe" loaded module "NTDLL.DLL" at base 774d0000 "WmiPrvSE.exe" loaded module "WINMM.DLL" at base 72a40000 "WmiPrvSE.exe" loaded module "WS2_32.DLL" at base 75e70000 "WmiPrvSE.exe" loaded module "POWRPROF.DLL" at base 77000000 "WmiPrvSE.exe" loaded module "USER32.DLL" at base 77350000 "WmiPrvSE.exe" loaded module "ADVAPI32.DLL" at base 74390000 "WmiPrvSE.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 72bf0000 "WmiPrvSE.exe" loaded module "IPHLPAPI.DLL" at base 73e10000 "WmiPrvSE.exe" loaded module "RPCRT4.DLL" at base 76260000 "WmiPrvSE.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72a00000 "WmiPrvSE.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 729b0000 "WmiPrvSE.exe" loaded module "USERENV.DLL" at base 72980000 "WmiPrvSE.exe" loaded module "NETAPI32.DLL" at base 72960000 "WmiPrvSE.exe" loaded module "OLE32.DLL" at base 76ea0000 "WmiPrvSE.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 739a0000 "WmiPrvSE.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77050000 "WmiPrvSE.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 728e0000 "WmiPrvSE.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 74390000 "WmiPrvSE.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 72860000 "WmiPrvSE.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 74480000 "WmiPrvSE.exe" loaded module "OLEAUT32.DLL" at base 74480000 "WmiPrvSE.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 727b0000 "WmiPrvSE.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 727a0000 "WmiPrvSE.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 726e0000 "WmiPrvSE.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 77050000 "WmiPrvSE.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 77050000 "WmiPrvSE.exe" loaded module "WTSAPI32.DLL" at base 73b60000 "WmiPrvSE.exe" loaded module "GDI32.DLL" at base 73f30000 "WmiPrvSE.exe" loaded module "CRYPT32.DLL" at base 75ee0000 "WmiPrvSE.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 73e40000 "WmiPrvSE.exe" loaded module "RSTRTMGR.DLL" at base 728e0000 "WmiPrvSE.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7633000039:T4f1,"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "WbemScripting.SWbemLocator.1.CreateObject" ... "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "WbemScripting.SWbemLocator.1.ConnectServer" with result: "IDispatch" ... "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "WbemScripting.SWbemLocator.1("ConnectServer").ExecQuery" with result: "IDispatch" ... "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "WbemScripting.SWbemLocator.1("ConnectServer")("ExecQuery").Count" with result: "1" ... "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "WbemScripting.SWbemLocator.1("ConnectServer")("ExecQuery")._NewEnum" with result: "IDispatch" ... "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "WbemScripting.SWbemLocator.1("ConnectServer")("ExecQuery").Count" with result: "2" ... "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "Schedule.Service.1.CreateObject" ... "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "Schedule.Service.1.Connect" ... "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "Schedule.Service.1.GetFolder" with result: "\" ... "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" called "Schedule.Service.1("GetFolder").GetTask" ... 3a:T988,"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" touched "WBEM Scripting Locator" (Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" touched "WBEM Locator" (Path: "HKCU\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" touched "PSDispatch" (Path: "HKCU\WOW6432NODE\CLSID\{00020420-0000-0000-C000-000000000046}\TREATAS") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" touched "PSTypeInfo" (Path: "HKCU\WOW6432NODE\CLSID\{00020422-0000-0000-C000-000000000046}\TREATAS") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" touched "WbemDefaultPathParser" (Path: "HKCU\WOW6432NODE\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\WOW6432NODE\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" touched "Microsoft WBEM Call Context" (Path: "HKCU\WOW6432NODE\CLSID\{674B6698-EE92-11D0-AD71-00C04FD8FDFF}\TREATAS") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\WOW6432NODE\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\WOW6432NODE\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" touched "PSEnumVariant" (Path: "HKCU\WOW6432NODE\CLSID\{00020421-0000-0000-C000-000000000046}\TREATAS") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" touched "TaskScheduler class" (Path: "HKCU\WOW6432NODE\CLSID\{0F87369F-A4E5-4CFC-BD3E-73E6154572DD}\TREATAS") "WmiPrvSE.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "WmiPrvSE.exe" touched "Private Profile Object" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{75847177-F077-4171-BD2C-A6BB2164FBD0}\INPROCSERVER32") "WmiPrvSE.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS")3b:T4a3,"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" file has an entrypoint instructions - "pushal ,mov esi, 0xc66015,lea edi, [esi - 0x865015],push edi,mov ebp, esp,lea ebx, [esp - 0x3e80],xor eax, eax,push eax,cmp esp, ebx,jne 0xf87d18,inc esi,inc esi,push ebx,push 0xb85b49,push edi,add ebx, 4,push ebx,push 0x321cde,push esi,add ebx, 4,push ebx,push eax,mov dword ptr [ebx], 0x20003,push ebp,push edi,push esi,push ebx,sub esp, 0x7c,mov edx, dword ptr [esp + 0x90],mov dword ptr [esp + 0x74], 0,mov byte ptr [esp + 0x73], 0,mov ebp, dword ptr [esp + 0x9c],lea eax, [edx + 4],mov dword ptr [esp + 0x78], eax," "OSPPSVC.EXE" file has an entrypoint instructions - "pushal ,mov esi, 0xc66015,lea edi, [esi - 0x865015],push edi,mov ebp, esp,lea ebx, [esp - 0x3e80],xor eax, eax,push eax,cmp esp, ebx,jne 0xf87d18,inc esi,inc esi,push ebx,push 0xb85b49,push edi,add ebx, 4,push ebx,push 0x321cde,push esi,add ebx, 4,push ebx,push eax,mov dword ptr [ebx], 0x20003,push ebp,push edi,push esi,push ebx,sub esp, 0x7c,mov edx, dword ptr [esp + 0x90],mov dword ptr [esp + 0x74], 0,mov byte ptr [esp + 0x73], 0,mov ebp, dword ptr [esp + 0x9c],lea eax, [edx + 4],mov dword ptr [esp + 0x78], eax,"3c:T19b2,Process "WmiPrvSE.exe" (UID: 00000000-00005128) was launched with new environment variables: "USERDNSDOMAIN="DESKTOP-FVVF82A", PROCESSOR_ARCHITEW6432="AMD64"" Process "WmiPrvSE.exe" (UID: 00000000-00005128) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS" Process "msedge.exe" (UID: 00000000-00003696) was launched with modified environment variables: "PROCESSOR_ARCHITECTURE, CommonProgramFiles, Path, ProgramFiles, NUMBER_OF_PROCESSORS" Process "msedge.exe" (UID: 00000000-00003696) was launched with missing environment variables: "PROCESSOR_ARCHITEW6432" Process "msedge.exe" (UID: 00000000-00007040) was launched with new environment variables: "EDGE_CRASHPAD_PIPE_NAME="\\.\pipe\crashpad_3696_HRNNYTDMLVSWCQQT", EDGE_METRICS_SESSION_ID="7", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753", EDGE_BROWSER_PID="3696"" Process "msedge.exe" (UID: 00000000-00001740) was launched with missing environment variables: "EDGE_METRICS_SESSION_ID, COMPONENT_INSTALLER_DIR, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00003264) was launched with new environment variables: "EDGE_METRICS_SESSION_ID="7", COMPONENT_INSTALLER_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00001424) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00006996) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="twYLWI2vwqjnjDx", LOGONSERVER="%HOSTNAME%", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="7", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="hV1wYIg", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="twYLWI2vwqjnjDx", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\hV1wYIg", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\hV1wYIg", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00007616) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH" Process "msedge.exe" (UID: 00000000-00005748) was launched with new environment variables: "USERDOMAIN_ROAMINGPROFILE="DESKTOP-FVVF82A", NVM_SYMLINK="%PROGRAMFILES%\nodejs", PROCESSOR_LEVEL="6", SSLKEYLOGFILE="%TEMP%\sslkey.txt", USERDOMAIN="twYLWI2vwqjnjDx", LOGONSERVER="%HOSTNAME%", SESSIONNAME="Console", ALLUSERSPROFILE="C:\ProgramData", PROCESSOR_ARCHITECTURE="AMD64", PSModulePath="%WINDIR%\system32\WindowsPowerShell\v1.0\Modules\;%PROGRAMFILES%\(x86)\AutoIt3\AutoItX", EDGE_METRICS_SESSION_ID="7", OneDrive="%USERPROFILE%\OneDrive", APPDATA="%USERPROFILE%\AppData\Roaming", EDGE_USER_DATA_DIR="%LOCALAPPDATA%\Microsoft\Edge\User Data", USERNAME="hV1wYIg", USERDNSDOMAIN="DESKTOP-FVVF82A", ProgramFiles(x86)="%PROGRAMFILES%\(x86)", CommonProgramFiles="%PROGRAMFILES%\Common Files", CURL_CA_BUNDLE="%USERPROFILE%\.mitmproxy\mitmproxy-ca-cert.cer", PATHEXT=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC", OS="Windows_NT", COMPUTERNAME="twYLWI2vwqjnjDx", NVM_HOME="%APPDATA%\nvm", PROCESSOR_REVISION="4f00", CommonProgramW6432="%PROGRAMFILES%\Common Files", ComSpec="%WINDIR%\system32\cmd.exe", ProgramData="C:\ProgramData", ProgramW6432="C:\Program Files", HOMEPATH="\Users\hV1wYIg", HOMEDRIVE="C:", PROCESSOR_IDENTIFIER="Intel64 Family 6 Model 79 Stepping 0 GenuineIntel", USERPROFILE="C:\Users\hV1wYIg", CommonProgramFiles(x86)="%PROGRAMFILES%\(x86)\Common Files", ProgramFiles="C:\Program Files", PUBLIC="C:\Users\Public", NUMBER_OF_PROCESSORS="2", windir="C:\WINDOWS", EDGE_METRICS_CLIENT_ID_HASH="8213263524593659753"" Process "msedge.exe" (UID: 00000000-00002740) was launched with missing environment variables: "USERDOMAIN_ROAMINGPROFILE, NVM_SYMLINK, PROCESSOR_LEVEL, SSLKEYLOGFILE, USERDOMAIN, LOGONSERVER, SESSIONNAME, ALLUSERSPROFILE, PROCESSOR_ARCHITECTURE, PSModulePath, EDGE_METRICS_SESSION_ID, OneDrive, APPDATA, EDGE_USER_DATA_DIR, USERNAME, USERDNSDOMAIN, ProgramFiles(x86), CommonProgramFiles, CURL_CA_BUNDLE, PATHEXT, OS, COMPUTERNAME, NVM_HOME, PROCESSOR_REVISION, CommonProgramW6432, ComSpec, ProgramData, ProgramW6432, HOMEPATH, HOMEDRIVE, PROCESSOR_IDENTIFIER, USERPROFILE, CommonProgramFiles(x86), ProgramFiles, PUBLIC, NUMBER_OF_PROCESSORS, windir, EDGE_METRICS_CLIENT_ID_HASH"3d:T446,"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "WmiPrvSE.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "WmiPrvSE.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "WmiPrvSE.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "WmiPrvSE.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "WmiPrvSE.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY")3e:Ta29,Spawned process "WmiPrvSE.exe" (UID: 00000000-00005128) Spawned process "WmiPrvSE.exe" with commandline "-" (UID: 00000000-00004840) Spawned process "WmiPrvSE.exe" with commandline "-" (UID: 00000000-00000312) Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00003696) Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00007040) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00001740), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00003264), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00001424), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00006244), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00007860), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00006996), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --disable ..." (UID: 00000000-00007616), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00004592), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00000164), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00001160), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=PooledProcess2 --lang=en-US -- ..." (UID: 00000000-00005748), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00004864), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00002740), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00003444), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00002468)3f:Ta29,Spawned process "WmiPrvSE.exe" (UID: 00000000-00005128) Spawned process "WmiPrvSE.exe" with commandline "-" (UID: 00000000-00004840) Spawned process "WmiPrvSE.exe" with commandline "-" (UID: 00000000-00000312) Spawned process "msedge.exe" with commandline "--profile-directory=Default" (UID: 00000000-00003696) Spawned process "msedge.exe" with commandline "--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAA ..." (UID: 00000000-00007040) Spawned process "msedge.exe" with commandline "--type=crashpad-handler "--user-data-dir=%LOCALAPPDATA%\\Microso ..." (UID: 00000000-00001740), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=network.mojom.NetworkService - ..." (UID: 00000000-00003264), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=storage.mojom.StorageService - ..." (UID: 00000000-00001424), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --video-c ..." (UID: 00000000-00006244), Spawned process "msedge.exe" with commandline "--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-mem ..." (UID: 00000000-00007860), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en ..." (UID: 00000000-00006996), Spawned process "msedge.exe" with commandline "--type=renderer --instant-process --pdf-upsell-enabled --disable ..." (UID: 00000000-00007616), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=asset_store.mojom.AssetStoreSe ..." (UID: 00000000-00004592), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=entity_extraction_service.mojo ..." (UID: 00000000-00000164), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00001160), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=PooledProcess2 --lang=en-US -- ..." (UID: 00000000-00005748), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=edge_search_indexer.mojom.Sear ..." (UID: 00000000-00004864), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00002740), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00003444), Spawned process "msedge.exe" with commandline "--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en ..." (UID: 00000000-00002468)40:T8c7,The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 65:DE:BF:81:62:CE:90:47:14:E9:61:43:8D:95:D4:22:C1:F3:5A:FB; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R1, O=Google Trust Services LLC, C=US" (SHA1: 66:E4:16:12:60:B1:00:FE:E0:DE:28:7A:9A:52:93:B4:C2:22:4A:E6; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 08:74:54:87:E8:91:C1:9E:30:78:C1:F2:A0:7E:45:29:50:EF:36:F6; see report for more information) The input sample is signed with a certificate issued by "CN=Microsoft Azure RSA TLS Issuing CA 07, O=Microsoft Corporation, C=US" (SHA1: 55:E7:21:8C:57:17:F9:59:2D:31:7E:1C:D2:0C:A9:3E:27:D5:4A:6C; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 33:82:51:70:58:A0:C2:02:28:D5:98:EE:75:01:B6:12:56:A7:64:42; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: DF:3C:24:F9:BF:D6:66:76:1B:26:80:73:FE:06:D1:CC:8D:4F:82:A4; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication CA DV R36, O=Sectigo Limited, C=GB" (SHA1: 48:62:BA:29:DB:48:52:50:EC:DE:95:62:15:70:58:A6:E2:13:BC:AE; see report for more information) The input sample is signed with a certificate issued by "CN=Sectigo Public Server Authentication Root R46, O=Sectigo Limited, C=GB" (SHA1: DD:55:B4:52:02:91:E2:76:58:8F:0D:D0:2F:AF:D8:3A:73:68:E0:FA; see report for more information) The input sample is signed with a certificate issued by "CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US" (SHA1: 2B:18:94:7A:6A:9F:C7:76:4F:D8:B5:FB:18:A8:63:B0:C6:DA:C2:4F; see report for more information) The input sample is signed with a certificate issued by "CN=WR2, O=Google Trust Services, C=US" (SHA1: 1A:63:7B:F3:04:6F:4C:E4:F3:15:87:E8:E7:FA:DD:B1:F7:7E:89:49; see report for more information)41:Ta7d,"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\TREATASCLASSINDEX"; Key: ""; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\PACKAGEDCOM\CLASSINDEX\{00000344-0000-0000-C000-000000000046}"; Key: ""; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}"; Key: ""; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}"; Key: ""; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\TREATAS"; Key: ""; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\TREATAS"; Key: ""; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCSERVER32"; Key: ""; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCSERVER32"; Key: ""; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCHANDLER32"; Key: ""; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCHANDLER32"; Key: ""; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCHANDLER"; Key: ""; Value: "")42:T9e9,"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}"; Key: ""; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCSERVER32"; Key: ""; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}"; Key: "APPID"; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WBEM\CIMOM"; Key: "LOGGING DIRECTORY"; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WBEM\CIMOM"; Key: "LOGGING"; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WBEM\CIMOM"; Key: "LOG FILE MAX SIZE"; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WBEM\SCRIPTING"; Key: "DEFAULT IMPERSONATION LEVEL"; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}"; Key: ""; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32"; Key: "INPROCSERVER32"; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32"; Key: ""; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32"; Key: "THREADINGMODEL"; Value: "")43:T631,"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" trying to access non-existent file "C:\FLTLIB.DLL" "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" trying to access non-existent file "C:\BCRYPT.DLL" "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" trying to access non-existent file "C:\bcrypt.dll" "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" trying to access non-existent file "C:\Windows\SysWOW64\wbem\WBEMCOMN.DLL" "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\wbemcomn.dll" "WmiPrvSE.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "WmiPrvSE.exe" trying to access non-existent file "C:\Program Files (x86)\Adobe\FLTLIB.DLL" "WmiPrvSE.exe" trying to access non-existent file "C:\Program Files (x86)\Adobe\CRYPTSP.DLL" "WmiPrvSE.exe" trying to access non-existent file "C:\Program Files (x86)\Adobe\BCRYPT.DLL" "WmiPrvSE.exe" trying to access non-existent file "C:\Program Files (x86)\Adobe\bcrypt.dll" "WmiPrvSE.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL"44:T6dd,"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" trying to access non-existent file "C:\F248D74E-5558-0BDF-D109-A68D9B924E55" "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}" "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}" "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" trying to access non-existent file "\Device\RasAcd" "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" trying to access non-existent file "C:\PROGRAM FILES (X86)(X86)" "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" trying to access non-existent file "C:\Program Files (x86)\Google\F248D74E-5558-0BDF-D109-A68D9B924E55" "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" trying to access non-existent file "C:\Program Files (x86)\Windows Multimedia Platform\F248D74E-5558-0BDF-D109-A68D9B924E55" "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" trying to access non-existent file "C:\Program Files (x86)\Adobe\F248D74E-5558-0BDF-D109-A68D9B924E55" "WmiPrvSE.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}" "WmiPrvSE.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}" "WmiPrvSE.exe" trying to access non-existent file "\Device\RasAcd" "WmiPrvSE.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\F248D74E-5558-0BDF-D109-A68D9B924E55" "WmiPrvSE.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\ARMORY" "WmiPrvSE.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\MYMONERO"45:T102b,Heuristic match: "5@.mw" Heuristic match: "^mn0<0http://cps.chambersign.org/cps/chambersroot.html0?w" - Source: "00000000-00000312.00000000.277562.06100000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0990709183120z190709184036z0salt" - Source: "00000000-00000312.00000000.277562.06100000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0;09071http://crl.usertrust.com/utn-userfirst-object.crl0)k%%-qcn>k't" - Source: "00000000-00000312.00000000.277562.06100000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?digicert" - Source: "00000000-00000312.00000000.277562.06100000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mn0<0http://cps.chambersign.org/cps/chambersroot.html0?w" - Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0990709183120z190709184036z0salt" - Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0;09071http://crl.usertrust.com/utn-userfirst-object.crl0)k%%-qcn>k't" - Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?jp1%0" - Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0," (Indicator: "GetDC"; Source: "00000000-00000312.00000000.277562.03A10000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00000312.00000000.277562.03A10000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00000312.00000000.277562.03A10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000312.00000000.277562.03A10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00000312.00000000.277562.03A10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00000312.00000000.277562.03A10000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00000312.00000000.277562.03A10000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00000312.00000000.277562.03A10000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004840.00000000.277160.00A20000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004840.00000000.277160.00A20000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004840.00000000.277160.00A20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004840.00000000.277160.00A20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004840.00000000.277160.00A20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004840.00000000.277160.00A20000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004840.00000000.277160.00A20000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004840.00000000.277160.00A20000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005128.00000000.276808.03660000.00000004.mdmp, 00000000-00005128.00000001.278728.03660000.00000004.mdmp, 00000000-00005128.00000002.280646.03660000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005128.00000000.276808.03660000.00000004.mdmp, 00000000-00005128.00000001.278728.03660000.00000004.mdmp, 00000000-00005128.00000002.280646.03660000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005128.00000000.276808.03660000.00000004.mdmp, 00000000-00005128.00000001.278728.03660000.00000004.mdmp, 00000000-00005128.00000002.280646.03660000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005128.00000000.276808.03660000.00000004.mdmp, 00000000-00005128.00000001.278728.03660000.00000004.mdmp, 00000000-00005128.00000002.280646.03660000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005128.00000000.276808.03660000.00000004.mdmp, 00000000-00005128.00000001.278728.03660000.00000004.mdmp, 00000000-00005128.00000002.280646.03660000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005128.00000000.276808.03660000.00000004.mdmp, 00000000-00005128.00000001.278728.03660000.00000004.mdmp, 00000000-00005128.00000002.280646.03660000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005128.00000000.276808.03660000.00000004.mdmp, 00000000-00005128.00000001.278728.03660000.00000004.mdmp, 00000000-00005128.00000002.280646.03660000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005128.00000000.276808.03660000.00000004.mdmp, 00000000-00005128.00000001.278728.03660000.00000004.mdmp, 00000000-00005128.00000002.280646.03660000.00000004.mdmp")4b:T464,Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00000312.00000000.277562.06000000.00000004.mdmp") Found reference to API "[System Process]Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00000312.00000000.277562.06000000.00000004.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00000312.00000000.277562.06000000.00000004.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API "[System Process]Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found reference to API "11560088010,7640,3121,,CreateToolhelp32Snapshot,kernel32.dll,"01:12:05.062",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00005128.00000000.276808.036A4000.00000004.mdmp")4c:Tfef,Found string "Select Name from Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00007752-00002717-3252010364") Found string "select Name from Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00007752-00002717-3252377505") Found string "select Name from Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00007752-00002717-3252377505") Found string "select * from Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00007752-00002717-3252731308") Found string "select TotalPhysicalMemory from Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00007752-00002717-3252995152") Found string "select TotalPhysicalMemory from Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00005128.00000000.276808.03660000.00000004.mdmp, 00000000-00005128.00000001.278728.03660000.00000004.mdmp, 00000000-00005128.00000002.280646.03660000.00000004.mdmp") Found string "instance of Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00005128.00000000.276808.036A4000.00000004.mdmp") Found string "instance of Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00005128.00000000.276808.036A4000.00000004.mdmp, 00000000-00005128.00000000.276808.036D1000.00000004.mdmp") Found string "instance of Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00005128.00000000.276808.036A4000.00000004.mdmp") Found string "instance of Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00005128.00000000.276808.036A4000.00000004.mdmp") Found string "of Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00005128.00000000.276808.036A4000.00000004.mdmp") Found string ""instance of Win32_Processor{DeviceID = 'CPU0';Name = 'Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz';};","instance of Win32_Processor{DeviceID = 'CPU1';Name = 'Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz';};"" (Indicator: " Win32_Process"; Source: "00000000-00005128.00000000.276808.036A4000.00000004.mdmp") Found string ""instance of Win32_Processor{DeviceID = 'CPU0';Name = 'Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz';};","instance of Win32_Processor{DeviceID = 'CPU1';Name = 'Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz';};"" (Indicator: " Win32_Processor"; Source: "00000000-00005128.00000000.276808.036A4000.00000004.mdmp") Found string "Select Name from Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00005128.00000001.278728.036A0000.00000004.mdmp, 00000000-00005128.00000002.280646.036A0000.00000004.mdmp") Found string "instance of Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00007752.00000000.276410.03910000.00000004.mdmp") Found string "select TotalPhysicalMemory from Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00007752.00000000.276410.03910000.00000004.mdmp, 00000000-00007752.00000001.276494.03910000.00000004.mdmp, 00000000-00007752.00000001.276494.03953000.00000004.mdmp") Found string "instance of Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00007752.00000000.276410.03984000.00000004.mdmp, 00000000-00007752.00000001.276494.03953000.00000004.mdmp") file/memory contains long string with (Indicator: " Win32_OperatingSystem"; Source: "00000000-00007752.00000000.276410.03984000.00000004.mdmp") Found string ""instance of Win32_Processor{DeviceID = 'CPU0';Name = 'Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz';};","instance of Win32_Processor{DeviceID = 'CPU1';Name = 'Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz';};"" (Indicator: " Win32_Process"; Source: "00000000-00007752.00000001.276494.03953000.00000004.mdmp") Found string ""instance of Win32_Processor{DeviceID = 'CPU0';Name = 'Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz';};","instance of Win32_Processor{DeviceID = 'CPU1';Name = 'Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz';};"" (Indicator: " Win32_Processor"; Source: "00000000-00007752.00000001.276494.03953000.00000004.mdmp")4d:T6c0,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000312.00000000.277562.03A10000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Program Files (x86)\Microsoft\Edge\Application\WmiPrvSE.exe" (Indicator: "\Device\"; Source: "00000000-00004840.00000000.277160.00A20000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004840.00000000.277160.00A20000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00005128.00000000.276808.03660000.00000004.mdmp, 00000000-00005128.00000001.278728.03660000.00000004.mdmp, 00000000-00005128.00000002.280646.03660000.00000004.mdmp") Found string "= "\\Device\\Harddi@" (Indicator: "\Device\"; Source: "00000000-00005128.00000000.276808.036A4000.00000004.mdmp 00000000-00005128.00000001.278728.036A0000.00000004.mdmp 00000000-00005128.00000002.280646.036A0000.00000004.mdmp"), Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007752.00000000.276410.03910000.00000004.mdmp 00000000-00007752.00000001.276494.03910000.00000004.mdmp"), Found string "BootDevice = "\\Device\\HarddiskVolume1";" (Indicator: "\Device\"; Source: "00000000-00007752.00000000.276410.03984000.00000004.mdmp 00000000-00007752.00000001.276494.03953000.00000004.mdmp"), Found string "Name = "Microsoft Windows 10 Pro|C:\\WINDOWS|\\Device\\Harddisk0\\Partition2";" (Indicator: "\Device\"; Source: "00000000-00007752.00000000.276410.03984000.00000004.mdmp"), Found string "SystemDevice = "\\Device\\HarddiskVolume2";" (Indicator: "\Device\"; Source: "00000000-00007752.00000000.276410.03984000.00000004.mdmp")4e:T9b7,"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\PROGRAM FILES (X86)\ADOBE\WMIPRVSE.EXE"; Value: ""), "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: ""), "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: ""), "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: ""), "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: ""), "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: ""), "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: ""), "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: ""), "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: ""), "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "")4f:Tfd3,"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "CSRSS"; Value: "%PROGRAMFILES%\(x86)\Google\csrss.exe"), "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "OSPPSVC"; Value: "%PROGRAMFILES%\(x86)\Windows Multimedia Platform\OSPPSVC.EXE"), "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "WMIPRVSE"; Value: "%PROGRAMFILES%\(x86)\Adobe\WmiPrvSE.exe"), "WmiPrvSE.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "OWNER"; Value: "081400007C07E9F17FD8DC0100"), "WmiPrvSE.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "98ACBEB8D33966200693FA7F6DB3905F0E66FADD15E409A72717F861E58429F000"), "WmiPrvSE.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SEQUENCE"; Value: "0100000000"), "WmiPrvSE.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILES0000"; Value: "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Web Data"), "WmiPrvSE.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "1CF0C8ADD06CC8ACDD09B47314DFE11118ED2898A09ECB129013743EB7381E8E00"), "WmiPrvSE.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "2387F82DBE2338756624EFC53F546420EF96241D6DF4EFEF7ABE17A64329AAF400"), "WmiPrvSE.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILES0000"; Value: "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Network\Cookies"), "WmiPrvSE.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "5025AC8BF6DF93A488F4F7397111EEC53758F5656198DF2CFB165988FD3458C300"), "WmiPrvSE.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "E017F66CFC863E13A53E15E405707B73E9E4C0E087B06861C9999290A6991B4100"), "WmiPrvSE.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILES0000"; Value: "%LOCALAPPDATA%\Google\Chrome\User Data\Default\Web Data"), "WmiPrvSE.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "47E0F482635B1173DE8D9696DCEB74390736386AD870CAE98E88F1C5A987C0E500"), "WmiPrvSE.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "689591B44D9326481DEE27355C4A2D75E8E6A58E3311EE034CB3D800AB7BF57500"), "WmiPrvSE.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "A59095679480DEA7E850AEE63781E3D99B8CE3E46A9951CFB1F438F21886635700"), "WmiPrvSE.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "78875B29BA23DBB012ED2622CAECCECA97FA454BB972440DC9CCF01CC1DC1E6B00"), "WmiPrvSE.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILES0000"; Value: "%LOCALAPPDATA%\Microsoft\Edge\User Data\Default\Network\Cookies"), "WmiPrvSE.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "BB1D71C63ED7ADF8587621596306FA1EFF20EB02FF436EBA7720CDE2AB3814B400"), "WmiPrvSE.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "SESSIONHASH"; Value: "2DC3F689AB2A80016ABAF839B53579E1BBF85236DB24094455221C0956650CB900"), "WmiPrvSE.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\RESTARTMANAGER\SESSION0000"; Key: "REGFILESHASH"; Value: "16D63D7C75164CC03BA9F51C09EC0F126A37333E8D3EBFFAE5B5E8D3BCDD1ACE00")50:T81c,"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" wrote 32768 bytes starting with PE header signature to file "C:\Program Files (x86)\Google\csrss.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" wrote 32768 bytes starting with PE header signature to file "C:\Program Files (x86)\Windows Multimedia Platform\OSPPSVC.EXE": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe" wrote 32768 bytes starting with PE header signature to file "C:\Program Files (x86)\Adobe\WmiPrvSE.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "WmiPrvSE.exe" wrote 11776 bytes starting with PE header signature to file "C:\Program Files (x86)\Microsoft\Edge\Application\WmiPrvSE.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "WmiPrvSE.exe" wrote 11776 bytes starting with PE header signature to file "C:\Program Files\Google\Chrome\Application\WmiPrvSE.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...51:T11b6,Found string "\\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00007752-00002716-3251970572") Found string "%PROGRAMFILES%\(x86)\Adobe\WmiPrvSE.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00007752-00000BC1-3254097511") Found string ""%PROGRAMFILES%\(x86)\Adobe\WmiPrvSE.exe"" (Indicator: "wmiprvse.exe"; in Source: "00000000-00007752-00000C47-14446890439") Found string "WmiPrvSE.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00005128-00000BC0-3254416248") Found string "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\WmiPrvSE.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00005128-00000BC0-3259803458") Found string ""%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\WmiPrvSE.exe" -" (Indicator: "wmiprvse.exe"; in Source: "00000000-00005128-00000C47-12785700278") Found string "%PROGRAMFILES%\Google\Chrome\Application\WmiPrvSE.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00005128-00000C47-28012066228") Found string ""%PROGRAMFILES%\Google\Chrome\Application\WmiPrvSE.exe" -" (Indicator: "wmiprvse.exe"; in Source: "00000000-00005128-00000C47-28012066228") Found string "C:\Program Files\Google\Chrome\Application\WmiPrvSE.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00000312.00000000.277562.03A10000.00000004.mdmp, 00000000-00000312.00000000.277562.06000000.00000004.mdmp, 00000000-00000312.00000000.277562.06100000.00000004.mdmp") Found string ""C:\Program Files\Google\Chrome\Application\WmiPrvSE.exe" -" (Indicator: "wmiprvse.exe"; in Source: "00000000-00000312.00000000.277562.03A10000.00000004.mdmp, 00000000-00000312.00000000.277562.06100000.00000004.mdmp") Found string "C:\WINDOWS\Temp\AslLog_ApphelpDebug_WmiPrvSE.exe_312.txt" (Indicator: "wmiprvse.exe"; in Source: "00000000-00000312.00000000.277562.03A10000.00000004.mdmp") Found string ":\WINDOWS\Temp\AslLog_shimengstate_WmiPrvSE.exe_312.txt" (Indicator: "wmiprvse.exe"; in Source: "00000000-00000312.00000000.277562.03A10000.00000004.mdmp") Found string "C:\WINDOWS\Temp\AslLog_ShimDebugLog_WmiPrvSE.exe_312.txt" (Indicator: "wmiprvse.exe"; in Source: "00000000-00000312.00000000.277562.03A10000.00000004.mdmp") Found string "C:\WINDOWS\Temp\AslLog_DetectorsTrace_WmiPrvSE.exe_312.txt" (Indicator: "wmiprvse.exe"; in Source: "00000000-00000312.00000000.277562.03A10000.00000004.mdmp") Found string "Device\HarddiskVolume2\Program Files\Google\Chrome\Application\WmiPrvSE.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00000312.00000000.277562.03A10000.00000004.mdmp") Found string ":\Program Files\Google\Chrome\Application\WmiPrvSE.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00000312.00000000.277562.03A10000.00000004.mdmp") Found string "" (Indicator: "wmiprvse.exe"; in Source: "00000000-00000312.00000000.277562.03A10000.00000004.mdmp") Found string "WmiPrvSE.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00000312.00000000.277562.06000000.00000004.mdmp") Found string "C:\Program Files (x86)\Microsoft\Edge\Application\WmiPrvSE.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00004840.00000000.277160.00A20000.00000004.mdmp, 00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found string ""C:\Program Files (x86)\Microsoft\Edge\Application\WmiPrvSE.exe" -" (Indicator: "wmiprvse.exe"; in Source: "00000000-00004840.00000000.277160.00A20000.00000004.mdmp, 00000000-00004840.00000000.277160.05C00000.00000004.mdmp") Found string "C:\WINDOWS\Temp\AslLog_ApphelpDebug_WmiPrvSE.exe_4840.txt" (Indicator: "wmiprvse.exe"; in Source: "00000000-00004840.00000000.277160.00A20000.00000004.mdmp") Found string "C:\WINDOWS\Temp\AslLog_shimengstate_WmiPrvSE.exe_4840.txt" (Indicator: "wmiprvse.exe"; in Source: "00000000-00004840.00000000.277160.00A20000.00000004.mdmp") Found string "C:\WINDOWS\Temp\AslLog_ShimDebugLog_WmiPrvSE.exe_4840.txt" (Indicator: "wmiprvse.exe"; in Source: "00000000-00004840.00000000.277160.00A20000.00000004.mdmp") Found string "n\WmiPrvSE.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00004840.00000000.277160.00A20000.00000004.mdmp") Found string "C:\WINDOWS\Temp\AslLog_DetectorsTrace_WmiPrvSE.exe_4840.txt" (Indicator: "wmiprvse.exe"; in Source: "00000000-00004840.00000000.277160.00A20000.00000004.mdmp")52:T4d2,"WmiPrvSE.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\GUARDA\LOCAL STORAGE\LEVELDB" "WmiPrvSE.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\COINOMI\COINOMI\WALLETS" "WmiPrvSE.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\EXODUS\EXODUS.WALLET" "WmiPrvSE.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\ETHEREUM\KEYSTORE" "WmiPrvSE.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\ELECTRUM\WALLETS" "WmiPrvSE.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\ATOMIC\LOCAL STORAGE\LEVELDB" "WmiPrvSE.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Roaming\COM.LIBERTY.JAXX\INDEXEDDB\FILE__0.INDEXEDDB.LEVELDB" "WmiPrvSE.exe" trying to touch file "%APPDATA%\GUARDA\LOCAL STORAGE\LEVELDB" "WmiPrvSE.exe" trying to touch file "%APPDATA%\COINOMI\COINOMI\WALLETS" "WmiPrvSE.exe" trying to touch file "%APPDATA%\EXODUS\EXODUS.WALLET" "WmiPrvSE.exe" trying to touch file "%APPDATA%\ETHEREUM\KEYSTORE" "WmiPrvSE.exe" trying to touch file "%APPDATA%\ELECTRUM\WALLETS" "WmiPrvSE.exe" trying to touch file "%APPDATA%\ATOMIC\LOCAL STORAGE\LEVELDB" "WmiPrvSE.exe" trying to touch file "%APPDATA%\COM.LIBERTY.JAXX\INDEXEDDB\FILE__0.INDEXEDDB.LEVELDB"53:T9e5,"WmiPrvSE.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA\WEB DATA" "WmiPrvSE.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\BRAVESOFTWARE\BRAVE-BROWSER\USER DATA" "WmiPrvSE.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\WEB DATA" "WmiPrvSE.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Local State" "WmiPrvSE.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Last Browser" "WmiPrvSE.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies" "WmiPrvSE.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "WmiPrvSE.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Web Data" "WmiPrvSE.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FCCKKDBJNOIKOOEDEDLAPCALPIONMALO" "WmiPrvSE.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\CMNDJBECILBOCJFKIBFBIFHNGKDMJGOG" "WmiPrvSE.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FIHKAKFOBKMKJOJPCHPFGCMHFJNMNFPI" "WmiPrvSE.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\HPGLFHGFNHBGPJDENJGMDGOEIAPPAFLN" "WmiPrvSE.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FNNEGPHLOBJDPKHECAPKIJJDKGCJHKIB" "WmiPrvSE.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\CJELFPLPLEBDJJENLLPJCBLMJKFCFFNE" "WmiPrvSE.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AFBCBJPBPFADLKMHMCLHKEEODMAMCFLC" "WmiPrvSE.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\HNFANKNOCFEOFBDDGCIJNMHNFNKDNAAD" "WmiPrvSE.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\BFNAELMOMEIMHLPMGJNJOPHHPKKOLJPA" "WmiPrvSE.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FFNBELFDOEIOHENKJIBNMADJIEHJHAJB"54:T11b3,WmiPrvSE.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FIHKAKFOBKMKJOJPCHPFGCMHFJNMNFPI related to BitApp Wallet WmiPrvSE.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\HPGLFHGFNHBGPJDENJGMDGOEIAPPAFLN related to Guarda WmiPrvSE.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\CJELFPLPLEBDJJENLLPJCBLMJKFCFFNE related to Jaxx Liberty WmiPrvSE.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AFBCBJPBPFADLKMHMCLHKEEODMAMCFLC related to Math Wallet WmiPrvSE.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\HNFANKNOCFEOFBDDGCIJNMHNFNKDNAAD related to Coinbase Wallet WmiPrvSE.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\BFNAELMOMEIMHLPMGJNJOPHHPKKOLJPA related to Phantom WmiPrvSE.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FFNBELFDOEIOHENKJIBNMADJIEHJHAJB related to Yoroi WmiPrvSE.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\OOKJLBKIIJINHPMNJFFCOFJONBFBGAOC related to Temple WmiPrvSE.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\OPCGPFMIPIDBGPENHMAJOAJPBOBPPDIL related to Sui Wallet WmiPrvSE.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\MCOHILNCBFAHBMGDJKBPEMCCIIOLGCGE related to OKX Wallet WmiPrvSE.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AEACHKNMEFPHEPCCIONBOOHCKONOEEMG related to Coin98 Wallet) WmiPrvSE.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NLBMNNIJCNLEGKJJPCFJCLMCFGGFEFDM related to MEW CX WmiPrvSE.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FHMFENDGDOCMCBMFIKDCOGOFPHIMNKNO related to Sollet WmiPrvSE.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NANJMDKNHKINIFNKGDCGGCFNHDAAMMMJ related to GuildWallet WmiPrvSE.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\JBDAOCNEIIINMJBJLGALHCELGBEJMNID related to Nifty Wallet WmiPrvSE.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\BHGHOAMAPCDPBOHPHIGOOOADDINPKBAI related to Authenticator WmiPrvSE.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\KPFOPKELMAPCOIPEMFENDMDCGHNEGIMN related to Liquality Wallet WmiPrvSE.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\EJBALBAKOPLCHLGHECDALMEEEAJNIMHM related to MetaMask WmiPrvSE.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\NKDDGNCDJGJFCDDAMFGCMFNLHCCNIMIG related to Saturn Wallet WmiPrvSE.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\KNCCHDIGOBGHENBBADDOJJNNAOGFPPFJ related to iWallet WmiPrvSE.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\MFGCCJCHIHFKKINDFPPNAOOECGFNEIII related to TokenPocket WmiPrvSE.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\EGJIDJBPGLICHDCONDBCBDNBEEPPGDPH related to Trust Wallet WmiPrvSE.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\FHBOHIMAELBOHPJBBLDCNGCNAPNDODJP related to Binance Chain Wallet WmiPrvSE.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\IBNEJDFJMMKPCNLPEBKLMNKOEOIHOFEC related to TronLink WmiPrvSE.exe trying to open a file C:\Users\%OSUSER%\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\AMKMJJMMFLDDOGMHPJLOIMIPBOFNFJIH related to Wombat1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"8b94f5fa94f35e5ba47ce260b009b34401c5c54042d7b7252c8c7d13bf8d9f05","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790483762892,"unified_at":"2026-09-27T04:36:02.892Z","metadata":{"hashes":{"sha256":"8b94f5fa94f35e5ba47ce260b009b34401c5c54042d7b7252c8c7d13bf8d9f05","sha1":"13ae04a3c0b2f716f64e4be323b16c2ee3982d46","md5":"276ff69704019d7b8491059ea9445a81","sha512":"30c76cd81a096b20b60910f2a01df431b16fbd223dce8ee7b3e31d4d7881f0e983e9c0b2ce110d6920b307aa9ccac3f501b0759c64b4fd867f5ced2400d768b3","ssdeep":"98304:hTCKoTRXrig5ns0eggiXCqNaWdL+GvbtFz:hOXTRXrVsvglSqEWldbHz","ssdeep_chunks":["98304:hTCKoTR","98304:TCKoTRX","98304:CKoTRXr","98304:KoTRXri","98304:oTRXrig","98304:TRXrig5","98304:RXrig5n","98304:Xrig5ns","98304:rig5ns0","98304:ig5ns0e","98304:g5ns0eg","98304:5ns0egg","98304:ns0eggi","98304:s0eggiX","98304:0eggiXC","98304:eggiXCq","98304:ggiXCqN","98304:giXCqNa","98304:iXCqNaW","98304:XCqNaWd","98304:CqNaWdL","98304:qNaWdL+","98304:NaWdL+G","98304:aWdL+Gv","98304:WdL+Gvb","98304:dL+Gvbt","98304:L+GvbtF","98304:+GvbtFz","196608:hTCKoTR","196608:TCKoTRX","196608:CKoTRXr","196608:KoTRXri","196608:oTRXrig","196608:TRXrig5","196608:RXrig5n","196608:Xrig5ns","196608:rig5ns0","196608:ig5ns0e","196608:g5ns0eg","196608:5ns0egg","196608:ns0eggi","196608:s0eggiX","196608:0eggiXC","196608:eggiXCq","196608:ggiXCqN","196608:giXCqNa","196608:iXCqNaW","196608:XCqNaWd","196608:CqNaWdL","196608:qNaWdL+","196608:NaWdL+G","196608:aWdL+Gv","196608:WdL+Gvb","196608:dL+Gvbt","196608:L+GvbtF","196608:+GvbtFz","98304:hOXTRXr","98304:OXTRXrV","98304:XTRXrVs","98304:TRXrVsv","98304:RXrVsvg","98304:XrVsvgl","98304:rVsvglS","98304:VsvglSq","98304:svglSqE","98304:vglSqEW","98304:glSqEWl","98304:lSqEWld","98304:SqEWldb","98304:qEWldbH","98304:EWldbHz"],"imphash":"6ed4f5f04d62b18d96b26d6db7c18840"},"file_info":{"file_name":"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":3288576,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1754396742000,"last_seen":1777514461000,"last_multi_scan":1777514461000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["salatstealer","wacatac","sabsik","evasive","windows-server-utility","infostealer"]},"stats":{"av":{"malicious_count":15,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":82},"sandbox_signatures":{"informative_count":151,"suspicious_count":23,"malicious_count":13,"total":187},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Banker]/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/AD.GenSteal.bbymi","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Genie.8DN.1350","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Genie.8DN.1350 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of WinGo/Agent_AGen.QU trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005ce1d91 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"Malicious","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/Salat-A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Agent.KKL.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.YIM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.4307746","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Genie.8DN.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Recently renewed or created SSL certificate"},{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Executes WMI queries"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Execution","technique":"Scheduled Task/Job","attack_id":"T1053","attack_id_wiki":"https://attack.mitre.org/techniques/T1053","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"malicious","value":"Loads the task scheduler COM API"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"},{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Intercepted relevant COM error"},{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","identifiers":[{"type":"suspicious","value":"Tries to save executable or command in registry"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Defense Evasion","technique":"Web Session Cookie","attack_id":"T1550.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1550/004","identifiers":[{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Marks file for deletion"},{"type":"suspicious","value":"Process deletes itself"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"suspicious","value":"Deletes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file is packed with UPX"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"malicious","value":"Attempts to obtain browser login credentials (file access)"},{"type":"informative","value":"References Firefox browser credentials files"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes that are not known child processes"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"malicious","value":"Checks for files associated with bitcoin mining software"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Identified known pipe name"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"},{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Queries the display settings of system associated file extensions"},{"type":"malicious","value":"Tries to steal Crypto currency wallets information (file access)"},{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"malicious","value":"Tries to steal crypto wallet extension (file access)"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","identifiers":[{"type":"informative","value":"Found domain strings related to cloud services(possible C&C communication)"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"},{"type":"suspicious","value":"Sends UDP traffic"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"GETs files from a web server (PE files)"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"WmiPrvSE.exe\" called \"RemoveDirectoryW\" with parameter masterkey_db (UID: 00000000-00005128)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; Source: \"00000000-00000312.00000000.277562.06000000.00000004.mdmp\")\n Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; Source: \"00000000-00004840.00000000.277160.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000312.00000000.277562.06000000.00000004.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004840.00000000.277160.05C00000.00000004.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004840.00000000.277160.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00000312.00000000.277562.03A10000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004840.00000000.277160.00A20000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005128.00000000.276808.03660000.00000004.mdmp, 00000000-00005128.00000001.278728.03660000.00000004.mdmp, 00000000-00005128.00000002.280646.03660000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007752.00000000.276410.03910000.00000004.mdmp, 00000000-00007752.00000001.276494.03910000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$27","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\root\\cimv2; Source: \"00000000-00007752-00002716-3251970572\")\n Found string - \\.\\root\\cimv2; Source: \"00000000-00005128.00000000.276808.036D1000.00000004.mdmp\")\n Found string - \\.\\root\\cimv2; Source: \"00000000-00007752.00000000.276410.03984000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$28","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$29","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00005128-00000C2C-3259348099\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2a","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.99991","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Found Crypto currency wallets related strings\n Matched sigs: Tries to steal crypto wallet extension (string)\n Matched sigs: Able to access crypto wallet extension (string)\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Tries to steal Crypto currency wallets information (file access)\n Matched sigs: Calls an API typically used to decrypt the data\n Matched sigs: Tries to steal crypto wallet extension (file access)\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2b","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"github.com/ncruces/go-sqlite3.Pointer\" (Indicator: \"github.com\"; Source: \"00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007752-00000C2C-3249527659\")\n Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00007752-00000C2C-3253055057\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000312.00000000.277562.06100000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004840.00000000.277160.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ICOUNTRY\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007752.00000000.276410.03984000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00007752-00000C2C-3250042127\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetMonitorInfoW\" in \"00000000-00000312.00000000.277562.06000000.00000004.mdmp\"\n Found system information discovery API: \"GetMonitorInfoW\" in \"00000000-00004840.00000000.277160.05C00000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00000312.00000000.277562.03A10000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00004840.00000000.277160.00A20000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00005128.00000000.276808.03660000.00000004.mdmp, 00000000-00005128.00000001.278728.03660000.00000004.mdmp, 00000000-00005128.00000002.280646.03660000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007752.00000000.276410.03910000.00000004.mdmp, 00000000-00007752.00000001.276494.03910000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007752)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00007752)\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" called \"Process32FirstW\" with parameters (UID: 00000000-00007752)\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" called \"Process32NextW\" with parameters (UID: 00000000-00007752)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007752)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" called \"GetForegroundWindow\" (UID: 00000000-00007752)\n \"WmiPrvSE.exe\" called \"GetForegroundWindow\" (UID: 00000000-00005128)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"WmiPrvSE.exe\" called \"IsWow64Process\" with parameter \"5128\" - (UID: 00000000-00005128)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"WmiPrvSE.exe\" called \"EnumWindows\" with parameter \"57333324\" - (UID: 00000000-00005128)\n \"WmiPrvSE.exe\" called \"EnumWindows\" with parameter \"57334732\" - (UID: 00000000-00005128)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" called \"GetWindowTextW\" (UID: 00000000-00007752)\n \"WmiPrvSE.exe\" called \"GetWindowTextW\" (UID: 00000000-00005128)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007752)\n \"WmiPrvSE.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00005128)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2d","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00007752)\n \"WmiPrvSE.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00005128)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"select * from Win32_OperatingSystem\" (Indicator: \"select * from \"; Source: \"00000000-00007752-00002717-3252731308\")\n Found string \"SELECT * FROM %Q.%Q\" (Indicator: \"select * from \"; Source: \"00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp\")\n Found string \"SELECT * FROM \"%w\".\"%w_rowid\" WHERE rowid=?1\" (Indicator: \"select * from \"; Source: \"00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp\")\n Found string \"SELECT * FROM %Q.'%q_rowid'\" (Indicator: \"select * from \"; Source: \"00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"WmiPrvSE.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"WmiPrvSE.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"81556311657,6240,109,,GetWindowTextW,user32.dll,\"01:12:34.234\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005128.00000001.278728.03660000.00000004.mdmp\")\n Found reference to API \"74348766757,7884,109,,GetWindowTextW,user32.dll,\"01:12:31.234\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005128.00000001.278728.036A0000.00000004.mdmp\")\n Found reference to API \"146548108776,6240,109,,GetWindowTextW,user32.dll,\"01:13:01.312\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005128.00000002.280646.03660000.00000004.mdmp\")\n Found reference to API \"153784717000,6240,109,,GetWindowTextW,user32.dll,\"01:13:04.328\",RX=0,PX=0\" (Indicator: \"GetWindowText\"; Source: \"00000000-00005128.00000002.280646.036A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"14445835025,3808,3024,,RtlGetVersion,NTDLL.dll,\"01:12:00.093\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00007752.00000001.276494.03953000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" issued a query \"select TotalPhysicalMemory from Win32_ComputerSystem\"\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" issued a query \"Select Name from Win32_VideoController\"\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" issued a query \"select * from Win32_OperatingSystem\"\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" issued a query \"select Name from Win32_Processor\"\n \"WmiPrvSE.exe\" issued a query \"select * from Win32_OperatingSystem\"\n \"WmiPrvSE.exe\" issued a query \"Select Name from Win32_VideoController\"\n \"WmiPrvSE.exe\" issued a query \"select TotalPhysicalMemory from Win32_ComputerSystem\"\n \"WmiPrvSE.exe\" issued a query \"select Name from Win32_Processor\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$2f","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"WmiPrvSE.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"WmiPrvSE.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"WmiPrvSE.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"select Name from Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00007752-00002717-3252377505\")\n Found string \"instance of Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00005128.00000000.276808.036A4000.00000004.mdmp\")\n Found string \"\"instance of Win32_Processor{DeviceID = 'CPU0';Name = 'Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz';};\",\"instance of Win32_Processor{DeviceID = 'CPU1';Name = 'Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz';};\"\" (Indicator: \" Win32_Process\"; Source: \"00000000-00005128.00000000.276808.036A4000.00000004.mdmp\")\n Found string \"\"instance of Win32_Processor{DeviceID = 'CPU0';Name = 'Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz';};\",\"instance of Win32_Processor{DeviceID = 'CPU1';Name = 'Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz';};\"\" (Indicator: \" Win32_Process\"; Source: \"00000000-00007752.00000001.276494.03953000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineW\" (Source: \"00000000-00000312.00000000.277562.06100000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00004840.00000000.277160.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Adobe\\WmiPrvSE.exe\"\" - (UID: 00000000-00007752)\n \"WmiPrvSE.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\WmiPrvSE.exe\" -\" - (UID: 00000000-00005128)\n \"WmiPrvSE.exe\" called \"CreateProcessW\" with parameter \"\"%PROGRAMFILES%\\Google\\Chrome\\Application\\WmiPrvSE.exe\" -\" - (UID: 00000000-00005128)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"WmiPrvSE.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00005128)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$31","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"edge-consumer-static.azureedge.net\"\n \"clients2.googleusercontent.com\"\n \"edgeassetservice.azureedge.net\"\n \"www.googleapis.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.21.81.197:443\"\n \"13.35.78.54:443\"\n \"13.107.253.51:443\"\n \"142.251.218.65:443\"\n \"172.217.12.106:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$32","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"14446890439,3808,3143,,CreateProcessW,kernel32.dll,\"01:12:00.093\",RX=0,PX=0\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007752.00000001.276494.03953000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00000312.00000000.277562.06000000.00000004.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00004840.00000000.277160.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00000312.00000000.277562.06000000.00000004.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004840.00000000.277160.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: OSPPSVC.EXE)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$33","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00000312.00000000.277562.06100000.00000004.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004840.00000000.277160.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$34","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$35","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"OSPPSVC.EXE\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"putin@kremlin.ru\"\n Pattern match: \"chambersroot@chambersign.org\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$36","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"github.com/ncruces/go-sqlite3.Pointer\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$37","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Intercepted relevant COM error","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" called \"Schedule.Service.1(\"GetFolder\").GetTask\"\n which returned the status code \"80020009\" (The system cannot locate the resource specified) ...\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" called \"Schedule.Service.1(\"GetFolder\").RegisterTaskDefinition\"\n which returned the status code \"80020009\" (The system cannot locate the resource specified) ...","origin":"API Call","mitre_attack_id":"T1546.015","relevance":10,"id":"api-67","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$38","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76330000\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72CC0000\n \"WmiPrvSE.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 76330000\n \"WmiPrvSE.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72CC0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76260000\n \"WmiPrvSE.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76260000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"$39","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" was detected as \"UPX\" and name: \"Packer\"\n \"OSPPSVC.EXE\" was detected as \"UPX\" and name: \"Packer\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" has an executable section named \"UPX0\"\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" has an executable section named \"UPX1\"\n \"OSPPSVC.EXE\" has an executable section named \"UPX0\"\n \"OSPPSVC.EXE\" has an executable section named \"UPX1\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" has an writable section named \"UPX0\"\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" has an writable section named \"UPX1\"\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" has an writable section named \"UPX2\"\n \"OSPPSVC.EXE\" has an writable section named \"UPX0\"\n \"OSPPSVC.EXE\" has an writable section named \"UPX1\"\n \"OSPPSVC.EXE\" has an writable section named \"UPX2\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$3b","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \"UPX1\" is \"0x322a00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \"UPX0\" is \"0x865000\" greater than 0x100000\n Virtual size of \"UPX1\" is \"0x323000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"$3c","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"clients2.googleusercontent.com\"\n \"edgeassetservice.azureedge.net\"\n \"sb.scorecardresearch.com\"\n \"www.googleapis.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$3d","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$3e","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$3f","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$40","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"OSPPSVC.EXE\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00000312.00000000.277562.06000000.00000004.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004840.00000000.277160.05C00000.00000004.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00004840.00000000.277160.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"WmiPrvSE.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"OSPPSVC.EXE\" has type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections\"- Location: [%PROGRAMFILES%\\(x86)\\Windows Multimedia Platform\\OSPPSVC.EXE]- [targetUID: 00000000-00007752]\n \"WmiPrvSE.exe\" has type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections\"- Location: [%PROGRAMFILES%\\Google\\Chrome\\Application\\WmiPrvSE.exe]- [targetUID: 00000000-00000312]\n \"WmiPrvSE.exe\" has type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections\"- Location: [%PROGRAMFILES%\\(x86)\\Adobe\\WmiPrvSE.exe]- [targetUID: 00000000-00000312]\n \"WmiPrvSE.exe\" has type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections\"- Location: [%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\WmiPrvSE.exe]- [targetUID: 00000000-00000312]\n \"csrss.exe\" has type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections\"- Location: [%PROGRAMFILES%\\(x86)\\Google\\csrss.exe]- [targetUID: 00000000-00007752]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$41","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" queries basic process information of the \"C:\\SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" (UID: 7752)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$42","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" reads file \"\\device\\namedpipe\\wkssvc\"\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" reads file \"c:\\windows\\syswow64\\wbem\\wbemdisp.tlb\"\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" reads file \"c:\\windows\\syswow64\\stdole2.tlb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" trying to touch file \"C:\\SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\"\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" trying to touch file \"C:\\Windows\\Temp\\VxSSL32.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" touched file \"C:\\Program Files (x86)\\Google\\f248d74e-5558-0bdf-d109-a68d9b924e55\"\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" touched file \"C:\\Program Files (x86)\\Google\\csrss.exe\"\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" touched file \"C:\\Program Files (x86)\\Windows Multimedia Platform\\f248d74e-5558-0bdf-d109-a68d9b924e55\"\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" touched file \"C:\\Program Files (x86)\\Windows Multimedia Platform\\OSPPSVC.EXE\"\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" touched file \"C:\\Program Files (x86)\\Adobe\\f248d74e-5558-0bdf-d109-a68d9b924e55\"\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" touched file \"C:\\Program Files (x86)\\Adobe\\WmiPrvSE.exe\"\n \"WmiPrvSE.exe\" touched file \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\WmiPrvSE.exe\"\n \"WmiPrvSE.exe\" touched file \"C:\\Program Files\\Google\\Chrome\\Application\\WmiPrvSE.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$43","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" writes file \"\\device\\namedpipe\\wkssvc\"\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" writes file \"c:\\program files (x86)\\google\\csrss.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00007752-00000C2C-3249732460\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00000312.00000000.277562.06000000.00000004.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00004840.00000000.277160.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00007752-00000C2C-3249876505\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /mouse-gesture/config.json\"\n Found http requests in header \"GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx\"\n Found http requests in header \"GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService\"\n Found http requests in header \"POST /chromewebstore/v1.1/items/verify\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00000312.00000000.277562.06000000.00000004.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00004840.00000000.277160.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00007752-00000C2C-3249510082\")\n Found reference to API \"WSARecvFrom\" (Indicator: \"WSARecv\"; Source: \"00000000-00007752-00000C2C-3250173864\")\n Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; Source: \"00000000-00007752-00000C2C-3250204165\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00000312.00000000.277562.06000000.00000004.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00004840.00000000.277160.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00007752-00000C2C-3249510082\")\n Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00000312.00000000.277562.06000000.00000004.mdmp\")\n Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00004840.00000000.277160.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Network Related","name":"Found domain strings related to cloud services(possible C&C communication)","description":"Found string \"www.googleapis.com\" (Indicator: \".googleapis.com\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1102","relevance":1,"id":"string-186","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"\n \"2.5.29.14\"\n \"2.5.29.15\"\n \"2.5.29.19\"\n \"2.5.29.35\"\n \"2.5.29.32\"\n \"2.5.29.31\"\n \"2.5.29.16\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$45","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$46","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"$47","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$48","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"clients2.googleusercontent.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Network Related","name":"Identified known pipe name","description":"Found pipe name string \"\\PIPE\\wkssvc\" (Source: \"00000000-00007752-00000CCE-3251628294\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":3,"id":"string-735","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 1fc1c530fdab845a0a2b05d0b5335bcb","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"edgeassetservice.azureedge.net\" (0 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://edge-consumer-static.azureedge.net/mouse-gesture/config.json\n Found HTTPS GET request to https://clients2.googleusercontent.com/crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx\n Found HTTPS GET request to https://edgeassetservice.azureedge.net/assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService\n Found HTTPS POST request to https://www.googleapis.com/chromewebstore/v1.1/items/verify","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"clients2.googleusercontent.com\" (83 days old)\n Short term registered certificate: \"www.googleapis.com\" (83 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"104.21.81.197\" on port \"443\"\n HTTPS traffic to \"13.35.78.54\" on port \"443\"\n HTTPS traffic to \"13.107.253.51\" on port \"443\"\n HTTPS traffic to \"142.251.218.65\" on port \"443\"\n HTTPS traffic to \"172.217.12.106\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$49","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00000312.00000000.277562.03A10000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00005128.00000001.278728.03660000.00000004.mdmp, 00000000-00005128.00000002.280646.03660000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--profile-directory=Default\" (Indicator: \"--profile-directory=\"; File: \"msedge.exe\")","origin":"File/Memory","mitre_attack_id":"T1550.004","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"14445835025,3808,3024,,RtlGetVersion,NTDLL.dll,\"01:12:00.093\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007752.00000001.276494.03953000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in \"00000000-00000312.00000000.277562.06000000.00000004.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00000312.00000000.277562.06000000.00000004.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00004840.00000000.277160.05C00000.00000004.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00004840.00000000.277160.05C00000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"WmiPrvSE.exe\" tries to directly access volume data \"Z:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"\"WmiPrvSE.exe\" called \"FindFirstFileW\" with parameter %LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Network (UID: 00000000-00005128)\n \"WmiPrvSE.exe\" called \"FindFirstFileW\" with parameter %LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default (UID: 00000000-00005128)\n \"WmiPrvSE.exe\" called \"FindFirstFileW\" with parameter %LOCALAPPDATA%\\Microsoft\\Edge\\User Data (UID: 00000000-00005128)\n \"WmiPrvSE.exe\" called \"FindFirstFileW\" with parameter %LOCALAPPDATA%\\Microsoft\\Edge (UID: 00000000-00005128)\n \"WmiPrvSE.exe\" called \"FindFirstFileW\" with parameter %LOCALAPPDATA%\\Microsoft (UID: 00000000-00005128)\n \"WmiPrvSE.exe\" called \"FindFirstFileW\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00005128)\n \"WmiPrvSE.exe\" called \"FindFirstFileW\" with parameter %USERPROFILE%\\AppData (UID: 00000000-00005128)\n \"WmiPrvSE.exe\" called \"FindFirstFileW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00005128)\n \"WmiPrvSE.exe\" called \"FindFirstFileW\" with parameter C:\\Users (UID: 00000000-00005128)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}\n \"WmiPrvSE.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"WmiPrvSE.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" called \"GetComputerNameW\" (UID: 00000000-00007752)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"base64 accepts only blob or text\" (Indicator: \"base64\"; Source: \"00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp\")\n Found string \"blob from base64 may be too big\" (Indicator: \"base64\"; Source: \"00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp\")\n Found string \"blob expanded to base64 too big\" (Indicator: \"base64\"; Source: \"00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp\")\n Found string \"base64 OOM\" (Indicator: \"base64\"; Source: \"00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp\")\n Found string \"base64\" (Indicator: \"base64\"; Source: \"00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$4b","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00000312.00000000.277562.06000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00000312.00000000.277562.06000000.00000004.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004840.00000000.277160.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00000312.00000000.277562.06000000.00000004.mdmp\")\n Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00004840.00000000.277160.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"WHERE rowid=?\" (Indicator: \"where \"; Source: \"00000000-00005128.00000001.278728.271C0000.00000004.mdmp, 00000000-00005128.00000001.278728.291C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00000312.00000000.277562.06000000.00000004.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004840.00000000.277160.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00000312.00000000.277562.06000000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004840.00000000.277160.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00004840.00000000.277160.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"Win32API|GetSystemMetrics|SM_DEBUG\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00007752.00000000.276410.03984000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000312.00000000.277562.06100000.00000004.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004840.00000000.277160.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"\"??\\c:\\users\\hapubws\\appdata\\roaming\\thunderbird\\profiles\" in Source: 00000000-00005128.00000001.278728.03660000.00000004.mdmp\n 00000000-00005128.00000002.280646.03660000.00000004.mdmp\n \"??\\C:\\Users\\HAPUBWS\\AppData\\Roaming\\Thunderbird\\Profiles\" in Source: 00000000-00005128.00000001.278728.036A0000.00000004.mdmp\n 00000000-00005128.00000002.280646.036A0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"Found string \"??\\C:\\Users\\HAPUBWS\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\ywzu7870.default\\key4.db\" (Indicator: \"key4.db\"; in Source: \"00000000-00005128.00000001.278728.036A0000.00000004.mdmp, 00000000-00005128.00000002.280646.036A0000.00000004.mdmp\")\n Found string \"??\\c:\\users\\hapubws\\appdata\\roaming\\mozilla\\firefox\\profiles\\ywzu7870.default\\key4.db\" (Indicator: \"key4.db\"; in Source: \"00000000-00005128.00000001.278728.036A0000.00000004.mdmp, 00000000-00005128.00000002.280646.036A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":1,"id":"string-405","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00000312.00000000.277562.06100000.00000004.mdmp\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00004840.00000000.277160.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00000312.00000000.277562.06000000.00000004.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"InitializeSid\"; Source: \"00000000-00000312.00000000.277562.06000000.00000004.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00000312.00000000.277562.06100000.00000004.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00004840.00000000.277160.05C00000.00000004.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"InitializeSid\"; Source: \"00000000-00004840.00000000.277160.05C00000.00000004.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00004840.00000000.277160.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"WmiPrvSE.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" opened \"\\Device\\KsecDD\"\n \"WmiPrvSE.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$4f","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00000312.00000000.277562.06000000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" was detected as \"UPX -> www.upx.sourceforge.net\"\n \"OSPPSVC.EXE\" was detected as \"UPX -> www.upx.sourceforge.net\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"ApplicationFrameHost.exeRuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"backgroundTaskHost.exe\" (Indicator: \"backgroundtaskhost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"WmiPrvSE.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Process deletes itself","description":"\"%PROGRAMFILES%\\(x86)\\Adobe\\WmiPrvSE.exe\" deletes itself","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-27","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Tries to save executable or command in registry","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"CSRSS\"; Value: \"%PROGRAMFILES%\\(x86)\\Google\\csrss.exe\"), \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"OSPPSVC\"; Value: \"%PROGRAMFILES%\\(x86)\\Windows Multimedia Platform\\OSPPSVC.EXE\"), \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"WMIPRVSE\"; Value: \"%PROGRAMFILES%\\(x86)\\Adobe\\WmiPrvSE.exe\")","origin":"Registry Access","mitre_attack_id":"T1547","relevance":7,"id":"registry-113","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" has a section named \"UPX0\"\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" has a section named \"UPX1\"\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" has a section named \"UPX2\"\n \"OSPPSVC.EXE\" has a section named \"UPX0\"\n \"OSPPSVC.EXE\" has a section named \"UPX1\"\n \"OSPPSVC.EXE\" has a section named \"UPX2\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" has section name UPX1 with entropy \"7.9999360724553705\"\n \"OSPPSVC.EXE\" has section name UPX1 with entropy \"7.9999360724553705\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%PROGRAMFILES%\\(x86)\\Windows Multimedia Platform\\OSPPSVC.EXE\" has high entropy 7.99991\n Dropped file \"%PROGRAMFILES%\\Google\\Chrome\\Application\\WmiPrvSE.exe\" has high entropy 7.99991\n Dropped file \"%PROGRAMFILES%\\(x86)\\Adobe\\WmiPrvSE.exe\" has high entropy 7.99991\n Dropped file \"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\WmiPrvSE.exe\" has high entropy 7.99991\n Dropped file \"%PROGRAMFILES%\\(x86)\\Google\\csrss.exe\" has high entropy 7.99991","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"14/27 Antivirus vendors marked sample as malicious (51% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"\"POST /chromewebstore/v1.1/items/verify HTTP/2\nHost: www.googleapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nContent-Type: application/json\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty\" with payload::==> \"{\"hash\":\"ifo2Iqi9nASjh5w8FI6djINbtL97c3K6v9uRx8Trm8Q=\",\"ids\":[\"ghbmnnjooekpmoecnnnilnnbdlolhkhi\"],\"protocol_version\":1}\" HTTP/2 200 OK\nContent-Type: application/json; charset=UTF-8\nDate: Thu\n 30 Apr 2026 02:03:57 GMT\nServer: ESF\nX-Xss-Protection: 0\nX-Content-Type-Options: nosniff\nVary: Referer\nContent-Encoding: gzip\nX-Frame-Options: SAMEORIGIN\nAlt-Svc: h3=\":443\"; ma=2592000\nh3-29=\":443\"; ma=2592000 with response body ==>BINARY_CONTENT.......","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"WmiPrvSE.exe\" reads file \"C:\\Program Files (x86)\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 104.21.81.197\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":1,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"OSPPSVC.EXE\" has type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections\"- Location: [%PROGRAMFILES%\\(x86)\\Windows Multimedia Platform\\OSPPSVC.EXE]- [targetUID: 00000000-00007752]\n \"WmiPrvSE.exe\" has type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections\"- Location: [%PROGRAMFILES%\\Google\\Chrome\\Application\\WmiPrvSE.exe]- [targetUID: 00000000-00000312]\n \"WmiPrvSE.exe\" has type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections\"- Location: [%PROGRAMFILES%\\(x86)\\Adobe\\WmiPrvSE.exe]- [targetUID: 00000000-00000312]\n \"WmiPrvSE.exe\" has type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections\"- Location: [%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\WmiPrvSE.exe]- [targetUID: 00000000-00000312]\n \"csrss.exe\" has type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections\"- Location: [%PROGRAMFILES%\\(x86)\\Google\\csrss.exe]- [targetUID: 00000000-00007752]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\")\n \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"CSRSS\"; Value: \"%PROGRAMFILES%\\(x86)\\Google\\csrss.exe\"), \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"OSPPSVC\"; Value: \"%PROGRAMFILES%\\(x86)\\Windows Multimedia Platform\\OSPPSVC.EXE\"), \"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"WMIPRVSE\"; Value: \"%PROGRAMFILES%\\(x86)\\Adobe\\WmiPrvSE.exe\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$50","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"UDP traffic to 104.21.81.197 on port 443","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE file \"sample.bin\"\n YARA signature for null IAT Directory of PE file \"WmiPrvSE.exe.3938472604\"\n YARA signature for null IAT Directory of PE file \"OSPPSVC.EXE.3817977655\"\n YARA signature for null IAT Directory of PE file \"WmiPrvSE.exe.2421238844\"\n YARA signature for null IAT Directory of PE file \"csrss.exe.1573068651\"\n YARA signature for null IAT Directory of PE file \"WmiPrvSE.exe.2463198251\"\n YARA signature for invalid Timestamp of PE file \"sample.bin\"\n YARA signature for invalid Timestamp of PE file \"WmiPrvSE.exe.3938472604\"\n YARA signature for invalid Timestamp of PE file \"OSPPSVC.EXE.3817977655\"\n YARA signature for invalid Timestamp of PE file \"WmiPrvSE.exe.2421238844\"\n YARA signature for invalid Timestamp of PE file \"csrss.exe.1573068651\"\n YARA signature for invalid Timestamp of PE file \"WmiPrvSE.exe.2463198251\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$51","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"WmiPrvSE.exe\" marked \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\WmiPrvSE.exe\" for deletion\n \"WmiPrvSE.exe\" marked \"C:\\Program Files\\Google\\Chrome\\Application\\WmiPrvSE.exe\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"WmiPrvSE.exe\" opened \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\WmiPrvSE.exe\" with delete access\n \"WmiPrvSE.exe\" opened \"C:\\masterkey_db\" with delete access\n \"WmiPrvSE.exe\" opened \"C:\\Program Files\\Google\\Chrome\\Application\\WmiPrvSE.exe\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"suspicious","category":"System Security","name":"Deletes registry keys","description":"\"WmiPrvSE.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\"; Key: \"REGFILESHASH\"; Value: \"\")\n \"WmiPrvSE.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\"; Key: \"REGFILES0000\"; Value: \"\")\n \"WmiPrvSE.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\"; Key: \"SEQUENCE\"; Value: \"\")\n \"WmiPrvSE.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\"; Key: \"SESSIONHASH\"; Value: \"\")\n \"WmiPrvSE.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\RESTARTMANAGER\\SESSION0000\"; Key: \"OWNER\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1070","relevance":3,"id":"registry-170","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"WmiPrvSE.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"ALWAYSSHOWEXT\")\n \"WmiPrvSE.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.EXE\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" has an entrypoint in section \"UPX1\"\n \"OSPPSVC.EXE\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"VirtualProtect\n LoadLibraryA\n GetProcAddress","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" claims program is from Thu Jan 1 00:00:00 1970\n \"OSPPSVC.EXE\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"14/27 Antivirus vendors marked sample as malicious (51% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"14/27 Antivirus vendors marked dropped file \"OSPPSVC.EXE\" as malicious (classified as \"Gen:Variant.Genie.8DN\" with 51% detection rate)\n 14/27 Antivirus vendors marked dropped file \"WmiPrvSE.exe\" as malicious (classified as \"Gen:Variant.Genie.8DN\" with 51% detection rate)\n 14/27 Antivirus vendors marked dropped file \"csrss.exe\" as malicious (classified as \"Gen:Variant.Genie.8DN\" with 51% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"14/27 Antivirus vendors marked spawned process \"WmiPrvSE.exe\" (PID: 5128) as malicious (classified as \"Gen:Variant.Genie.8DN\" with 51% detection rate)\n 14/27 Antivirus vendors marked spawned process \"WmiPrvSE.exe\" (PID: 4840) as malicious (classified as \"Gen:Variant.Genie.8DN\" with 51% detection rate)\n 14/27 Antivirus vendors marked spawned process \"WmiPrvSE.exe\" (PID: 312) as malicious (classified as \"Gen:Variant.Genie.8DN\" with 51% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 733B0000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe\" wrote 00000004 bytes to a remote process \"C:\\Program Files (x86)\\Adobe\\WmiPrvSE.exe\" (Handle: 1260)\n \"WmiPrvSE.exe\" wrote 00000004 bytes to a remote process \"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\WmiPrvSE.exe\" (Handle: 964)\n \"WmiPrvSE.exe\" wrote 00000004 bytes to a remote process \"C:\\Program Files\\Google\\Chrome\\Application\\WmiPrvSE.exe\" (Handle: 1308)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"malicious","category":"Ransomware/Banking","name":"Checks for files associated with bitcoin mining software","description":"\"WmiPrvSE.exe\" opened file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\BYTECOIN\"\n \"WmiPrvSE.exe\" opened file \"%APPDATA%\\BYTECOIN\"","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-46","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Attempts to obtain browser login credentials (file access)","description":"\"WmiPrvSE.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Edge\\User Data\\Default\\Login Data\"\n \"WmiPrvSE.exe\" trying to open a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\"\n \"WmiPrvSE.exe\" trying to open a file \"%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Default\\Login Data\"\n \"WmiPrvSE.exe\" trying to open a file \"%LOCALAPPDATA%\\Google\\Chrome\\User Data\\Default\\Login Data\"","origin":"API Call","mitre_attack_id":"T1555.003","relevance":10,"id":"api-281","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Observed sensitive data harvesting behavior","description":"Identified stealer based malicious activity","origin":"Indicator Combinations","relevance":7,"id":"summary-46","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal Crypto currency wallets information (file access)","description":"$52","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-101","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$53","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal crypto wallet extension (file access)","description":"$54","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-114","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]}],"incidents":[{"name":"Spyware","details_count":4,"details":[{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Attempts to steal desktop application's information (file access)"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Reads FTP client related files"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Marks file for deletion"},{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"PE file has a section name known to be used by a packer/protector"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]}]},"activity":{"stats":{"process_count":21,"spawned_processes_count":21,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":19,"imported_dlls_count":163,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":14,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":5,"dns_resolutions_count":4,"contacted_urls_count":4,"http_requests_count":4},"behavior_tags":["salatstealer","wacatac","sabsik","evasive","windows-server-utility","infostealer"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"69f2b7dcceb2fb45dd006790","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Genie.8DN","contacted_countries":["USA"],"submit_name":"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe","analysis_start_time":"2026-04-30T02:01:02+00:00","indicators_count":{"informative":151,"suspicious":63,"malicious":13},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.21.81.197","port":443,"protocol":"UDP","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"address":"13.35.78.54","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"address":"13.107.253.51","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"address":"142.251.218.65","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"address":"172.217.12.106","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]}],"dns_resolutions":[{"domain":"clients2.googleusercontent.com","address":"142.251.218.65","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"domain":"edgeassetservice.azureedge.net","address":"150.171.109.185","ttl":1461,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"domain":"sb.scorecardresearch.com","address":"13.35.78.54","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"domain":"www.googleapis.com","address":"172.217.12.106","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]}],"http_requests":[{"host":"edge-consumer-static.azureedge.net","host_ip":"13.107.253.51:443","url":"/mouse-gesture/config.json","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /mouse-gesture/config.json HTTP/2\nHost: edge-consumer-static.azureedge.net\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nSec-Fetch-Site: none\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"host":"clients2.googleusercontent.com","host_ip":"142.251.218.65:443","url":"/crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /crx/blobs/AXJDbcB3bcsV6gp8gPeje3RcGNJ3eqIJK3ZArzrmZgm66KMI_kiXwkouPJ_H1mUKEwkz3sgH3WqX91P8sppzYc4bmn9MHbflNecjUeea0PpDyi6PGAvEm-AFGgz7Z7D2-5EAxlKa5ZzBahtzgxEuNigzgslrK_1YzGwG/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_104_1_0.crx HTTP/2\nHost: clients2.googleusercontent.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nSec-Mesh-Client-Arch: x86_64\nSec-Mesh-Client-Os: Windows\nPriority: u=4, i\nSec-Mesh-Client-Edge-Version: 145.0.3800.58\nSec-Mesh-Client-Edge-Channel: stable\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Mesh-Client-Os-Version: 10.0.16299\nSec-Mesh-Client-Webview: 0\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"host":"edgeassetservice.azureedge.net","host_ip":"150.171.109.185:443","url":"/assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /assets/arbitration_priority_list/39.0.3/asset?assetgroup=ArbitrationService HTTP/2\nHost: edgeassetservice.azureedge.net\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nSec-Fetch-Mode: no-cors\nEdge-Asset-Group: ArbitrationService\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"host":"www.googleapis.com","host_ip":"172.217.12.106:443","url":"/chromewebstore/v1.1/items/verify","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /chromewebstore/v1.1/items/verify HTTP/2\nHost: www.googleapis.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36 Edg/145.0.0.0\nContent-Type: application/json\nSec-Fetch-Mode: no-cors\nSec-Fetch-Storage-Access: active\nSec-Fetch-Site: none\nAccept-Language: en-US,en;q=0.9\nPriority: u=4, i\nAccept-Encoding: gzip, deflate, br, zstd\nSec-Fetch-Dest: empty","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}],"processes":[{"pid":7752,"ppid":0,"name":"SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe","command_line":"","sha256":"8b94f5fa94f35e5ba47ce260b009b34401c5c54042d7b7252c8c7d13bf8d9f05","normalized_path":"C:\\SecuriteInfo.com.Win32.SalatStealer-A.44876682.exe","uid":"00000000-00007752","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":5128,"ppid":7752,"name":"WmiPrvSE.exe","command_line":"","sha256":"8b94f5fa94f35e5ba47ce260b009b34401c5c54042d7b7252c8c7d13bf8d9f05","normalized_path":"%PROGRAMFILES%\\(x86)\\Adobe\\WmiPrvSE.exe","parent_uid":"00000000-00007752","uid":"00000000-00005128"},{"pid":4840,"ppid":5128,"name":"WmiPrvSE.exe","command_line":"-","sha256":"8b94f5fa94f35e5ba47ce260b009b34401c5c54042d7b7252c8c7d13bf8d9f05","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\WmiPrvSE.exe","parent_uid":"00000000-00005128","uid":"00000000-00004840"},{"pid":312,"ppid":5128,"name":"WmiPrvSE.exe","command_line":"-","sha256":"8b94f5fa94f35e5ba47ce260b009b34401c5c54042d7b7252c8c7d13bf8d9f05","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\WmiPrvSE.exe","parent_uid":"00000000-00005128","uid":"00000000-00000312"},{"pid":3696,"ppid":0,"name":"msedge.exe","command_line":"--profile-directory=Default","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","uid":"00000000-00003696","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7040,"ppid":3696,"name":"msedge.exe","command_line":"--type=gpu-process --gpu-preferences=SAAAAAAAAADgAAAEAAAAAAAAAAAAAGAAAQAAAAAAAAAAAAAAAAAAAAIAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --startup-read-main-dll --metrics-shmem-handle=1712,i,15179122097234242564,4727123657867420785,262144 --field-trial-handle=1996,i,10085467699893847406,3922642833044170950,262144 --variations-seed-version --trace-process-track-uuid=3190708988185955192 --mojo-platform-channel-handle=1992 /prefetch:2","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003696","uid":"00000000-00007040"},{"pid":1740,"ppid":3696,"name":"msedge.exe","command_line":"--type=crashpad-handler \"--user-data-dir=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler \"--database=%LOCALAPPDATA%\\Microsoft\\Edge\\User Data\\Crashpad\" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=145.0.7632.76 \"--annotation=exe=%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=145.0.3800.58 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x29c,0x7ff88bb90f18,0x7ff88bb90f24,0x7ff88bb90f30","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003696","uid":"00000000-00001740"},{"pid":3264,"ppid":3696,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --startup-read-main-dll --metrics-shmem-handle=1836,i,23904196782883174,11718740162487376598,524288 --field-trial-handle=1996,i,10085467699893847406,3922642833044170950,262144 --variations-seed-version --trace-process-track-uuid=3190708989122997041 --mojo-platform-channel-handle=2024 /prefetch:3","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003696","uid":"00000000-00003264"},{"pid":1424,"ppid":3696,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --startup-read-main-dll --metrics-shmem-handle=2284,i,2833695364293628102,8476878309949565898,524288 --field-trial-handle=1996,i,10085467699893847406,3922642833044170950,262144 --variations-seed-version --trace-process-track-uuid=3190708990060038890 --mojo-platform-channel-handle=3852 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003696","uid":"00000000-00001424"},{"pid":6244,"ppid":3696,"name":"msedge.exe","command_line":"--type=renderer --instant-process --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --time-ticks-at-unix-epoch=-1777535364788811 --launch-time-ticks=4434601747 --skip-read-main-dll --metrics-shmem-handle=2868,i,11142500270457575672,7225105625410755513,2097152 --field-trial-handle=1996,i,10085467699893847406,3922642833044170950,262144 --variations-seed-version --trace-process-track-uuid=3190708990997080739 --mojo-platform-channel-handle=3912 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003696","uid":"00000000-00006244"},{"pid":7860,"ppid":3696,"name":"msedge.exe","command_line":"--type=renderer --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --time-ticks-at-unix-epoch=-1777535364788811 --launch-time-ticks=4434600668 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=2860,i,17752822754605382275,17525967070428201946,2097152 --field-trial-handle=1996,i,10085467699893847406,3922642833044170950,262144 --variations-seed-version --trace-process-track-uuid=3190708991934122588 --mojo-platform-channel-handle=3892 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003696","uid":"00000000-00007860"},{"pid":6996,"ppid":3696,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=4904,i,13215642648413523848,6286804148129572246,524288 --field-trial-handle=1996,i,10085467699893847406,3922642833044170950,262144 --variations-seed-version --trace-process-track-uuid=3190708992871164437 --mojo-platform-channel-handle=4908 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003696","uid":"00000000-00006996"},{"pid":7616,"ppid":3696,"name":"msedge.exe","command_line":"--type=renderer --instant-process --pdf-upsell-enabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --time-ticks-at-unix-epoch=-1777535364788811 --launch-time-ticks=4466592468 --ssd-no-pressure-read-main-dll --metrics-shmem-handle=4892,i,9978962088236754218,17600624521153230401,2097152 --field-trial-handle=1996,i,10085467699893847406,3922642833044170950,262144 --variations-seed-version --trace-process-track-uuid=3190708993808206286 --mojo-platform-channel-handle=4904 /prefetch:1","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003696","uid":"00000000-00007616"},{"pid":4592,"ppid":3696,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --skip-read-main-dll --metrics-shmem-handle=5108,i,3166808279928945563,4502415941571732547,524288 --field-trial-handle=1996,i,10085467699893847406,3922642833044170950,262144 --variations-seed-version --trace-process-track-uuid=3190708994745248135 --mojo-platform-channel-handle=5096 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003696","uid":"00000000-00004592"},{"pid":164,"ppid":3696,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --skip-read-main-dll --metrics-shmem-handle=5128,i,14320310688938567638,6780683787769862338,524288 --field-trial-handle=1996,i,10085467699893847406,3922642833044170950,262144 --variations-seed-version --trace-process-track-uuid=3190708995682289984 --mojo-platform-channel-handle=5196 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003696","uid":"00000000-00000164"},{"pid":1160,"ppid":3696,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=4712,i,5353882690475568546,7319453194969684780,524288 --field-trial-handle=1996,i,10085467699893847406,3922642833044170950,262144 --variations-seed-version --trace-process-track-uuid=3190708996619331833 --mojo-platform-channel-handle=4740 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003696","uid":"00000000-00001160"},{"pid":5748,"ppid":3696,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --skip-read-main-dll --metrics-shmem-handle=5820,i,1961661679412956732,12657309267517898591,524288 --field-trial-handle=1996,i,10085467699893847406,3922642833044170950,262144 --variations-seed-version --trace-process-track-uuid=3190708998493415531 --mojo-platform-channel-handle=5832 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003696","uid":"00000000-00005748"},{"pid":4864,"ppid":3696,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --skip-read-main-dll --metrics-shmem-handle=6200,i,1200595376096683086,5503960312618134300,524288 --field-trial-handle=1996,i,10085467699893847406,3922642833044170950,262144 --variations-seed-version --trace-process-track-uuid=3190708999430457380 --mojo-platform-channel-handle=6188 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003696","uid":"00000000-00004864"},{"pid":2740,"ppid":3696,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=5096,i,8224956416966242225,5818404021544948411,524288 --field-trial-handle=1996,i,10085467699893847406,3922642833044170950,262144 --variations-seed-version --trace-process-track-uuid=3190709000367499229 --mojo-platform-channel-handle=5404 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003696","uid":"00000000-00002740"},{"pid":3444,"ppid":3696,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --skip-read-main-dll --metrics-shmem-handle=3916,i,2850846344381343458,5045688884141831999,524288 --field-trial-handle=1996,i,10085467699893847406,3922642833044170950,262144 --variations-seed-version --trace-process-track-uuid=3190709001304541078 --mojo-platform-channel-handle=3912 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003696","uid":"00000000-00003444"},{"pid":2468,"ppid":3696,"name":"msedge.exe","command_line":"--type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --ssd-no-pressure-read-main-dll --metrics-shmem-handle=5680,i,11586277874453284277,825620050238292083,524288 --field-trial-handle=1996,i,10085467699893847406,3922642833044170950,262144 --variations-seed-version --trace-process-track-uuid=3190709002241582927 --mojo-platform-channel-handle=5900 /prefetch:8","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00003696","uid":"00000000-00002468"}],"all_imported_dlls":["dbghelp.dll","mfplat.dll","wscapi.dll","sspicli.dll","wow64.dll","rpcrt4.dll","IPHLPAPI.DLL","xmllite.dll","dpapi.dll","dwmapi.dll","TextInputFramework.dll","gdi32full.dll","msvcrt.dll","cfgmgr32.dll","dxgi.dll","Windows.Networking.Connectivity.dll","npmproxy.dll","tbs.dll","sppc.dll","gdi32.dll","cryptsp.dll","dhcpcsvc6.dll","crypt32.dll","dsreg.dll","devobj.dll","netprofm.dll","advapi32.dll","winhttp.dll","dcomp.dll","slc.dll","urlmon.dll","uxtheme.dll","winsta.dll","comctl32.dll","winmm.dll","bcrypt.dll","msasn1.dll","fwbase.dll","ResourcePolicyClient.dll","d3dcompiler_47.dll","user32.dll","KernelBase.dll","mswsock.dll","nsi.dll","FWPUCLNT.DLL","kernel.appcore.dll","ncrypt.dll","dmcmnutils.dll","ucrtbase.dll","msedge.dll","nlaapi.dll","CoreUIComponents.dll","domain_actions.dll","telclient.dll","d3d10warp.dll","wbemsvc.dll","Windows.System.UserProfile.DiagnosticsSettings.dll","dhcpcsvc.dll","samcli.dll","wmiutils.dll","wintrust.dll","vcruntime140.dll","shell32.dll","msedge_elf.dll","msctf.dll","well_known_domains.dll","cryptbase.dll","sechost.dll","aepic.dll","twinapi.appcore.dll","Windows.UI.Immersive.dll","shlwapi.dll","KBDUS.DLL","mscms.dll","Windows.UI.dll","rometadata.dll","webauthn.dll","win32u.dll","RstrtMgr.dll","DWrite.dll","twinapi.dll","slwga.dll","Windows.Security.Authentication.OnlineId.dll","ole32.dll","netutils.dll","samlib.dll","version.dll","CoreMessaging.dll","WinTypes.dll","setupapi.dll","PCPKsp.dll","apphelp.dll","wbemdisp.dll","Windows.System.Profile.PlatformDiagnosticsAndUsageDataSettings.dll","ffmpeg.dll","imagehlp.dll","imm32.dll","secur32.dll","wlanapi.dll","profapi.dll","wbemprox.dll","propsys.dll","directmanipulation.dll","dusmapi.dll","wow64cpu.dll","VxSSL32.dll","powrprof.dll","userenv.dll","wkscli.dll","ntasn1.dll","SHCore.dll","atlthunk.dll","actxprxy.dll","mf.dll","libGLESv2.dll","onnxruntime.dll","msvcp110_win.dll","OneCoreUAPCommonProxyStub.dll","ncryptprov.dll","wevtapi.dll","oneds.dll","libEGL.dll","iertutil.dll","ntmarta.dll","mdmregistration.dll","oneauth.dll","bcryptprimitives.dll","winmmbase.dll","clbcatq.dll","fastprox.dll","rmclient.dll","d3d11.dll","rsaenh.dll","fltLib.dll","netapi32.dll","cldapi.dll","combase.dll","rasadhlp.dll","oleacc.dll","microsoft_shell_integration.dll","kernel32.dll","dnsapi.dll","wldp.dll","FirewallAPI.dll","wwapi.dll","ws2_32.dll","sxs.dll","Windows.Security.Authentication.Web.Core.dll","msvcp_win.dll","wtsapi32.dll","gpapi.dll","linkinfo.dll","RTWorkQ.dll","wbemcomn.dll","wow64win.dll","taskschd.dll","BitsProxy.dll","vk_swiftshader.dll","ntdll.dll","oleaut32.dll","windows.storage.dll","DataExchange.dll","Windows.System.Profile.RetailInfo.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"WmiPrvSE.exe","sha256":"8b94f5fa94f35e5ba47ce260b009b34401c5c54042d7b7252c8c7d13bf8d9f05","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"name":"csrss.exe","sha256":"8b94f5fa94f35e5ba47ce260b009b34401c5c54042d7b7252c8c7d13bf8d9f05","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"name":"OSPPSVC.EXE","sha256":"8b94f5fa94f35e5ba47ce260b009b34401c5c54042d7b7252c8c7d13bf8d9f05","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"path":"PIPE\\wkssvc","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"path":"%PROGRAMFILES%\\(x86)\\Google\\f248d74e-5558-0bdf-d109-a68d9b924e55","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"path":"%PROGRAMFILES%\\(x86)\\Google\\csrss.exe","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"path":"%PROGRAMFILES%\\(x86)\\Windows Multimedia Platform\\f248d74e-5558-0bdf-d109-a68d9b924e55","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"path":"%PROGRAMFILES%\\(x86)\\Windows Multimedia Platform\\OSPPSVC.EXE","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\f248d74e-5558-0bdf-d109-a68d9b924e55","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"path":"%PROGRAMFILES%\\(x86)\\Adobe\\WmiPrvSE.exe","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"path":"%TEMP%\\f248d74e-5558-0bdf-d109-a68d9b924e55","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\WmiPrvSE.exe","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\WmiPrvSE.exe","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\WEBR_GWC8KGSIHIAP","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"name":"SM0:7752:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7752:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"name":"SM0:5128:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"name":"Local\\SM0:5128:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"name":"RstrMgr3887CAB8-533F-4C85-B0DC-3E5639F8D511","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"name":"RstrMgr-3887CAB8-533F-4C85-B0DC-3E5639F8D511-Session0000","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"name":"Local\\SM0:5128:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"name":"SM0:5128:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5128:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5128:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:5128:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:5128:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4840:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"name":"SM0:4840:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:312:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]},{"name":"SM0:312:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"69f2b7dcceb2fb45dd006790"}]}]}},"report_ids":{"sandbox_job_ids":["69f2b7dcceb2fb45dd006790"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Genie.8DN.Generic Sample 8b94f5fa94f3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 8b94f5fa94f3…. Malware family: Genie.8DN.Generic. Threat score 100/100. 15/28 AV engines flagged this file. 13 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8b94f5fa94f35e5ba47ce260b009b34401c5c54042d7b7252c8c7d13bf8d9f05"}],["$","meta","4",{"property":"og:title","content":"Malicious Genie.8DN.Generic Sample 8b94f5fa94f3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 8b94f5fa94f3…. Malware family: Genie.8DN.Generic. Threat score 100/100. 15/28 AV engines flagged this file. 13 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8b94f5fa94f35e5ba47ce260b009b34401c5c54042d7b7252c8c7d13bf8d9f05"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Genie.8DN.Generic Sample 8b94f5fa94f3… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 8b94f5fa94f3…. Malware family: Genie.8DN.Generic. Threat score 100/100. 15/28 AV engines flagged this file. 13 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L55","11",{}]]