24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 4f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4d6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Suspicious TrojanDownloader.Rugmi Sample 8ca17f8770bf… — Score 77/100 — Hybrid Analysis","description":"Suspicious verdict for sample 8ca17f8770bf…. Malware family: TrojanDownloader.Rugmi. Threat score 77/100. 1/26 AV engines flagged this file. 0 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/8ca17f8770bf57d63512f5689c3cfaa0ea286cb553365595cf4ede21411324bf","keywords":["Suspicious","TrojanDownloader.Rugmi","malware analysis","sandbox report","threat intelligence","8ca17f8770bf57d63512f5689c3cfaa0ea286cb553365595cf4ede21411324bf"],"about":{"@type":"SoftwareApplication","name":"8ca17f8770bf57d63512f5689c3cfaa0ea286cb553365595cf4ede21411324bf.bin","applicationCategory":["msi","data"],"identifier":"8ca17f8770bf57d63512f5689c3cfaa0ea286cb553365595cf4ede21411324bf","additionalType":"Suspicious sample"},"threatScore":77,"malwareFamily":"TrojanDownloader.Rugmi","antivirusDetections":{"malicious":1,"total":26},"behavioralIndicators":{"malicious":0,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T40c,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp")26:T7f4,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "rTimer: QueryPerformanceCounter failed with error" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp")27:T4b1,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp")28:T174b,file/memory contains long string with (Indicator: "SHA384"; File: "48B35517638A85CA46010B026C2B955A_7B1A0B83FEDB976F620CFD7925C2C915") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00003824-00000CC3-1134568872") Found reference to "/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl" (Indicator: "SHA384"; Source: "00000000-00003824-00000CCB-1135278190") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00003824.00000000.138542.0333E000.00000004.mdmp, 00000000-00003824.00000000.138542.03389000.00000004.mdmp, 00000000-00003824.00000000.138542.062D2000.00000004.mdmp, 00000000-00003824.00000001.138816.0333E000.00000004.mdmp, 00000000-00003824.00000001.138816.03389000.00000004.mdmp, 00000000-00003824.00000001.138816.062D2000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00003824.00000000.138542.0333E000.00000004.mdmp, 00000000-00003824.00000000.138542.03389000.00000004.mdmp, 00000000-00003824.00000001.138816.0333E000.00000004.mdmp, 00000000-00003824.00000001.138816.03389000.00000004.mdmp") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA10" (Indicator: "SHA384"; Source: "00000000-00003824.00000000.138542.0333E000.00000004.mdmp, 00000000-00003824.00000001.138816.0333E000.00000004.mdmp") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S" (Indicator: "SHA384"; Source: "00000000-00003824.00000000.138542.0333E000.00000004.mdmp, 00000000-00003824.00000000.138542.03DC0000.00000004.mdmp, 00000000-00003824.00000001.138816.0333E000.00000004.mdmp, 00000000-00003824.00000001.138816.03DC0000.00000004.mdmp") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0>" (Indicator: "SHA384"; Source: "00000000-00003824.00000000.138542.0333E000.00000004.mdmp, 00000000-00003824.00000001.138816.0333E000.00000004.mdmp") Found reference to "Phttp://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; Source: "00000000-00003824.00000000.138542.0333E000.00000004.mdmp, 00000000-00003824.00000000.138542.03DC0000.00000004.mdmp, 00000000-00003824.00000001.138816.0333E000.00000004.mdmp") Found reference to "GET /DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl HTTP/1.1" (Indicator: "SHA384"; Source: "00000000-00003824.00000000.138542.0333E000.00000004.mdmp, 00000000-00003824.00000001.138816.0333E000.00000004.mdmp") Found reference to "DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl" (Indicator: "SHA384"; Source: "00000000-00003824.00000000.138542.03389000.00000004.mdmp, 00000000-00003824.00000001.138816.03389000.00000004.mdmp") Found reference to "http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl" (Indicator: "SHA384"; Source: "00000000-00003824.00000000.138542.03389000.00000004.mdmp, 00000000-00003824.00000000.138542.062A0000.00000004.mdmp, 00000000-00003824.00000001.138816.03389000.00000004.mdmp, 00000000-00003824.00000001.138816.062A0000.00000004.mdmp") Found reference to "ttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl" (Indicator: "SHA384"; Source: "00000000-00003824.00000000.138542.03389000.00000004.mdmp, 00000000-00003824.00000001.138816.03389000.00000004.mdmp") Found reference to "http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl" (Indicator: "SHA384"; Source: "00000000-00003824.00000000.138542.03389000.00000004.mdmp, 00000000-00003824.00000001.138816.03389000.00000004.mdmp") Found reference to "//crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl" (Indicator: "SHA384"; Source: "00000000-00003824.00000000.138542.03389000.00000004.mdmp, 00000000-00003824.00000001.138816.03389000.00000004.mdmp") Found reference to ")Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl" (Indicator: "SHA384"; Source: "00000000-00003824.00000000.138542.03389000.00000004.mdmp, 00000000-00003824.00000001.138816.03389000.00000004.mdmp") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA107" (Indicator: "SHA384"; Source: "00000000-00003824.00000000.138542.03DC0000.00000004.mdmp, 00000000-00003824.00000001.138816.03DC0000.00000004.mdmp") Found reference to "stedG4CodeSigningRSA4096SHA3842021CA1.crl0>" (Indicator: "SHA384"; Source: "00000000-00003824.00000000.138542.03DC0000.00000004.mdmp, 00000000-00003824.00000001.138816.03DC0000.00000004.mdmp") Found reference to "8DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; Source: "00000000-00003824.00000000.138542.03DC0000.00000004.mdmp, 00000000-00003824.00000000.138542.062D2000.00000004.mdmp, 00000000-00003824.00000001.138816.03DC0000.00000004.mdmp") Found reference to "CertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl" (Indicator: "SHA384"; Source: "00000000-00003824.00000000.138542.062A0000.00000004.mdmp, 00000000-00003824.00000001.138816.062A0000.00000004.mdmp") Found reference to "/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl" (Indicator: "SHA384"; Source: "00000000-00003824.00000000.138542.062A0000.00000004.mdmp, 00000000-00003824.00000001.138816.062A0000.00000004.mdmp") Found reference to "Mhttp://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl" (Indicator: "SHA384"; Source: "00000000-00003824.00000000.138542.062D2000.00000004.mdmp") Found reference to "Mhttp://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0" (Indicator: "SHA384"; Source: "00000000-00003824.00000000.138542.062D2000.00000004.mdmp") Found reference to "DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1" (Indicator: "SHA384"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to "ts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0" (Indicator: "SHA384"; Source: "00000000-00003824.00000001.138816.03DC0000.00000004.mdmp")29:T9b7,"BinaryTransponder.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CRLS") "BinaryTransponder.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CRLS") "BinaryTransponder.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CTLS") "BinaryTransponder.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\CTLS") "BinaryTransponder.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE") "BinaryTransponder.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE") "BinaryTransponder.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT ENHANCED RSA AND AES CRYPTOGRAPHIC PROVIDER") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT ENHANCED RSA AND AES CRYPTOGRAPHIC PROVIDER") "BinaryTransponder.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY") "BinaryTransponder.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\OFFLOAD") "BinaryTransponder.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\CRYPTOGRAPHY\DESHASHSESSIONKEYBACKWARD") "BinaryTransponder.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\WINTRUST\TRUST PROVIDERS\SOFTWARE PUBLISHING") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\WINTRUST\TRUST PROVIDERS\SOFTWARE PUBLISHING") "BinaryTransponder.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY") "BinaryTransponder.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPUBLISHER\SAFER") "BinaryTransponder.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE") "BinaryTransponder.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE\ALTERNATE SORTS") "BinaryTransponder.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE GROUPS")2a:Te3f,Found api reference "CryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00003824.00000000.138542.03389000.00000004.mdmp, 00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found api reference "CryptEncrypt failed" (Indicator: "CryptEncrypt"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found api reference "CryptStringToBinaryA" (Indicator: "CryptStringToBinaryA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found api reference "CryptStringToBinaryW" (Indicator: "CryptStringToBinaryW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found api reference "CryptBinaryToStringW" (Indicator: "CryptBinaryToStringW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found api reference "CertGetNameStringW" (Indicator: "CertGetNameStringW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found api reference "CryptVerifyMessageSignature" (Indicator: "CryptVerifyMessageSignature"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found api reference "CertGetNameStringA" (Indicator: "CertGetNameStringA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found api reference "CryptAcquireContextA" (Indicator: "CryptAcquireContextA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found api reference "CryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found api reference "CryptHashData" (Indicator: "CryptHashData"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found api reference "CryptVerifySignatureW" (Indicator: "CryptVerifySignatureW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found api reference "CryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found api reference "CryptSetKeyParam" (Indicator: "CryptSetKeyParam"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found api reference "CryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp")2b:Ta1b,Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "CryptoAPI/10" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCECVgOf5DM4ckJwGXosBI7BU" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCECVgOf5DM4ckJwGXosBI7BU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "Keep" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCECVgOf5DM4ckJwGXosBI7BU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "User" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCECVgOf5DM4ckJwGXosBI7BU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "CryptoAPI/10" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCECVgOf5DM4ckJwGXosBI7BU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base64 string in header "ocsp" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCECVgOf5DM4ckJwGXosBI7BU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com"2c:T552,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Able to import cryptographic keys (seen in ransomware) Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Contains ability to perform decryption (API string) Matched sigs: HTTP requests contain Base64 strings Matched sigs: Drops file with high entropy indicating encryption/obfuscation Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match - Compress data using CryptoPP library Matched sigs: YARA signature match – cryptographic algorithms Matched sigs: Contains ability to perform RSA encryption using crypto++ library Matched sigs: Reads the cryptographic machine GUID Matched sigs: YARA signature match - Cryptographic algorithm using CryptoPP library Matched sigs: YARA signature match - AES encryption2d:T5104,Found XOR loop in file "BinaryTransponder.exe" at offset 2290132; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 2326204; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 2882310; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 2887034; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 2905048; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 2909646; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 2910776; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3168868; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3174222; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3208849; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3218307; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3225983; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3252941; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3255177; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3262601; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3275581; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3276577; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3299459; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3301747; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3305439; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3307619; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3309863; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3312103; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3313101; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3314687; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3316441; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3323411; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3325821; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3326635; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3327883; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3329301; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3330835; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3332125; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3335111; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3336235; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3337645; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3341875; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3343447; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3345271; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3347173; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3348739; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3350275; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3353395; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3354843; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3356299; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3357887; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3359563; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3363139; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3370819; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3371497; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3372995; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3374645; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3375489; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3378047; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3379863; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3381257; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3383281; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3384577; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3386689; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3388317; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3389911; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3390533; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3391033; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3391605; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3392631; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3393731; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 3394227; code bytes = 30d0 Found XOR loop in file "BinaryTransponder.exe" at offset 1111; code bytes = 33c1 Found XOR loop in file "BinaryTransponder.exe" at offset 1128; code bytes = 33c1 Found XOR loop in file "BinaryTransponder.exe" at offset 1141; code bytes = 33c1 Found XOR loop in file "BinaryTransponder.exe" at offset 1056976; code bytes = 33c1 Found XOR loop in file "BinaryTransponder.exe" at offset 2001581; code bytes = 33c1 Found XOR loop in file "BinaryTransponder.exe" at offset 2003802; code bytes = 33c1 Found XOR loop in file "BinaryTransponder.exe" at offset 2003931; code bytes = 33c1 Found XOR loop in file "BinaryTransponder.exe" at offset 2194545; code bytes = 33c1 Found XOR loop in file "BinaryTransponder.exe" at offset 2526085; code bytes = 33c1 Found XOR loop in file "BinaryTransponder.exe" at offset 2526533; code bytes = 33c1 Found XOR loop in file "BinaryTransponder.exe" at offset 2527109; code bytes = 33c1 Found XOR loop in file "BinaryTransponder.exe" at offset 2527557; code bytes = 33c1 Found XOR loop in file "BinaryTransponder.exe" at offset 2874919; code bytes = 33c1 Found XOR loop in file "BinaryTransponder.exe" at offset 3178181; code bytes = 33c1 Found XOR loop in file "BinaryTransponder.exe" at offset 3198525; code bytes = 33c1 Found XOR loop in file "BinaryTransponder.exe" at offset 3226753; code bytes = 33c1 Found XOR loop in file "BinaryTransponder.exe" at offset 3237119; code bytes = 33c1 Found XOR loop in file "BinaryTransponder.exe" at offset 3240747; code bytes = 33c1 Found XOR loop in file "BinaryTransponder.exe" at offset 3244409; code bytes = 33c1 Found XOR loop in file "BinaryTransponder.exe" at offset 3250023; code bytes = 33c1 Found XOR loop in file "BinaryTransponder.exe" at offset 3268819; code bytes = 33c1 Found XOR loop in file "BinaryTransponder.exe" at offset 3289695; code bytes = 33c1 Found XOR loop in file "BinaryTransponder.exe" at offset 3302847; code bytes = 33c1 Found XOR loop in file "BinaryTransponder.exe" at offset 3439700; code bytes = 33c1 Found XOR loop in file "BinaryTransponder.exe" at offset 304167; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 1119801; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 1119874; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 1267555; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 1434292; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 1434384; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 1504163; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 1504185; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 1504207; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 1645689; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 1654196; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 1826720; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 2528860; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 2541210; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 2881392; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 2906557; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3225688; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3227880; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3250722; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3252484; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3257088; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3259252; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3259768; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3264652; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3269308; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3269476; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3270642; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3271502; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3280076; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3285546; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3307588; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3309824; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3312064; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3313062; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3314648; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3316412; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3323380; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3325782; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3326596; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3329262; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3330796; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3332092; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3333684; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3335072; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3336196; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3339236; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3343408; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3345232; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3347134; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3348700; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3350236; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3353356; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3354804; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3356264; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3357848; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3359524; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3361408; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3363100; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3369100; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3370300; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3370780; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3371478; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3372052; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3373810; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3374630; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3376330; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3377174; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3378926; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3381252; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3383266; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3385622; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3388298; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3389892; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3391586; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3392620; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3422626; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3424756; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3457769; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3460434; code bytes = 8030 Found XOR loop in file "BinaryTransponder.exe" at offset 3460681; code bytes = 8030 Found XOR loop in file "SdAppServices.dll" at offset 72321; code bytes = 30d0 Found XOR loop in file "SdAppServices.dll" at offset 72545; code bytes = 30d0 Found XOR loop in file "SdAppServices.dll" at offset 958490; code bytes = 30d0 Found XOR loop in file "SdAppServices.dll" at offset 1016448; code bytes = 30d0 Found XOR loop in file "SdAppServices.dll" at offset 1079963; code bytes = 30d0 Found XOR loop in file "SdAppServices.dll" at offset 1097561; code bytes = 30d0 Found XOR loop in file "SdAppServices.dll" at offset 1104351; code bytes = 30d0 Found XOR loop in file "SdAppServices.dll" at offset 1106475; code bytes = 30d0 Found XOR loop in file "SdAppServices.dll" at offset 1107915; code bytes = 30d0 Found XOR loop in file "SdAppServices.dll" at offset 1108767; code bytes = 30d0 Found XOR loop in file "SdAppServices.dll" at offset 1110549; code bytes = 30d0 Found XOR loop in file "SdAppServices.dll" at offset 1112559; code bytes = 30d0 Found XOR loop in file "SdAppServices.dll" at offset 1113443; code bytes = 30d0 Found XOR loop in file "SdAppServices.dll" at offset 1120099; code bytes = 30d0 Found XOR loop in file "SdAppServices.dll" at offset 15178; code bytes = 33c1 Found XOR loop in file "SdAppServices.dll" at offset 15350; code bytes = 33c1 Found XOR loop in file "SdAppServices.dll" at offset 15360; code bytes = 33c1 Found XOR loop in file "SdAppServices.dll" at offset 48973; code bytes = 33c1 Found XOR loop in file "SdAppServices.dll" at offset 60674; code bytes = 33c1 Found XOR loop in file "SdAppServices.dll" at offset 579060; code bytes = 33c1 Found XOR loop in file "SdAppServices.dll" at offset 579098; code bytes = 33c1 Found XOR loop in file "SdAppServices.dll" at offset 579200; code bytes = 33c1 Found XOR loop in file "SdAppServices.dll" at offset 579216; code bytes = 33c1 Found XOR loop in file "SdAppServices.dll" at offset 579302; code bytes = 33c1 Found XOR loop in file "SdAppServices.dll" at offset 579705; code bytes = 33c1 Found XOR loop in file "SdAppServices.dll" at offset 579767; code bytes = 33c1 Found XOR loop in file "SdAppServices.dll" at offset 579878; code bytes = 33c1 Found XOR loop in file "SdAppServices.dll" at offset 580019; code bytes = 33c1 Found XOR loop in file "SdAppServices.dll" at offset 582944; code bytes = 33c1 Found XOR loop in file "SdAppServices.dll" at offset 634848; code bytes = 33c1 Found XOR loop in file "SdAppServices.dll" at offset 634979; code bytes = 33c1 Found XOR loop in file "SdAppServices.dll" at offset 1084559; code bytes = 33c1 Found XOR loop in file "SdAppServices.dll" at offset 303525; code bytes = 8030 Found XOR loop in file "SdAppServices.dll" at offset 898468; code bytes = 8030 Found XOR loop in file "SdAppServices.dll" at offset 910826; code bytes = 8030 Found XOR loop in file "SdAppServices.dll" at offset 992348; code bytes = 8030 Found XOR loop in file "SdAppServices.dll" at offset 1045128; code bytes = 8030 Found XOR loop in file "SdAppServices.dll" at offset 1083002; code bytes = 8030 Found XOR loop in file "SdAppServices.dll" at offset 1101336; code bytes = 8030 Found XOR loop in file "SdAppServices.dll" at offset 1104320; code bytes = 8030 Found XOR loop in file "SdAppServices.dll" at offset 1106452; code bytes = 8030 Found XOR loop in file "SdAppServices.dll" at offset 1107732; code bytes = 8030 Found XOR loop in file "SdAppServices.dll" at offset 1107900; code bytes = 8030 Found XOR loop in file "SdAppServices.dll" at offset 1108730; code bytes = 8030 Found XOR loop in file "SdAppServices.dll" at offset 1110522; code bytes = 8030 Found XOR loop in file "SdAppServices.dll" at offset 1112544; code bytes = 8030 Found XOR loop in file "SdAppServices.dll" at offset 1113428; code bytes = 8030 Found XOR loop in file "SdAppServices.dll" at offset 1114578; code bytes = 8030 Found XOR loop in file "SdAppServices.dll" at offset 1117902; code bytes = 8030 Found XOR loop in file "SdAppServices.dll" at offset 1119102; code bytes = 8030 Found XOR loop in file "SdAppServices.dll" at offset 1119610; code bytes = 8030 Found XOR loop in file "SdAppServices.dll" at offset 1128626; code bytes = 8030 Found XOR loop in file "SdAppServices.dll" at offset 1128873; code bytes = 8030 Found XOR loop in file "SdAppServices.dll" at offset 1130347; code bytes = 8030 Found XOR loop in file "wblindp2.dll" at offset 94574; code bytes = 30d0 Found XOR loop in file "wblindp2.dll" at offset 432127; code bytes = 30d0 Found XOR loop in file "wblindp2.dll" at offset 432194; code bytes = 30d0 Found XOR loop in file "wblindp2.dll" at offset 432230; code bytes = 30d0 Found XOR loop in file "wblindp2.dll" at offset 741111; code bytes = 30d0 Found XOR loop in file "wblindp2.dll" at offset 741985; code bytes = 30d0 Found XOR loop in file "wblindp2.dll" at offset 762453; code bytes = 30d0 Found XOR loop in file "wblindp2.dll" at offset 768171; code bytes = 30d0 Found XOR loop in file "wblindp2.dll" at offset 545864; code bytes = 33c1 Found XOR loop in file "wblindp2.dll" at offset 546483; code bytes = 33c1 Found XOR loop in file "wblindp2.dll" at offset 742447; code bytes = 33c1 Found XOR loop in file "wblindp2.dll" at offset 743757; code bytes = 33c1 Found XOR loop in file "wblindp2.dll" at offset 752453; code bytes = 33c1 Found XOR loop in file "wblindp2.dll" at offset 760369; code bytes = 33c1 Found XOR loop in file "wblindp2.dll" at offset 769999; code bytes = 33c1 Found XOR loop in file "wblindp2.dll" at offset 280760; code bytes = 8030 Found XOR loop in file "wblindp2.dll" at offset 328328; code bytes = 8030 Found XOR loop in file "wblindp2.dll" at offset 451953; code bytes = 8030 Found XOR loop in file "wblindp2.dll" at offset 687212; code bytes = 8030 Found XOR loop in file "wblindp2.dll" at offset 699562; code bytes = 8030 Found XOR loop in file "wblindp2.dll" at offset 741982; code bytes = 8030 Found XOR loop in file "wblindp2.dll" at offset 744958; code bytes = 8030 Found XOR loop in file "wblindp2.dll" at offset 745314; code bytes = 8030 Found XOR loop in file "wblindp2.dll" at offset 757822; code bytes = 8030 Found XOR loop in file "wblindp2.dll" at offset 766472; code bytes = 80302e:Ta02,"BinaryTransponder.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003824) "BinaryTransponder.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000033dabf7750242f030001000000000000000000000001000050242f034000000004fd2501dd7d550000002e030000000050242f030001000000010000800000002b12550080f32e03000000008000000040000000200000004cfd2501032a550000f42e0388f32e032900000000000000df00000044fd250147615500e8505f0080fd250112275500020000000227550063ac085b29000000104d5700df0000000000000054fd25010000000038fe250160b3530033a7705afeffffff02275500b127550094fd2501b0fd250198fd2501020000000200000000000000b8fd2501a42a550002000000b0fd2501c0fd2501c4fd2501c8fd2501282a5500 (UID: 00000000-00003824) "BinaryTransponder.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003824) "BinaryTransponder.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003824)2f:T567,Found reference to API "10959231392,3808,107,,GetActiveWindow,user32.dll,"00:36:04.671",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00003824.00000000.138542.03389000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "InternalGetWindowText" (Indicator: "GetWindowText"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "GetWindowTextA" (Indicator: "GetWindowText"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "FindWindowA" (Indicator: "FindWindow"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "21243735992,3808,107,,GetActiveWindow,user32.dll,"00:36:08.953",RX=0,PX=0" (Indicator: "GetActiveWindow"; Source: "00000000-00003824.00000001.138816.03389000.00000004.mdmp")30:T766,"BinaryTransponder.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")31:T95e,"BinaryTransponder.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "BinaryTransponder.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "BinaryTransponder.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "BinaryTransponder.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "BinaryTransponder.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "BinaryTransponder.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "BinaryTransponder.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "BinaryTransponder.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "BinaryTransponder.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "BinaryTransponder.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "BinaryTransponder.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "BinaryTransponder.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "BinaryTransponder.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "BinaryTransponder.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "BinaryTransponder.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "BinaryTransponder.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "BinaryTransponder.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "BinaryTransponder.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "BinaryTransponder.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "BinaryTransponder.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "BinaryTransponder.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "BinaryTransponder.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")32:T551,"BinaryTransponder.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "BinaryTransponder.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "BinaryTransponder.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "BinaryTransponder.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "BinaryTransponder.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "BinaryTransponder.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "BinaryTransponder.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "BinaryTransponder.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "BinaryTransponder.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "BinaryTransponder.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")33:T1629,"BinaryTransponder.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter IsTouchWindow (UID: 00000000-00003824) "BinaryTransponder.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00003824)34:T14b83,Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00003824.00000000.138542.03389000.00000004.mdmp, 00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "HttpOpenRequestA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "HttpSendRequestA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "HttpQueryInfoA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "DisplayVersion"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetThreadInformation"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetProductInfo"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "WTSGetActiveConsoleSessionId"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CreateActCtxW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "ActivateActCtx"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "DeactivateActCtx"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "FindActCtxSectionStringW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "QueryActCtxW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "SetDefaultDllDirectories"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetOpenFileNameW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetSaveFileNameW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetThreadPreferredUILanguages"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "RegisterApplicationRestart"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "RegisterApplicationRecoveryCallback"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "ApplicationRecoveryInProgress"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "ApplicationRecoveryFinished"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SHGetKnownFolderPath"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CreateFileTransactedW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesTransactedW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyExW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "SetThreadStackGuarantee"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "timeSetEvent"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "PathFileExistsA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "PathFileExistsW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CryptStringToBinaryA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CryptStringToBinaryW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CryptBinaryToStringW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CertGetNameStringW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CryptVerifyMessageSignature"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CertGetNameStringA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "InternetCrackUrlA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "InternetOpenA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "InternetCloseHandle"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "InternetConnectA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetThreadPriority"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "LoadResource"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "LockResource"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SizeofResource"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "FindResourceW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileStringW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "SetThreadAffinityMask"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetCurrentDirectoryA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "Beep"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "SetProcessWorkingSetSize"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GlobalFindAtomW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileSectionA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileSectionW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "WritePrivateProfileSectionA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileSectionNamesW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "FindResourceA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileSectionNamesA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "FlushInstructionCache"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "IsBadCodePtr"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetShortPathNameW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "IsBadReadPtr"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetUserGeoID"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GlobalAddAtomW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GlobalFindAtomA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "IsBadWritePtr"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "ProcessIdToSessionId"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "WaitNamedPipeA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "FreeResource"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GlobalDeleteAtom"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GlobalSize"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GlobalGetAtomNameW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GlobalFlags"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GlobalReAlloc"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GlobalHandle"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "LocalReAlloc"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetThreadLocale"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "lstrcpyW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "VerifyVersionInfoW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "FindResourceExW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetVolumeInformationW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "LockFile"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "UnlockFile"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetFileTime"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetProfileIntW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetTempFileNameW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "UnregisterClassW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "EnableWindow"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "InvalidateRect"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "RedrawWindow"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetKeyState"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "ToAscii"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetCapture"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetTimer"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "KillTimer"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetClientRect"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetCursorPos"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "PtInRect"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetParent"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "UpdateWindow"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "EqualRect"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetDesktopWindow"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetPropA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "FillRect"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetPropA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "RemovePropA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CopyImage"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "DrawIconEx"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "ShowWindow"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetFocus"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "IsWindowEnabled"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetSysColor"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "BeginPaint"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "WindowFromPoint"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetCursor"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "MapWindowPoints"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "MoveWindow"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetWindowDC"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "DrawTextA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "ReleaseCapture"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPos"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetCapture"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CreatePopupMenu"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "DestroyMenu"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "AppendMenuW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "TrackPopupMenu"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetMenuDefaultItem"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetActiveWindow"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "ClientToScreen"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "IntersectRect"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetScrollInfo"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "MessageBeep"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "LoadImageA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "DrawFrameControl"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "DrawFocusRect"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "UpdateLayeredWindow"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "EnumChildWindows"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "IsIconic"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetForegroundWindow"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "FindWindowA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "RegisterWindowMessageA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "IsZoomed"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "DrawIcon"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SystemParametersInfoW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetWindowTextA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CheckMenuItem"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "EnableMenuItem"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetMenuItemBitmaps"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetMenuCheckMarkDimensions"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetMenuItemInfoW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetMessageTime"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "IsChild"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetWindowPlacement"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetWindowPlacement"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetMenu"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetMenu"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetSubMenu"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetMenuItemID"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetMenuItemCount"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "ScrollWindow"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetScrollPos"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetScrollPos"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetScrollRange"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetScrollRange"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "ShowScrollBar"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "AdjustWindowRectEx"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CopyRect"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetTopWindow"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetScrollInfo"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetMenuStringW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetMenuState"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "InsertMenuW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "RemoveMenu"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "LoadMenuW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "OffsetRect"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetKeyNameTextW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetAsyncKeyState"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "MapDialogRect"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "InflateRect"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "BringWindowToTop"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "LoadAcceleratorsW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "TranslateAcceleratorW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "InsertMenuItemW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "DestroyIcon"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "LoadImageW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "PostQuitMessage"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "ShowOwnedPopups"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetSysColorBrush"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetMenuItemInfoW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMenu"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "DeleteMenu"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetWindowRgn"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetMenuDefaultItem"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "IsRectEmpty"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "EnableScrollBar"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetIconInfo"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetParent"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "WaitMessage"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CopyAcceleratorTableW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetRect"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "HideCaret"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "DrawEdge"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetCursorPos"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CopyIcon"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "FrameRect"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CharUpperBuffW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "ModifyMenuW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "ToUnicodeEx"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetKeyboardLayout"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetKeyboardState"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CreateAcceleratorTableW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "DestroyAcceleratorTable"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "DestroyCursor"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "DrawMenuBar"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "TranslateMDISysAccel"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CreateMenu"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CreateFontA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "RoundRect"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetStretchBltMode"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetObjectW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "BitBlt"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CreateSolidBrush"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentObject"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetDIBits"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "StretchBlt"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetTextColor"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetDeviceCaps"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CreatePatternBrush"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CreateRoundRectRgn"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetMapMode"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CreateFontIndirectW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetMapMode"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "DPtoLP"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetBkColor"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetSidIdentifierAuthority"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthority"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "IsValidSid"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountNameA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CryptReleaseContext"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CryptImportKey"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CryptCreateHash"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CryptHashData"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyHash"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CryptVerifySignatureW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContextW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CryptDestroyKey"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CryptSetKeyParam"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CryptDecrypt"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteKeyW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "RegEnumKeyExW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "SHGetFolderPathW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "SHGetMalloc"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SHGetDesktopFolder"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SHBrowseForFolderA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SHGetFileInfoW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SHGetPathFromIDListW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SHBrowseForFolderW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CoInitialize"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CreateStreamOnHGlobal"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CoCreateGuid"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CoDisconnectObject"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "CoGetClassObject"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "OleInitialize"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "OleUninitialize"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "IsAccelerator"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "PathFindExtensionW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "PathFindFileNameW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "PathRemoveExtensionW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "PathRemoveFileSpecW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "RtlUnwind"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetDriveTypeW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "PeekNamedPipe"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleCP"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "HeapQueryInformation"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "InitOnceExecuteOnce"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolTimer"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolTimer"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "WaitForThreadpoolTimerCallbacks"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolTimer"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWait"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "SetThreadpoolWait"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWait"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "FlushProcessWriteBuffers"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryWhenCallbackReturns"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessorNumber"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CreateSymbolicLinkW"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "WakeConditionVariable"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "InitializeSRWLock"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "TryAcquireSRWLockExclusive"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableSRW"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CreateThreadpoolWork"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "SubmitThreadpoolWork"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CloseThreadpoolWork"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetUserPreferredUILanguages"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CryptAcquireContext"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CryptGenRandom"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "SetHandleInformation"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "AddAtomA"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "MsgWaitForMultipleObjects"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetLastInputInfo"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "CreateWellKnownSid"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetNamedSecurityInfoW"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "SetEntriesInAclW"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "SetNamedSecurityInfoW"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSecurityDescriptorToSecurityDescriptorW"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "SetSecurityDescriptorSacl"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "ShellExecuteExW"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "SHFileOperationW"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "PathAppendW"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetAdaptersInfo"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "WinHttpCloseHandle"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "WinHttpCrackUrl"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "WinHttpCreateUrl"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "WinHttpOpen"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "WinHttpSetTimeouts"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "WinHttpConnect"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "WinHttpSetOption"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "WinHttpSendRequest"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "WinHttpQueryDataAvailable"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "WinHttpReadData"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "InterlockedPushEntrySList"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "InterlockedFlushSList"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "IsValidLocale"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "EnumSystemLocalesW"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExA"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp")35:T9ca,"SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00003824.00000000.138542.03389000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\ThemeManager" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "Software\" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp 00000000-00003824.00000001.138816.72C33000.00000002.mdmp "Software\Classes\" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "SOFTWARE\" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp 00000000-00003824.00000001.138816.72C33000.00000002.mdmp "SOFTWARE\Stardock\Misc\WindowBlinds8" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "Software\Stardock\Settings" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "SOFTWARE\Stardock\WindowBlinds" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "SOFTWARE\Stardock\Misc\WindowBlinds" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "Software\Policies\LibreOffice\org.openoffice.Office.Common\VCL\UseOpenGL" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "Software\Policies\LibreOffice\org.openoffice.Office.Common\VCL\ForceOpenGL" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Accent" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "Software\Microsoft\Windows\DWM" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00003824.00000001.138816.03389000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003824.00000001.138816.062A0000.00000004.mdmp36:T9f8,"SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" in Source: 00000000-00003824.00000000.138542.03389000.00000004.mdmp "SOFTWARE\Stardock\Misc\WindowBlinds8" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "Software\Stardock\Settings" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "SOFTWARE\Stardock\WindowBlinds" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Themes\Personalize" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "SOFTWARE\Stardock\Misc\WindowBlinds" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "Software\Policies\LibreOffice\org.openoffice.Office.Common\VCL\UseOpenGL" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "Software\Policies\LibreOffice\org.openoffice.Office.Common\VCL\ForceOpenGL" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\ThemeManager" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\Accent" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "Software\Microsoft\Windows\DWM" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Network" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Comdlg32" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "Software\" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "Software\Classes\" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "SOFTWARE\" in Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp "stry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00003824.00000001.138816.03389000.00000004.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00003824.00000001.138816.062A0000.00000004.mdmp "Software\" in Source: 00000000-00003824.00000001.138816.72C33000.00000002.mdmp "SOFTWARE\" in Source: 00000000-00003824.00000001.138816.72C33000.00000002.mdmp37:Tabe,"BinaryTransponder.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74820000 "BinaryTransponder.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 74820000 "BinaryTransponder.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 74820000 "BinaryTransponder.exe" loaded module "KERNEL32" at base 779b0000 "BinaryTransponder.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 72c80000 "BinaryTransponder.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 74090000 "BinaryTransponder.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-1" at base 75d00000 "BinaryTransponder.exe" loaded module "%LOCALAPPDATA%\FUSSER_DATA\SDAPPSERVICES.DLL" at base 72b60000 "BinaryTransponder.exe" loaded module "WINTRUST.DLL" at base 74b30000 "BinaryTransponder.exe" loaded module "%WINDIR%\SYSWOW64\WINTRUST.DLL" at base 74b30000 "BinaryTransponder.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 72a80000 "BinaryTransponder.exe" loaded module "KERNEL32.DLL" at base 779b0000 "BinaryTransponder.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 757d0000 "BinaryTransponder.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 759a0000 "BinaryTransponder.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 72a30000 "BinaryTransponder.exe" loaded module "%WINDIR%\SYSWOW64\CRYPTNET.DLL" at base 72a30000 "BinaryTransponder.exe" loaded module "RPCRT4.DLL" at base 74600000 "BinaryTransponder.exe" loaded module "WINHTTP.DLL" at base 72ab0000 "BinaryTransponder.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72a00000 "BinaryTransponder.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 733d0000 "BinaryTransponder.exe" loaded module "SSPICLI.DLL" at base 745e0000 "BinaryTransponder.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 72990000 "BinaryTransponder.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 72940000 "BinaryTransponder.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72920000 "BinaryTransponder.exe" loaded module "CRYPTNET.DLL" at base 72a30000 "BinaryTransponder.exe" loaded module "COMCTL32.DLL" at base 73850000 "BinaryTransponder.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 754f0000 "BinaryTransponder.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 74a00000 "BinaryTransponder.exe" loaded module "OLEAUT32.DLL" at base 751c0000 "BinaryTransponder.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 75640000 "BinaryTransponder.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 75640000 "BinaryTransponder.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 395000038:T17d9,"20f188.msi" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.2 MSI Installer Code page: 1252 Title: Installation Database Subject: Fusser - Streamlined workflow automation platform | fusser.io Author: Vortex Software Solutions Inc. Keywords: Installer Comments: Fully silent - no UI. Run with: msiexec /quiet /i installer.msi Template: Intel;1033 Revision Number: {34050A73-C045-41A9-B936-61FC9A603CE7} Create Time/Date: Thu Feb 5 13:52:16 2026 Last Saved Time/Date: Thu Feb 5 13:52:16 2026 Number of Pages: 500 Number of Words: 10 Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516) Security: 2"- [targetUID: N/A] "BinaryTransponder.exe" has type "PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections"- Location: [%LOCALAPPDATA%\Fusser_Data\BinaryTransponder.exe]- [targetUID: 00000000-00003824] "SdAppServices.dll" has type "PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections"- Location: [%LOCALAPPDATA%\Fusser_Data\SdAppServices.dll]- [targetUID: 00000000-00003824] "wblindp2.dll" has type "PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections"- [targetUID: N/A] "Thais.zn" has type "data"- [targetUID: N/A] "ngen.log" has type "Unicode text UTF-8 (with BOM) text with very long lines (337) with CRLF line terminators"- [targetUID: N/A] "1A374813EDB1A6631387E414D3E73232" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\1A374813EDB1A6631387E414D3E73232]- [targetUID: 00000000-00003824] "Rurt.sc" has type "data"- [targetUID: N/A] "inprogressinstallinfo.ipi" has type "Composite Document File V2 Document Cannot read section info"- [targetUID: N/A] "SourceHash_E66BC25A-7161-4FD2-9418-EBA1BA9C2483_" has type "Unknown"- [targetUID: N/A] "20f189.rbs" has type "data"- [targetUID: N/A] "MSIF2D0.tmp" has type "data"- [targetUID: N/A] "48B35517638A85CA46010B026C2B955A_7B1A0B83FEDB976F620CFD7925C2C915" has type "data"- [targetUID: N/A] "439F613B3D55693954E1B080DE3085B4_C4927E03400A4F6EDB9D613E6354F864" has type "data"- [targetUID: N/A] "B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F" has type "data"- [targetUID: N/A] "18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013" has type "data"- [targetUID: N/A] "3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95]- [targetUID: 00000000-00003824] "C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141]- [targetUID: 00000000-00003824] "C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB]- [targetUID: 00000000-00003824] "8EC9B1D0ABBD7F98B401D425828828CE_B460DBDB6691F360C14B4617119E5588" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_B460DBDB6691F360C14B4617119E5588]- [targetUID: 00000000-00003824] "3AA0DCD5A74331FBD6F344550EC48B87_2C56F6A734D0F80A970DE78FB8C0B00F" has type "data"- [targetUID: N/A] "698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB]- [targetUID: 00000000-00003824] "3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95]- [targetUID: 00000000-00003824] "C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB]- [targetUID: 00000000-00003824] "C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141]- [targetUID: 00000000-00003824] "8EC9B1D0ABBD7F98B401D425828828CE_B460DBDB6691F360C14B4617119E5588" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_B460DBDB6691F360C14B4617119E5588]- [targetUID: 00000000-00003824] "698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB]- [targetUID: 00000000-00003824] "1A374813EDB1A6631387E414D3E73232" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\1A374813EDB1A6631387E414D3E73232]- [targetUID: 00000000-00003824] "329B6147266C1E26CD774EA22B79EC2E" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\329B6147266C1E26CD774EA22B79EC2E]- [targetUID: 00000000-00003824] "20f18a.msi" has type "Composite Document File V2 Document Little Endian Os: Windows Version 6.2 MSI Installer Code page: 1252 Title: Installation Database Subject: Fusser - Streamlined workflow automation platform | fusser.io Author: Vortex Software Solutions Inc. Keywords: Installer Comments: Fully silent - no UI. Run with: msiexec /quiet /i installer.msi Template: Intel;1033 Revision Number: {34050A73-C045-41A9-B936-61FC9A603CE7} Create Time/Date: Thu Feb 5 13:52:16 2026 Last Saved Time/Date: Thu Feb 5 13:52:16 2026 Number of Pages: 500 Number of Words: 10 Name of Creating Application: Windows Installer XML Toolset (3.11.2.4516) Security: 2"- [targetUID: N/A] "329B6147266C1E26CD774EA22B79EC2E" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\329B6147266C1E26CD774EA22B79EC2E]- [targetUID: 00000000-00003824]39:T683,"BinaryTransponder.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "BinaryTransponder.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS"; Key: ""; Value: "") "BinaryTransponder.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "BinaryTransponder.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: ""; Value: "") "BinaryTransponder.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}"; Key: ""; Value: "") "BinaryTransponder.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: ""; Value: "") "BinaryTransponder.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: ""; Value: "") "BinaryTransponder.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: ""; Value: "") "BinaryTransponder.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS"; Key: ""; Value: "") "BinaryTransponder.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: ""; Value: "")3a:Ta75,"BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSETTINGSPERUSER"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPV6DOMAIN"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS"; Key: "DEFAULTCONNECTIONSETTINGS"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\USER SHELL FOLDERS"; Key: "LOCAL APPDATA"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\PROFILELIST\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "PROFILEIMAGEPATH"; Value: "")3b:T448,"BinaryTransponder.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "BinaryTransponder.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\BINARYTRANSPONDER.EXE.LOCAL" "BinaryTransponder.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.16299.248_none_8e66fbc1026df8ab\GdiPlus.dll" "BinaryTransponder.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\MSIMG32.DLL" "BinaryTransponder.exe" trying to touch file "C:\Windows\SysWOW64\msimg32.dll" "BinaryTransponder.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\WINMM.DLL" "BinaryTransponder.exe" trying to touch file "C:\Windows\SysWOW64\winmm.dll" "BinaryTransponder.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\UXTHEME.DLL" "BinaryTransponder.exe" trying to touch file "C:\Windows\SysWOW64\uxtheme.dll" "BinaryTransponder.exe" trying to touch file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\WINMMBASE.DLL" "BinaryTransponder.exe" trying to touch file "C:\Windows\SysWOW64\winmmbase.dll"3c:Tb71,"BinaryTransponder.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\MSIMG32.DLL" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\WINMM.DLL" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\UXTHEME.DLL" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\WINMMBASE.DLL" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\WININET.DLL" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\VERSION.DLL" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\DWMAPI.DLL" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\IPHLPAPI.DLL" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\BCRYPT.DLL" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\OLEDLG.DLL" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\URLMON.DLL" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\OLEACC.DLL" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\IERTUTIL.DLL" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\OLEACCRC.DLL" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\FLTLIB.DLL" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\CRYPTSP.DLL" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\WINHTTP.DLL" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\WINHTTP.dll" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\WEBIO.DLL" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\webio.dll" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\WINNLSRES.DLL" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\winnlsres.dll" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\SDAPPSIRVICES.DLL" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\IMAGERES.DLL"3d:T97c,"BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\BINARYTRANSPONDER.EXE.LOCAL" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Fusser_Data\WINSPOOL.DRV" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_480C858474EF9C8E5CC1EA7749803D46" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\616AD1AB067CFD351D6C0EF6F3E12F40" "BinaryTransponder.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}" "BinaryTransponder.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}" "BinaryTransponder.exe" trying to access non-existent file "\Device\RasAcd" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_19E426B6FB64BBA263DD49F71BBA5C3B" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BA74182F76F15A9CF514DEF352303C95" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_B460DBDB6691F360C14B4617119E5588" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_0A90A53590426F13FC7C7354CE1910F0" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1A374813EDB1A6631387E414D3E73232" "BinaryTransponder.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\329B6147266C1E26CD774EA22B79EC2E"3e:T530,"BinaryTransponder.exe" writes file "c:\users\%osuser%\appdata\local\fusser_data\sdappservices.dll" "BinaryTransponder.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\698460a0b6e60f2f602361424d832905_8bb23d43de574e82f2bee0df0ec47eeb" "BinaryTransponder.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\698460a0b6e60f2f602361424d832905_8bb23d43de574e82f2bee0df0ec47eeb" "BinaryTransponder.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\c8e534ee129f27d55460ce17fd628216_1130d9b25898b0db0d4f04dc5b93f141" "BinaryTransponder.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\c8e534ee129f27d55460ce17fd628216_1130d9b25898b0db0d4f04dc5b93f141" "BinaryTransponder.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\8ec9b1d0abbd7f98b401d425828828ce_b460dbdb6691f360c14b4617119e5588" "BinaryTransponder.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\8ec9b1d0abbd7f98b401d425828828ce_b460dbdb6691f360c14b4617119e5588" "BinaryTransponder.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\c8e534ee129f27d55460ce17fd628216_56db209c155b5a05fcbf555df7e6d1bb"3f:T4f8,"BinaryTransponder.exe" called "WinHttpSendRequest" with parameters {"hRequest": "33af4f0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "BinaryTransponder.exe" called "WinHttpSendRequest" with parameters {"hRequest": "33ab9d8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "BinaryTransponder.exe" called "WinHttpSendRequest" with parameters {"hRequest": "33c9030" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "BinaryTransponder.exe" called "WinHttpSendRequest" with parameters {"hRequest": "62d86b8" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "BinaryTransponder.exe" called "WinHttpSendRequest" with parameters {"hRequest": "33a9e38" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "BinaryTransponder.exe" called "WinHttpSendRequest" with parameters {"hRequest": "62adb18" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"} "BinaryTransponder.exe" called "WinHttpSendRequest" with parameters {"hRequest": "33d13f0" "dwHeadersLength": "0" "dwOptionalLength": "0" "dwTotalLength": "0" "dwContext": "0"}40:T104a,Found reference to API "HttpOpenRequestA" (Indicator: "HttpOpenRequest"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "HttpSendRequestA" (Indicator: "HttpSendRequest"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "HttpQueryInfoA" (Indicator: "HttpQueryInfo"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "InternetOpenA" (Indicator: "InternetOpen"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "InternetConnectA" (Indicator: "InternetConnect"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "EstablishHttpSession::WinHttpOpen failed" (Indicator: "WinHttpOpen"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "EstablishInternetConnection::WinHttpConnect failed" (Indicator: "InternetConnect"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "EstablishInternetConnection::WinHttpConnect failed" (Indicator: "WinHttpConnect"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "InitializeRequest::WinHttpOpenRequest failed" (Indicator: "HttpOpenRequest"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "InitializeRequest::WinHttpOpenRequest failed" (Indicator: "WinHttpOpen"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "InitializeRequest::WinHttpOpenRequest failed" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "SendRequest::WinHttpSendRequest failed" (Indicator: "HttpSendRequest"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "SendRequest::WinHttpSendRequest failed" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "GetResponse::GetResponseWinHttpQueryHeaders failed" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "GetResponse::WinHttpReadData failed" (Indicator: "WinHttpReadData"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "DownloadResponse::GetResponseWinHttpQueryHeaders failed" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "DownloadResponse::WinHttpReadData failed" (Indicator: "WinHttpReadData"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp")41:T1124,Found reference to API "InitializeUrl::WinHttpCrackUrl failed" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "InitializeRelativeUrl::WinHttpCreateUrl failed" (Indicator: "WinHttpCreateUrl"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "EstablishHttpSession::WinHttpOpen failed" (Indicator: "WinHttpOpen"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "EstablishInternetConnection::WinHttpConnect failed" (Indicator: "WinHttpConnect"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "InitializeRequest::WinHttpOpenRequest failed" (Indicator: "WinHttpOpen"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "InitializeRequest::WinHttpOpenRequest failed" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "SetMimeType::WinHttpAddRequestHeaders failed" (Indicator: "WinHttpAddRequestHeaders"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "SendRequest::WinHttpSendRequest failed" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "GetResponse::WinHttpReceiveResponse failed" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "GetResponse::GetResponseWinHttpQueryHeaders failed" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "GetResponse::WinHttpQueryDataAvailable failed" (Indicator: "WinHttpQueryDataAvailable"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "GetResponse::WinHttpReadData failed" (Indicator: "WinHttpReadData"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "DownloadResponse::WinHttpReceiveResponse failed" (Indicator: "WinHttpReceiveResponse"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "DownloadResponse::GetResponseWinHttpQueryHeaders failed" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "DownloadResponse::WinHttpQueryDataAvailable failed" (Indicator: "WinHttpQueryDataAvailable"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "DownloadResponse::WinHttpReadData failed" (Indicator: "WinHttpReadData"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "WinHttpCloseHandle" (Indicator: "WinHttpCloseHandle"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "WinHttpCrackUrl" (Indicator: "WinHttpCrackUrl"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "WinHttpCreateUrl" (Indicator: "WinHttpCreateUrl"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "WinHttpGetIEProxyConfigForCurrentUser" (Indicator: "WinHttpGetIEProxyConfigForCurrentUser"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "WinHttpSetTimeouts" (Indicator: "WinHttpSetTimeouts"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "WinHttpGetProxyForUrl" (Indicator: "WinHttpGetProxyForUrl"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "WinHttpSetOption" (Indicator: "WinHttpSetOption"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp")42:T2367,Heuristic match: "`l.cn" Heuristic match: "jc.ws" Heuristic match: ":v.gu" Heuristic match: "mrg_c^.cv" Heuristic match: "ff.cv" Heuristic match: "ocsp.sectigo.com" Heuristic match: "get /mfewtzbnmeswstajbgurdgmcgguabbsde3gf41waic8uh9lf92%2bijqh5qwqumuusmv81lkgvkebccca2kvwxheycedpxckirqfmz4qw70zm5rw4%3d http/1.1connection: keep-aliveaccept: */*user-agent: microsoft-cryptoapi/10.0host: ocsp.sectigo.com" Heuristic match: "get /mfewtzbnmeswstajbgurdgmcgguabbrd0jozuyxmqqw4y4zjtrlcmcrskaqugtksqssozubixklgkjks7eippxqcecvgof5dm4ckjwgxosbi7bu%3d http/1.1connection: keep-aliveaccept: */*user-agent: microsoft-cryptoapi/10.0host: ocsp.sectigo.com" Heuristic match: "ocsp.digicert.com" Heuristic match: "crl3.digicert.com" Heuristic match: "crl4.digicert.com" Pattern match: "www.windowblinds.net" Pattern match: "https://forums.stardock.com/486023/windowblinds-support-faq#chromeskin" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Pattern match: "www.microsoft.com" Heuristic match: "=c:\e3913.cd.akamaiedge.net" Heuristic match: "e3913.cd.akamaiedge.net" Pattern match: "crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl" Pattern match: "http://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbtjzy2p9pa8oibmj%2bnsmwsz63kmwgquuhbzbu2fl3mpdpovdyxqii%2beyg8ceaver%2founqg5pr%2fbp1%2flyry%3d" Pattern match: "http://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbsrxerf0efeswrriptgtkcjwmm7iqquadfg67y7%2bf8rhvv%2byxsiigx0tkiceaksyfpiaxyqctpmuex%2bbei%3d" Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com1!0" Heuristic match: "ntrust.net" Pattern match: "http://ocsp.digicert.com0c" Pattern match: "cacerts.digicert.com/digicertassuredidrootca.crt0e" Pattern match: "crl3.digicert.com/digicertassuredidrootca.crl0" Pattern match: "http://ocsp.digicert.com0a" Pattern match: "cacerts.digicert.com/digicerttrustedrootg4.crt0c" Pattern match: "crl3.digicert.com/digicerttrustedrootg4.crl0" Pattern match: "crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0" Pattern match: "http://ocsp.digicert.com0x" Pattern match: "cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0" Pattern match: "crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0s" Pattern match: "crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0" Pattern match: "http://www.digicert.com/cps0" Pattern match: "http://ocsp.digicert.com0\" Pattern match: "cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "csp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbt3xl4lqlxdrdm9p665tw442vrsuqqureuir%2fssy4ixlvglp6chnfntya8cea6bgi750c3n79tq4ghagfo%3d" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Heuristic match: "m .ph" Pattern match: "0www.entrust.net/cps" Pattern match: "http://www.microsoft.com0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Heuristic match: "host: crl4.digicert.com" Heuristic match: "host: crl3.digicert.com" Heuristic match: "digicert.com" Pattern match: "http://crl3.digicert.com/digicertassuredidrootca.crl" Heuristic match: "rl3.digicert.com" Pattern match: "crl3.digicert.com/digicerttrustedrootg4.crl" Pattern match: "cacerts.digicert.com/digicerttrus" Pattern match: "http://ocsp.digicert.com" Heuristic match: "crl.edge.digicert.com" Heuristic match: "cac-ocsp.digicert.com.edgekey.net" Heuristic match: "acrl3.digicert.com" Pattern match: "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl" Pattern match: "http://crl3.digicert.com/digicerttrustedrootg4.crl" Pattern match: "http://ctlp.digicert.com/" Pattern match: "crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl" Pattern match: "http://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl" Pattern match: "ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbsrxerf0efeswrriptgtkcjwmm7iqquadfg67y7%2bf8rhvv%2byxsiigx0tkiceaksyfpiaxyqctpmuex%2bbei%3d" Pattern match: "crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl" Pattern match: "crl.microsoft.com/pki/crl/prod,c" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl4.digicert.com/dig" Pattern match: "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl" Heuristic match: "//ocsp.digicert.com" Heuristic match: "cert.com" Pattern match: "https://www.stardock.com/products/start10" Pattern match: "https://www.stardock.com/products/start8" Pattern match: "https://api.wincustomize.com/v1/library/1/categories" Pattern match: "https://www.wincustomize.com/explore/all/author/" Pattern match: "https://redirects.stardock.com/skinstudio/product" Pattern match: "https://www.skinstudio.net" Pattern match: "https://esupport.stardock.com/index.php?/default_import/knowledgebase/article/view/424/124/windowblinds-states-that-windowblinds-is-not-installed-correctly-on-this-pc" Pattern match: "https://redirects.stardock.com/skinstudio/8.0/product" Pattern match: "https://redirects.stardock.com/windowblinds/8.0/product" Pattern match: "https://services.stardock.net/apptrials/activate" Pattern match: "https://redirects.stardock.com/windowblinds/11.0/purchase" Pattern match: "https://api.wincustomize.com/v1/library/1/skins" Heuristic match: "animations.info" Heuristic match: "toolbaricons.info" Pattern match: "https://store.steampowered.com/app/2294630/windowblinds_11/" Pattern match: "https://www.stardock.com/products/windowblinds" Pattern match: "https://redirects.stardock.com/windowblinds/11.0/support-faq" Pattern match: "https://www.stardock.com/products/windowblinds/" Pattern match: "https://www.wincustomize.com/skins.aspx?libid=1" Pattern match: "ts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0" Heuristic match: "api.stardock.net"43:T79c9,Found URL "https://forums.stardock.com/486023/windowblinds-support-faq" - Source: "00000000-00003824.00000000.138542.005F6000.00000002.mdmp") Found URL "http://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbtjzy2p9pa8oibmj%2bnsmwsz63kmwgquuhbzbu2fl3mpdpovdyxqii%2beyg8ceaver%2founqg5pr%2fbp1%2flyry%3dendphtepschehttp://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbsrxerf0efeswrriptgtkcjwmm7iqquadfg67y7%2bf8rhvv%2byxsiigx0tkiceaksyfpiaxyqctpmuex%2bbei%3dendphtepscheendpfhhtepschehomedrive=c:os=windows_ntsystemdrive=c:" - Source: "00000000-00003824.00000000.138542.032E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00003824.00000000.138542.0333E000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00003824.00000000.138542.0333E000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00003824.00000000.138542.0333E000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0a7hiw.%x%w" - Source: "00000000-00003824.00000000.138542.0333E000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0p2dxc\" - Source: "00000000-00003824.00000000.138542.0333E000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00003824.00000000.138542.0333E000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00003824.00000000.138542.0333E000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00003824.00000000.138542.0333E000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003824.00000000.138542.0333E000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003824.00000000.138542.0333E000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003824.00000000.138542.0333E000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcglobalsign" - Source: "00000000-00003824.00000000.138542.0333E000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00003824.00000000.138542.0333E000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00003824.00000000.138542.0333E000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eaucoonew" - Source: "00000000-00003824.00000000.138542.0333E000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.-xgj%ory08>=i@iqoz" - Source: "00000000-00003824.00000000.138542.0333E000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003824.00000000.138542.0333E000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00003824.00000000.138542.0333E000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00003824.00000000.138542.0333E000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicertassuredidrootca.crlapplion" - Source: "00000000-00003824.00000000.138542.03389000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicertassuredidrootca.crlertduovadis" - Source: "00000000-00003824.00000000.138542.03389000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicertassuredidrootca.crl32905_*e3913.cd.akamaiedge.netcrl.edge.digicert.comcac-ocsp.digicert.com.edgekey.netcrl3.digicert.comcrl.edge.digicert.comicrosoft" - Source: "00000000-00003824.00000000.138542.03389000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlcsp:http://ocsp.digicert.comhttp://crl3.digicert.com/digicerttrustedrootg4.crlondemandconnroutehelper.dllondemandconnroutehelper.dllondemandconnroutehelper.dllhttp://ctlp.digicert.com/ocsp.digicert.come3913.cd.akamaiedge.netcrl4.digicert.com??\c:\windows\system32\rpcss.dll??\c:\windows\system32\imageres.dll??\c:\windows\system32\imageres.dll:\windows\system32\imageres.dll:\windows\system32\imageres.dll:\windows\system32\kernelbase.dll:\windows\system32\imageres.dllecurity=impersonation" - Source: "00000000-00003824.00000000.138542.03389000.00000004.mdmp") Found URL "http://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crligidigicert," - Source: "00000000-00003824.00000000.138542.03389000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlmeiryosegoeui.ttf,segoe" - Source: "00000000-00003824.00000000.138542.03389000.00000004.mdmp") Found URL "http://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlmalgun" - Source: "00000000-00003824.00000000.138542.03389000.00000004.mdmp") Found URL "http://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbtjzy2p9pa8oibmj%2bnsmwsz63kmwgquuhbzbu2fl3mpdpovdyxqii%2beyg8ceaver%2founqg5pr%2fbp1%2flyry%3drosoft\cryptneturlcache\con3ohdvhfrqwdfwvxssruwzlwkhuuruphvvdjh" - Source: "00000000-00003824.00000000.138542.03389000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicerttrustedrootg4.crlu9.w?bjeit+l:oun" - Source: "00000000-00003824.00000000.138542.03389000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/prod,ccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2-03-29.crt0wx" - Source: "00000000-00003824.00000000.138542.03389000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00003824.00000000.138542.03389000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0a7hiw.%x%w" - Source: "00000000-00003824.00000000.138542.03DC0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digstedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0p2dxc\" - Source: "00000000-00003824.00000000.138542.03DC0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl:\users\hapubws\appdata\locallow\microsoft\cryptneturlcache\metadata\103e497cc28a174a9b7a2a96cab452fad03d:\users\hapubws\appdata\locallow\microsoft\cryptneturlcache\content\1a374813edb1a6631387e414d3e73232:\users\hapubws\appdata\locallow\microsoft\cryptneturlcache\content\329b6147266c1e26cd774ea22b79ec2eystem\currentcontrolset\services\tcpip6\parameters\interfaces\" - Source: "00000000-00003824.00000000.138542.062A0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crlc:\windows\system32\ondemandconnroutehelper.dlld03d:\users\hapubws\appdata\locallow\microsoft\cryptneturlcache\metadata\329b6147266c1e26cd774ea22b79ec2e:\users\hapubws\appdata\locallow\microsoft\cryptneturlcache\metadata\1a374813edb1a6631387e414d3e73232ystem\currentcontrolset\services\tcpip\parameters\interfaces\" - Source: "00000000-00003824.00000000.138542.062A0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crlystem\currentcontrolset\services\tcpip6\parameters\interfaces\" - Source: "00000000-00003824.00000000.138542.062A0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlicmarshalwndclasssctfime" - Source: "00000000-00003824.00000000.138542.062A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003824.00000000.138542.062B0000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl??\c:\users\hapubws\appdata\locallow\microsoft\cryptneturlcache\content\1a374813edb1a6631387e414d3e73232:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\??\c:\users\hapubws\appdata\locallow\microsoft\cryptneturlcache\metadata\1a374813edb1a6631387e414d3e73232??\c:\users\hapubws\appdata\locallow\microsoft\cryptneturlcache\content\329b6147266c1e26cd774ea22b79ec2e:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\isallowedcert_autoupdate_1subcamicrosofte3913.cd.akamaiedge.netcrl3.digicert.commingliu.ttc,pmingliusimsun.ttc,simsunbatang.ttc,batangyugothm.ttc,yu" - Source: "00000000-00003824.00000000.138542.062D2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00003824.00000000.138542.062D2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003824.00000000.138542.062D2000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*luxl/dnsrzzzzuriu/mfewtzbnmeswstajbgurdgmcgguabbtfis%2bljdtgwq09xeb1yeq%2btx%2bbgqqu7nfjgtjxxwrm3y5np%2be6mk4cd08ceac2n7ckvhzyr6z9kgyqxls%3d" - Source: "00000000-00003824.00000000.138542.062D2000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlmhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0bx" - Source: "00000000-00003824.00000000.138542.062D2000.00000004.mdmp") Found URL "https://www.stardock.com/products/start10https://www.stardock.com/products/start8search...hide" - Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found URL "https://api.wincustomize.com/v1/library/1/categoriessidefirstrunnolinewp_1origoffsetcur_contextobtaining" - Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found URL "https://http://----------you" - Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found URL "https://www.wincustomize.com/explore/all/author/http(" - Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found URL "https://redirects.stardock.com/skinstudio/productfail" - Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found URL "https://www.skinstudio.netbuy" - Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found URL "https://esupport.stardock.com/index.php?/default_import/knowledgebase/article/view/424/124/windowblinds-states-that-windowblinds-is-not-installed-correctly-on-this-pcproblem" - Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found URL "https://redirects.stardock.com/skinstudio/8.0/producthttps://redirects.stardock.com/windowblinds/8.0/productskinnameskinuisnameskinauthorskincategoryskindateno" - Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found URL "https://services.stardock.net/apptrials/activate?code" - Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found URL "https://redirects.stardock.com/windowblinds/11.0/purchasestring" - Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found URL "https://api.wincustomize.com/v1/library/1/skins?&featured=true&sortorder=2&sortorder=3&sortorder=2categories=&premium=false&sortorder=4&search=&w=%ddownloadsdownloaddate&page=%dsegoe" - Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found URL "https://store.steampowered.com/app/2294630/windowblinds_11/https://www.stardock.com/products/windowblindssoftware\stardock\misc\windowblindssteampath\windowblindsbootstrap.exe/updatecheckhttps://redirects.stardock.com/windowblinds/11.0/support-faqchrome.exeactivefix%d%%" - Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found URL "https://www.stardock.com/products/windowblinds/stardock\stardock\wbthumb\wbosetprocessdpiawareuninstallwbafilewbafile\shellwbafile\shell\openfinalsoftware\policies\libreoffice\org.openoffice.office.common\vcl\useopenglsoftware\policies\libreoffice\org.openoffice.office.common\vcl\forceopenglvalueinstallwindowblinds" - Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found URL "https://www.wincustomize.com/skins.aspx?libid=1deleteskinwintrust.dllwinverifytruststardock" - Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found URL "http://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbtjzy2p9pa8oibmj%2bnsmwsz63kmwgquuhbzbu2fl3mpdpovdyxqii%2beyg8ceaver%2founqg5pr%2fbp1%2flyry%3dendphtepschepvmrhttp://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbsrxerf0efeswrriptgtkcjwmm7iqquadfg67y7%2bf8rhvv%2byxsiigx0tkiceaksyfpiaxyqctpmuex%2bbei%3dendphtepscheendpfhhtepschehomedrive=c:os=windows_ntsystemdrive=c:" - Source: "00000000-00003824.00000001.138816.032E0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0c7http://cacerts.digicert.com/digicertassuredidrootca.crt0e>0<0:4http://crl3.digicert.com/digicertassuredidrootca.crl0jz/-5fjitwz\t" - Source: "00000000-00003824.00000001.138816.0333E000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0" - Source: "00000000-00003824.00000001.138816.0333E000.00000004.mdmp") Found URL "http://ocsp.digicert.com0a5http://cacerts.digicert.com/digicerttrustedrootg4.crt0c<0:082http://crl3.digicert.com/digicerttrustedrootg4.crl0:" - Source: "00000000-00003824.00000001.138816.0333E000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0a7hiw.%x%w" - Source: "00000000-00003824.00000001.138816.0333E000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0http://ocsp.digicert.com0\phttp://cacerts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0p2dxc\" - Source: "00000000-00003824.00000001.138816.0333E000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00003824.00000001.138816.0333E000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00003824.00000001.138816.0333E000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00003824.00000001.138816.0333E000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003824.00000001.138816.0333E000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003824.00000001.138816.0333E000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003824.00000001.138816.0333E000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcglobalsign" - Source: "00000000-00003824.00000001.138816.0333E000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00003824.00000001.138816.0333E000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00003824.00000001.138816.0333E000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eaucoonew" - Source: "00000000-00003824.00000001.138816.0333E000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.-xgj%ory08>=i@iqoz" - Source: "00000000-00003824.00000001.138816.0333E000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003824.00000001.138816.0333E000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00003824.00000001.138816.0333E000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00003824.00000001.138816.0333E000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicertassuredidrootca.crlapplhttp://crl3.digicert.com/digicertassuredidrootca.crluovadis" - Source: "00000000-00003824.00000001.138816.03389000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicertassuredidrootca.crl32905_*e3913.cd.akamaiedge.netcrl.edge.digicert.comcac-ocsp.digicert.com.edgekey.netcrl3.digicert.comcrl.edge.digicert.comicrosoft" - Source: "00000000-00003824.00000001.138816.03389000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlcsp:http://ocsp.digicert.comhttp://crl3.digicert.com/digicerttrustedrootg4.crlondemandconnroutehelper.dllondemandconnroutehelper.dllondemandconnroutehelper.dllhttp://ctlp.digicert.com/ocsp.digicert.come3913.cd.akamaiedge.netcrl4.digicert.com:\0f78b956-909d-45b2-8b8d-2e5e1d522649:\0f78b956-909d-45b2-8b8d-2e5e1d522649??\c:\windows\system32\user32.dll:\windows\system32\kernelbase.dll:\windows\system32\kernelbase.dll:\windows\system32\coremessaging.dllaa80e7f7-2021-11d2-93e0-0060b067b86e" - Source: "00000000-00003824.00000001.138816.03389000.00000004.mdmp") Found URL "http://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlstry\machine\software\classes\clsid\" - Source: "00000000-00003824.00000001.138816.03389000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crlmeiryosegoeui.ttf,segoe" - Source: "00000000-00003824.00000001.138816.03389000.00000004.mdmp") Found URL "http://crl4.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl:\windows\registration\r000000000018.clbeiryo.ttc,meiryo" - Source: "00000000-00003824.00000001.138816.03389000.00000004.mdmp") Found URL "http://ocsp.digicert.com/mfewtzbnmeswstajbgurdgmcgguabbtjzy2p9pa8oibmj%2bnsmwsz63kmwgquuhbzbu2fl3mpdpovdyxqii%2beyg8ceaver%2founqg5pr%2fbp1%2flyry%3drosoft\cryptneturlcache\conu9.w?bjeit+heapheapheapheapheapheapheapheapheapheapheapheapl:ouheapheapheapheapheapn" - Source: "00000000-00003824.00000001.138816.03389000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00003824.00000001.138816.03389000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl0http://ocsp.digicert.com0xlhttp://cacerts.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crt0.%x%w" - Source: "00000000-00003824.00000001.138816.03DC0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crl0smhttp://crl4.digicert.com/digstedg4codesigningrsa4096sha3842021ca1.crl0>705030)0'http://www.digicert.com/cps0ts.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crt0p2dxc\" - Source: "00000000-00003824.00000001.138816.03DC0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicerttrustedg4codesigningrsa4096sha3842021ca1.crltatice" - Source: "00000000-00003824.00000001.138816.062A0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003824.00000001.138816.062B2000.00000004.mdmp") Found URL "http://ocsp.digicert.comhttp://crl3.digicert.com/digicerttrustedg4rsa4096sha256timestampingca.crl??\c:\users\hapubws\appdata\locallow\microsoft\cryptneturlcache\content\1a374813edb1a6631387e414d3e73232:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\??\c:\users\hapubws\appdata\locallow\microsoft\cryptneturlcache\metadata\1a374813edb1a6631387e414d3e73232:\windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\isallowedcert_autoupdate_1subcamicrosofte3913.cd.akamaiedge.netcrl3.digicert.commingliu.ttc,pmingliusimsun.ttc,simsunbatang.ttc,batangyugothm.ttc,yu" - Source: "00000000-00003824.00000001.138816.062D2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00003824.00000001.138816.062D2000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003824.00000001.138816.062D2000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*luxl/dnsruriu/mfewtzbnmeswstajbgurdgmcgguabbtfis%2bljdtgwq09xeb1yeq%2btx%2bbgqqu7nfjgtjxxwrm3y5np%2be6mk4cd08ceac2n7ckvhzyr6z9kgyqxls%3d" - Source: "00000000-00003824.00000001.138816.062D2000.00000004.mdmp") Found URL "http://'" - Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found URL "https://posthttps" - Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found URL "https://http" - Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found URL "http://httpshttp" - Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp")44:T5e8,Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base62 string in header "2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kV" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base62 string in header "MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCECVgOf5DM4ckJwGXosBI7BU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base62 string in header "JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQS" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCECVgOf5DM4ckJwGXosBI7BU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com" Contains base62 string in header "sozUbIxKLGKjkS7EipPxQCECVgOf5DM4c" in header "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCECVgOf5DM4ckJwGXosBI7BU%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/10.0Host: ocsp.sectigo.com"45:T500,Found registry query API: "RegOpenKeyTransactedW" in "00000000-00003824.00000001.138816.00574000.00000002.mdmp" Found registry query API: "RegOpenKeyA" in "00000000-00003824.00000001.138816.00574000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00003824.00000001.138816.00574000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00003824.00000001.138816.00574000.00000002.mdmp" Found registry query API: "RegEnumValueA" in "00000000-00003824.00000001.138816.00574000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp" Found registry query API: "RegEnumKeyW" in "00000000-00003824.00000001.138816.00574000.00000002.mdmp" Found registry query API: "RegQueryValueW" in "00000000-00003824.00000001.138816.00574000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00003824.00000001.138816.00574000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00003824.00000001.138816.00574000.00000002.mdmp"46:T414,file/memory contains long string with (Indicator: "aes"; File: "Rurt.sc") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00003824.00000000.138542.032E0000.00000004.mdmp, 00000000-00003824.00000000.138542.0333E000.00000004.mdmp, 00000000-00003824.00000001.138816.032E0000.00000004.mdmp, 00000000-00003824.00000001.138816.0333E000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003824.00000000.138542.032E0000.00000004.mdmp, 00000000-00003824.00000001.138816.032E0000.00000004.mdmp") Found string "SOFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003824.00000000.138542.03389000.00000004.mdmp") Found string "OFTWARE\Microsoft\Cryptography\Defaults\Provider\Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003824.00000000.138542.062A0000.00000004.mdmp, 00000000-00003824.00000001.138816.062A0000.00000004.mdmp")47:T435,Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "CreateDCW" (Indicator: "CreateDC"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp")48:T5ed,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "GetModuleHandleExA" (Indicator: "GetModuleHandle"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp")49:Tde4,Found reference to API "GetFileAttributesTransactedW" (Indicator: "GetFileAttributes"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeA" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "GetFileVersionInfoA" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "GetFileAttributesExA" (Indicator: "GetFileAttributes"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "PathFindFileNameW" (Indicator: "PathFindFileName"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "GetCurrentDirectoryA" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp")4a:T7b7,Found reference to API "GetSidIdentifierAuthority" (Indicator: "GetSidIdentifierAuthority"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "GetSidSubAuthority" (Indicator: "GetSidSubAuthority"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthority"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "GetSidSubAuthorityCount" (Indicator: "GetSidSubAuthorityCount"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "IsValidSid" (Indicator: "IsValidSid"; Source: "00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "CreateWellKnownSid" (Indicator: "CreateWellKnownSid"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "InitializeSecurityDescriptor" (Indicator: "InitializeSecurityDescriptor"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "SetSecurityDescriptorDacl" (Indicator: "SetSecurityDescriptorDacl"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "GetSecurityDescriptorSacl" (Indicator: "GetSecurityDescriptorSacl"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp") Found reference to API "SetSecurityDescriptorSacl" (Indicator: "SetSecurityDescriptorSacl"; Source: "00000000-00003824.00000001.138816.72C33000.00000002.mdmp")4b:T931,"BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPV6DOMAIN"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "BinaryTransponder.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DEBUGFLAGS"; Value: "")4c:Tda1,Dropped file: "BinaryTransponder.exe" - Location: [%LOCALAPPDATA%\Fusser_Data\BinaryTransponder.exe]- [targetUID: 00000000-00003824] Dropped file: "SdAppServices.dll" - Location: [%LOCALAPPDATA%\Fusser_Data\SdAppServices.dll]- [targetUID: 00000000-00003824] Dropped file: "1A374813EDB1A6631387E414D3E73232" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\1A374813EDB1A6631387E414D3E73232]- [targetUID: 00000000-00003824] Dropped file: "3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95]- [targetUID: 00000000-00003824] Dropped file: "C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141]- [targetUID: 00000000-00003824] Dropped file: "C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB]- [targetUID: 00000000-00003824] Dropped file: "8EC9B1D0ABBD7F98B401D425828828CE_B460DBDB6691F360C14B4617119E5588" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_B460DBDB6691F360C14B4617119E5588]- [targetUID: 00000000-00003824] Dropped file: "698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB]- [targetUID: 00000000-00003824] Dropped file: "3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95]- [targetUID: 00000000-00003824] Dropped file: "C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB]- [targetUID: 00000000-00003824] Dropped file: "C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141]- [targetUID: 00000000-00003824] Dropped file: "8EC9B1D0ABBD7F98B401D425828828CE_B460DBDB6691F360C14B4617119E5588" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_B460DBDB6691F360C14B4617119E5588]- [targetUID: 00000000-00003824] Dropped file: "698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB]- [targetUID: 00000000-00003824] Dropped file: "1A374813EDB1A6631387E414D3E73232" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\1A374813EDB1A6631387E414D3E73232]- [targetUID: 00000000-00003824] Dropped file: "329B6147266C1E26CD774EA22B79EC2E" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\329B6147266C1E26CD774EA22B79EC2E]- [targetUID: 00000000-00003824] Dropped file: "329B6147266C1E26CD774EA22B79EC2E" - Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\329B6147266C1E26CD774EA22B79EC2E]- [targetUID: 00000000-00003824]4d:T94f,"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/10.0 Host: ocsp.sectigo.com" Response ==> HTTP/1.1 200 OK Date: Fri 06 Feb 2026 12:09:39 GMT Content-Type: application/ocsp-response Content-Length: 765 Connection: keep-alive Server: cloudflare CF-Ray: 9c9a8a35ce8e4f1b-SJC CF-Cache-Status: HIT Accept-Ranges: bytes Age: 97 Cache-Control: max-age=328094 s-maxage=1800 public no-transform must-revalidate ETag: "d3cb296bd3c929c02a5cbd9908b7be04db0cc13c" Expires: Tue 10 Feb 2026 06:56:27 GMT Last-Modified: Tue 03 Feb 2026 06:56:28 GMT Vary: Accept-Encoding X-CCACDN-Proxy-ID: scdpinlb5 X-Frame-Options: SAMEORIGIN Set-Cookie: __cf_bm=gZalFr0ugpBPMmRtojxjO5QIFhYD18m0V.EYzjRp9bI-1770379779-1.0.1.1-8IJ95EpxVAYiZ24jf9DSjbKUF89SowDDWpESmOPw5OyMyzU0cH5__c.mchfcHDnH0Smqj4LzKAAVL7HTC_YSygIc0il8BbU6B70QC.pwjuw; path=/; expires=Fri 06-Feb-26 12:39:39 GMT; domain=.ocsp.sectigo.com; HttpOnly with response body ==>30C28202C3B90A0100C2A0C28202C3B230C28202C3AE06092B060105050730010104C28202C39F30C28202C39B30C281C384C2A216041432C3ABC292C29AC3BF....... "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCECVgOf5DM4ckJwGXosBI7BU%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/10.0 Host: ocsp.sectigo.com" Response ==> HTTP/1.1 200 OK Date: Fri 06 Feb 2026 12:09:39 GMT Content-Type: application/ocsp-response Content-Length: 637 Connection: keep-alive Server: cloudflare CF-Ray: 9c9a8a365f504f1b-SJC CF-Cache-Status: MISS Accept-Ranges: bytes Cache-Control: max-age=485922 s-maxage=1800 public no-transform must-revalidate ETag: "78920a1d7de39745f55bcfa343d7740ab4239088" Expires: Thu 12 Feb 2026 03:05:46 GMT Last-Modified: Thu 05 Feb 2026 03:05:47 GMT Vary: Accept-Encoding X-CCACDN-Proxy-ID: scdpinlb4 X-Frame-Options: SAMEORIGIN Set-Cookie: __cf_bm=mowtDdd5wDgeGyXgxteaOqLN5ZCC1lhLbo0innHHAUE-1770379779-1.0.1.1-QrhwWF8Wz.OnGWcLvk_DVPhUHNUrhwURVhaKjQO1UtbN0RfzJYglg23DZUH_kn6ku6y2VE891miS9Wvo.r6_a2KtHX3waUgIsh8a_zR75og; path=/; expires=Fri 06-Feb-26 12:39:39 GMT; domain=.ocsp.sectigo.com; HttpOnly with response body ==>30C28202790A0100C2A0C282027230C282026E06092B060105050730010104C282025F30C282025B30C281C384C2A2160414C28132C292412B28C38D46C388C3.......4e:Ta92,"BinaryTransponder.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "BinaryTransponder.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "BinaryTransponder.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "BinaryTransponder.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "BinaryTransponder.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA") "BinaryTransponder.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES") "BinaryTransponder.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS") "BinaryTransponder.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS") "BinaryTransponder.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "BinaryTransponder.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "BinaryTransponder.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "BinaryTransponder.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "BinaryTransponder.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED") "BinaryTransponder.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES") "BinaryTransponder.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS") "BinaryTransponder.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS") "BinaryTransponder.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT") "BinaryTransponder.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES") "BinaryTransponder.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS") "BinaryTransponder.exe" (Access type: "CREATE"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS") "BinaryTransponder.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE") "BinaryTransponder.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"8ca17f8770bf57d63512f5689c3cfaa0ea286cb553365595cf4ede21411324bf","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"suspicious","threat_score":77,"unified_at_epoch_ms":1792234116334,"unified_at":"2026-10-17T10:48:36.334Z","metadata":{"hashes":{"sha256":"8ca17f8770bf57d63512f5689c3cfaa0ea286cb553365595cf4ede21411324bf","sha1":"9b46ab9885768e8fe101db9545ee88e733058465","md5":"b552f5c14a03a6dab1d1227958ea1126","sha512":"982b1e4a9613898ef5b8ca1aa47ecbd0d1b4cb03d0971fc18cd97af2f61ae0601bcea5674fecb13596f848caf4b0c1605a87f261d7cf47c2a0514fa0c0b514a2","ssdeep":"98304:rwLz1Vy7mA4dWVqejlXJalaeCs9ARYR/7dYeEPi1DEWj5bAoZoEG:rwtVzAbBlZaz7xptEQwi1Y","ssdeep_chunks":["98304:rwLz1Vy","98304:wLz1Vy7","98304:Lz1Vy7m","98304:z1Vy7mA","98304:1Vy7mA4","98304:Vy7mA4d","98304:y7mA4dW","98304:7mA4dWV","98304:mA4dWVq","98304:A4dWVqe","98304:4dWVqej","98304:dWVqejl","98304:WVqejlX","98304:VqejlXJ","98304:qejlXJa","98304:ejlXJal","98304:jlXJala","98304:lXJalae","98304:XJalaeC","98304:JalaeCs","98304:alaeCs9","98304:laeCs9A","98304:aeCs9AR","98304:eCs9ARY","98304:Cs9ARYR","98304:s9ARYR/","98304:9ARYR/7","98304:ARYR/7d","98304:RYR/7dY","98304:YR/7dYe","98304:R/7dYeE","98304:/7dYeEP","98304:7dYeEPi","98304:dYeEPi1","98304:YeEPi1D","98304:eEPi1DE","98304:EPi1DEW","98304:Pi1DEWj","98304:i1DEWj5","98304:1DEWj5b","98304:DEWj5bA","98304:EWj5bAo","98304:Wj5bAoZ","98304:j5bAoZo","98304:5bAoZoE","98304:bAoZoEG","196608:rwLz1Vy","196608:wLz1Vy7","196608:Lz1Vy7m","196608:z1Vy7mA","196608:1Vy7mA4","196608:Vy7mA4d","196608:y7mA4dW","196608:7mA4dWV","196608:mA4dWVq","196608:A4dWVqe","196608:4dWVqej","196608:dWVqejl","196608:WVqejlX","196608:VqejlXJ","196608:qejlXJa","196608:ejlXJal","196608:jlXJala","196608:lXJalae","196608:XJalaeC","196608:JalaeCs","196608:alaeCs9","196608:laeCs9A","196608:aeCs9AR","196608:eCs9ARY","196608:Cs9ARYR","196608:s9ARYR/","196608:9ARYR/7","196608:ARYR/7d","196608:RYR/7dY","196608:YR/7dYe","196608:R/7dYeE","196608:/7dYeEP","196608:7dYeEPi","196608:dYeEPi1","196608:YeEPi1D","196608:eEPi1DE","196608:EPi1DEW","196608:Pi1DEWj","196608:i1DEWj5","196608:1DEWj5b","196608:DEWj5bA","196608:EWj5bAo","196608:Wj5bAoZ","196608:j5bAoZo","196608:5bAoZoE","196608:bAoZoEG","98304:rwtVzAb","98304:wtVzAbB","98304:tVzAbBl","98304:VzAbBlZ","98304:zAbBlZa","98304:AbBlZaz","98304:bBlZaz7","98304:BlZaz7x","98304:lZaz7xp","98304:Zaz7xpt","98304:az7xptE","98304:z7xptEQ","98304:7xptEQw","98304:xptEQwi","98304:ptEQwi1","98304:tEQwi1Y"],"imphash":"Unknown"},"file_info":{"file_name":"8ca17f8770bf57d63512f5689c3cfaa0ea286cb553365595cf4ede21411324bf.bin","file_type":["msi","data"],"file_type_id":"msi","file_size":5120000,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1770340135000,"last_seen":1770379744000,"last_multi_scan":1770379744000}},"detections":{"summary":{"verdict":"suspicious","score":77,"tags":null},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":67},"sandbox_signatures":{"informative_count":172,"suspicious_count":10,"malicious_count":0,"total":182},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/TrojanDownloader.Rugmi.BUP trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"TrojanDownloader.Rugmi","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Able to use GrayString API for text rendering"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"suspicious","value":"Modifies Software Policy Settings"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"},{"type":"informative","value":"Possible DLL sideloading"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"suspicious","value":"Spawned processes are likely due to an injection"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - Cryptographic algorithm using CryptoPP library"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to perform decryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"},{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API typically used to get active windows title"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Attempts to retrieve geographical location information"},{"type":"informative","value":"Contains ability to determine disk drive type (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to query network adapter information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"suspicious","value":"Calls an API possibly used to take screenshots"},{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"YARA signature match - Compress data using CryptoPP library"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"GETs files from a webserver"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Contains ability to perform RSA encryption using crypto++ library"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"BinaryTransponder.exe\" called \"FindResourceW\" with parameter \"3585\" - (UID: 00000000-00003824)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00003824.00000000.138542.032E0000.00000004.mdmp, 00000000-00003824.00000001.138816.032E0000.00000004.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00003824.00000000.138542.032E0000.00000004.mdmp, 00000000-00003824.00000001.138816.032E0000.00000004.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$29","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"BinaryTransponder.exe\" queried SystemProcessInformation at 00000000-00003824-00000C15-1133681291 [PID: 3824]\n \"BinaryTransponder.exe\" queried SystemProcessInformation at 00000000-00003824-00000C15-1133691509 [PID: 3824]\n \"BinaryTransponder.exe\" queried SystemProcessInformation at 00000000-00003824-00000C15-1134026372 [PID: 3824]\n \"BinaryTransponder.exe\" queried SystemProcessInformation at 00000000-00003824-00000C15-1134035450 [PID: 3824]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"CryptStringToBinaryW\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform RSA encryption using crypto++ library","description":"Found string \".?AVRSAPrimeSelector@CryptoPP@@\" (Indicator: \".?AVRSAPrimeSelector@CryptoPP@@\"; Source: \"00000000-00003824.00000000.138542.72C67000.00000004.mdmp, 00000000-00003824.00000001.138816.72C67000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":3,"id":"string-583","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2b","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.99696","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2c","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2d","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"file/memory contains long string with (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"20f189.rbs\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; Source: \"00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; Source: \"00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; Source: \"00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetUserGeoID\" (Indicator: \"getusergeoid\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsA\" in \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\"\n Found system information discovery API: \"GetMonitorInfoW\" in \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"GetTextCharsetInfo\" (Indicator: \"GetTextCharset\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"GetUserPreferredUILanguages\" (Indicator: \"GetUserPreferredUILanguages\"; Source: \"00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"EnumChildWindows\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"FindWindowA\" (Indicator: \"findwindow\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"BinaryTransponder.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00003824)\n \"BinaryTransponder.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00003824)\n \"BinaryTransponder.exe\" called \"EnumDisplayMonitors\" with parameters (UID: 00000000-00003824)\n \"BinaryTransponder.exe\" called \"GetAdaptersAddresses\" with parameters (UID: 00000000-00003824)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"BinaryTransponder.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003824)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"BinaryTransponder.exe\" called \"GetWindowTextW\" with parameter \"4f004b00\" - (UID: 00000000-00003824)\n \"BinaryTransponder.exe\" called \"GetWindowTextW\" with parameter \"WindowBlinds has detected a problem with core files.Please contact support with error message -7\" - (UID: 00000000-00003824)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\"BinaryTransponder.exe\" called \"GetActiveWindow\" (UID: 00000000-00003824)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"BinaryTransponder.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003824)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2e","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"?IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowA\" (Indicator: \"FindWindowA\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"BinaryTransponder.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"GetFileTime\" (Indicator: \"GetFileTime\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimePreciseAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionWB\" (Indicator: \"GetVersion\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"DllGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"VerSetConditionMask\" (Indicator: \"VerSetConditionMask\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"VerifyVersionInfoW\" (Indicator: \"VerifyVersionInfo\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk (API string)","description":"Found reference to API \"PathFileExistsA\" (Indicator: \"PathFileExist\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"PathFileExistsW\" (Indicator: \"PathFileExist\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-140","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %LOCALAPPDATA%\\FUSSER_DATA\\SDAPPSERVICES.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$30","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"BinaryTransponder.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"BinaryTransponder.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyTransactedW\" in \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyA\" in \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyW\" in \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Able to use GrayString API for text rendering","description":"Found reference to API \"GrayStringW\" (Indicator: \"GrayStringW\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-900","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$31","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$32","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"BinaryTransponder.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003824)\n \"BinaryTransponder.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003824)\n \"BinaryTransponder.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003824)\n \"BinaryTransponder.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00003824)\n \"BinaryTransponder.exe\" called \"LoadLibrary\" with a parameter api-ms-win-appmodel-runtime-l1-1-1 (UID: 00000000-00003824)\n \"BinaryTransponder.exe\" called \"LoadLibrary\" with a parameter %LOCALAPPDATA%\\Fusser_Data\\SdAppServices.dll (UID: 00000000-00003824)\n \"BinaryTransponder.exe\" called \"LoadLibrary\" with a parameter Wintrust.dll (UID: 00000000-00003824)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$33","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ocsp.sectigo.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Select any substyle from the box above.\" (Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp, Indicator: \"select any substyle from the box above.\")\n \"Select a different wallpaper image for your desktop from the list on the right.\" (Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp, Indicator: \"select a different wallpaper image for your desktop from the list on the right.\")\n \"Select from additional styles included with this style, or from presets created by yourself.\" (Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp, Indicator: \"select from additional styles included with this style, or from presets created by yourself.\")\n \"SELECT * FROM\" (Source: 00000000-00003824.00000001.138816.72C33000.00000002.mdmp, Indicator: \"select * from\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileTransactedW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"CreateFileA\" (Indicator: \"CreateFile\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$34","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteA\" (Indicator: \"ShellExecute\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; Source: \"00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"FindResourceA\" (Indicator: \"FindResource\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"FreeResource\" (Indicator: \"FreeResource\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolTimer\" (Indicator: \"CreateThread\"; Source: \"00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWait\" (Indicator: \"CreateThread\"; Source: \"00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"CreateThreadpoolWork\" (Indicator: \"CreateThread\"; Source: \"00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"Setting skin in OnShowWindow FROM\" (Indicator: \"ShowWindow\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$35","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process BinaryTransponder.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3824:168:WilStaging_02\"\n Process BinaryTransponder.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:3824:64:WilError_01\"\n Process BinaryTransponder.exe created mutex with name \"Local\\SM0:3824:168:WilStaging_02\"\n Process BinaryTransponder.exe created mutex with name \"SM0:3824:64:WilError_01\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"BinaryTransponder.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"SdAppServices.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"premium-server@thawte.com\"\n Pattern match: \"no-reply@stardock.com\"\n Pattern match: \"support@stardock.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\WBServer","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$36","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"Found string \"User-Agent: Microsoft-CryptoAPI/10.0\" (Indicator: \"user-agent: \"; Source: \"00000000-00003824.00000000.138542.0333E000.00000004.mdmp, 00000000-00003824.00000001.138816.0333E000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$37","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at AF290000\n \"msiexec.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at ADF10000\n \"BinaryTransponder.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 759A0000\n \"BinaryTransponder.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 734A0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 7FCB0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"msiexec.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at B05A0000\n \"BinaryTransponder.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74600000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"8ca17f8770bf57d63512f5689c3cfaa0ea286cb553365595cf4ede21411324bf.bin\" was detected as \"Microsoft Installer(MSI)\" and name: \"Installer\"\n \"8ca17f8770bf57d63512f5689c3cfaa0ea286cb553365595cf4ede21411324bf.bin\" was detected as \"Microsoft Compound\" and name: \"Data\"\n \"BinaryTransponder.exe\" was detected as \"Microsoft Installer(MSI)\" and name: \"Installer\"\n \"BinaryTransponder.exe\" was detected as \"Microsoft Compound\" and name: \"Data\"\n \"SdAppServices.dll\" was detected as \"Microsoft Installer(MSI)\" and name: \"Installer\"\n \"SdAppServices.dll\" was detected as \"Microsoft Compound\" and name: \"Data\"\n \"wblindp2.dll\" was detected as \"Microsoft Installer(MSI)\" and name: \"Installer\"\n \"wblindp2.dll\" was detected as \"Microsoft Compound\" and name: \"Data\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"msiexec.exe\" (UID: 00000000-00001744) was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, PROCESSOR_ARCHITECTURE, PSModulePath, APPDATA, USERNAME, CommonProgramFiles, Path, PATHEXT, TEMP, USERPROFILE, TMP, ProgramFiles\"\n Process \"msiexec.exe\" (UID: 00000000-00001744) was launched with missing environment variables: \"USERDOMAIN_ROAMINGPROFILE, LOGONSERVER, PROMPT, OneDrive, PROCESSOR_ARCHITEW6432, HOMEPATH, HOMEDRIVE\"\n Process \"BinaryTransponder.exe\" (UID: 00000000-00003824) was launched with new environment variables: \"USERDOMAIN_ROAMINGPROFILE=\"DESKTOP-FVVF82A\", LOGONSERVER=\"%HOSTNAME%\", OneDrive=\"%USERPROFILE%\\OneDrive\", HOMEPATH=\"\\Users\\%OSUSER%\", HOMEDRIVE=\"C:\"\"\n Process \"BinaryTransponder.exe\" (UID: 00000000-00003824) was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, TEMP, USERPROFILE, TMP\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"ocsp.sectigo.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"BinaryTransponder.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"BinaryTransponder.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"BinaryTransponder.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"BinaryTransponder.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"BinaryTransponder.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\\GEO\"; Key: \"NATION\")\n \"BinaryTransponder.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00001744)\n Spawned process \"BinaryTransponder.exe\" (UID: 00000000-00003824)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"msiexec.exe\" with commandline \"/V\" (UID: 00000000-00001744)\n Spawned process \"BinaryTransponder.exe\" (UID: 00000000-00003824)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"BinaryTransponder.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"SdAppServices.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"wblindp2.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"BinaryTransponder.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$38","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"MSIF2D0.tmp\" has type \"data\"","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$39","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"SdAppServices.dll\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections\"- Location: [%LOCALAPPDATA%\\Fusser_Data\\SdAppServices.dll]- [targetUID: 00000000-00003824]\n \"wblindp2.dll\" has type \"PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"BinaryTransponder.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Fusser_Data\\BinaryTransponder.exe\" (UID: 3824)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"BinaryTransponder.exe\" called \"NtQueueApcThread\" (UID: 00000000-00003824)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"BinaryTransponder.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\fusser_data\\sdappservices.dll\"\n \"BinaryTransponder.exe\" reads file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\698460a0b6e60f2f602361424d832905_8bb23d43de574e82f2bee0df0ec47eeb\"\n \"BinaryTransponder.exe\" reads file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\c8e534ee129f27d55460ce17fd628216_1130d9b25898b0db0d4f04dc5b93f141\"\n \"BinaryTransponder.exe\" reads file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\c8e534ee129f27d55460ce17fd628216_56db209c155b5a05fcbf555df7e6d1bb\"\n \"BinaryTransponder.exe\" reads file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\3e3e9689537b6b136ecf210088069d55_ef6c9357bb54ddb629fd2d79f1594f95\"\n \"BinaryTransponder.exe\" reads file \"c:\\windows\\fonts\\staticcache.dat\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment using user register activity\n Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)\n Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$3c","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$3e","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"$3f","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"BinaryTransponder.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"33af4f0\"\n \"lpReserved\": \"0\"}\n \"BinaryTransponder.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"33ab9d8\"\n \"lpReserved\": \"0\"}\n \"BinaryTransponder.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"33c9030\"\n \"lpReserved\": \"0\"}\n \"BinaryTransponder.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"62d86b8\"\n \"lpReserved\": \"0\"}\n \"BinaryTransponder.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"33a9e38\"\n \"lpReserved\": \"0\"}\n \"BinaryTransponder.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"62adb18\"\n \"lpReserved\": \"0\"}\n \"BinaryTransponder.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"33d13f0\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D\"\n Found http requests in header \"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCECVgOf5DM4ckJwGXosBI7BU%3D\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectA\" (Indicator: \"InternetConnect\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"EstablishInternetConnection::WinHttpConnect failed\" (Indicator: \"InternetConnect\"; Source: \"00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestA\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"InitializeRequest::WinHttpOpenRequest failed\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"URLDownloadToCacheFileW\" (Indicator: \"URLDownload\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"Unable to connect to the servers.\" (Indicator: \" connect \"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"nvumdshimx.dll\" [Source: 00000000-00003824.00000001.138816.00574000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.37\"\n \"2.5.29.35\"\n \"2.5.29.31\"\n \"11.0.4.0\"\n \"2.5.29.19\"\n \"2.5.29.14\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.15\"\n \"2.5.29.32\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.20\"\n \"2.5.29.28\"\n \"2.5.29.17\"\n \"2.5.4.7\"\n \"2.5.29.10\"\n \"2.5.4.8\"\n \"2.5.4.3\"\n \"2.5.29.1\"\n \"2.5.29.16\"\n \"2.5.29.21\"\n \"2.5.4.10\"\n \"2.5.4.6\"\n \"2.5.4.11\"\n \"1.9.23.0\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$42","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$43","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"GET /DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00003824.00000000.138542.0333E000.00000004.mdmp, 00000000-00003824.00000001.138816.0333E000.00000004.mdmp\")\n Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00003824.00000000.138542.03389000.00000004.mdmp, 00000000-00003824.00000000.138542.062A0000.00000004.mdmp, 00000000-00003824.00000000.138542.062B0000.00000004.mdmp, 00000000-00003824.00000000.138542.062D2000.00000004.mdmp, 00000000-00003824.00000001.138816.03389000.00000004.mdmp, 00000000-00003824.00000001.138816.062A0000.00000004.mdmp, 00000000-00003824.00000001.138816.062B2000.00000004.mdmp, 00000000-00003824.00000001.138816.062D2000.00000004.mdmp\")\n Found string \"HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/10.0\nHost: ocsp.sectigo.com\n\n GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCECVgOf5DM4ckJwGXosBI7BU%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/10.0\nHost: ocsp.sectigo.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Network Related","name":"HTTP requests contain custom Base62 strings","description":"$44","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-78","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00003824\"\n YARA signature for AES encryption matched on file \"wblindp2.dll\"\n YARA signature for AES encryption matched on file \"SdAppServices.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Compress data using CryptoPP library","description":"YARA signature for compress data function process \"00000000-00003824\"\n YARA signature for compress data function file \"SdAppServices.dll\"","origin":"YARA Signature","mitre_attack_id":"T1560.002","relevance":1,"id":"yara-179","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Cryptographic algorithm using CryptoPP library","description":"YARA signature for Cryptographic function process \"00000000-00003824\"\n YARA signature for Cryptographic function file \"SdAppServices.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":1,"id":"yara-178","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"Microsoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00003824.00000000.138542.032E0000.00000004.mdmp, 00000000-00003824.00000001.138816.032E0000.00000004.mdmp\")\n Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00003824.00000000.138542.03389000.00000004.mdmp, 00000000-00003824.00000001.138816.03389000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SysWOW64\\Kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00003824.00000000.138542.03389000.00000004.mdmp, 00000000-00003824.00000001.138816.03389000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00003824.00000000.138542.03389000.00000004.mdmp, 00000000-00003824.00000001.138816.03389000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"DragQueryFileA\" (Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found string \"DragQueryFileW\" (Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"GetKeyNameTextW\" (Indicator: \"GetKeyNameText\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"MapVirtualKeyExW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"BinaryTransponder.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$46","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$47","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to determine disk drive type (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$48","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; Source: \"00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameA\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"GetModuleHandleExA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"Where should search look for files?\" (Indicator: \"where \"; Source: \"00000000-00003824.00000000.138542.005F6000.00000002.mdmp\")\n Found string \"WHERE DeviceID = '\\\\\\\\.\\\\PHYSICALDRIVE0'\" (Indicator: \"where \"; Source: \"00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found string \"WHERE DeviceID = '\\\\\\\\.\\\\PHYSICALDRIVE1'\" (Indicator: \"where \"; Source: \"00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"LookupAccountNameA\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"GetUserNameA\" (Indicator: \"GetUserName\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"password\" (Indicator: \"password\"; Source: \"00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyTransactedW\" in \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\"\n Found registry deletion API: \"SHDeleteKeyA\" in \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyA\" in \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueA\" in \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00003824.00000000.138542.032E0000.00000004.mdmp, 00000000-00003824.00000001.138816.032E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown SAS in module '\" (Indicator: \"shutdown \") in Source: 00000000-00003824.00000001.138816.72C33000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003824.00000001.138816.00574000.00000002.mdmp, 00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"BinaryTransponder.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4b","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"BinaryTransponder.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2F3\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")\n \"BinaryTransponder.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2F3\\52C64B7E\"; Key: \"@%SYSTEMROOT%\\SYSTEM32\\DNSAPI.DLL,-103\"; Value: \"Domain Name System (DNS) Server Trust\"), \"BinaryTransponder.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2F3\\52C64B7E\"; Key: \"@%SYSTEMROOT%\\SYSTEM32\\WINDOWSPOWERSHELL\\V1.0\\POWERSHELL.EXE\n-124\"; Value: \"Document Encryption\"), \"BinaryTransponder.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NOTIFICATIONS\\DATA\"; Key: \"418A073AA3BC1C75\"; Value: \"531F0000000000000400040001001C00020000000D78790016DDA4001E8D520021777A00259960002C3D81003E3383004AAA8100560A8500726E4A0075A37E00799C39008106950087DE83009D9D9200A736A800B1CE9800B3F1A200BC6EB400C046AD00C36D8100CF74AA00D3E88D00E1C97700E7997F00EBBF8400F1FC6000F7D36F0006000600000019C398001C4452007140A30091508A00A522A400C45F7F0000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"Thais.zn has high entropy\"\n \"48B35517638A85CA46010B026C2B955A_7B1A0B83FEDB976F620CFD7925C2C915 has high entropy\"\n \"439F613B3D55693954E1B080DE3085B4_C4927E03400A4F6EDB9D613E6354F864 has high entropy\"\n \"B2FAF7692FD9FFBD64EDE317E42334BA_93702E680A5530C052C8D2BA33A2225F has high entropy\"\n \"18E6B4A57A6BC7EC9B861CDF2D6D0D02_EF52C1EC85F21F31CC0157A5C8803013 has high entropy\"\n \"3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95 has high entropy\"\n \"C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 has high entropy\"\n \"C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB has high entropy\"\n \"8EC9B1D0ABBD7F98B401D425828828CE_B460DBDB6691F360C14B4617119E5588 has high entropy\"\n \"3AA0DCD5A74331FBD6F344550EC48B87_2C56F6A734D0F80A970DE78FB8C0B00F has high entropy\"\n \"698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB has high entropy\"","origin":"Binary File","mitre_attack_id":"T1027.013","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"$4c","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"BinaryTransponder.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"BinaryTransponder.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Uses a Windows Living Off The Land Binaries (LOL bins)","description":"Process \"%WINDIR%\\system32\\msiexec.exe\" launched with commandline \"/V\" (UID: 00000000-00001744)","origin":"Monitored Target","relevance":3,"id":"target-411","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve geographical location information","description":"\"BinaryTransponder.exe\" called \"GetUserGeoID\" with parameters {\"GeoClass\": \"16\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-308","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/26 Antivirus vendors marked sample as malicious (3% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"suspicious","category":"General","name":"GETs files from a webserver","description":"$4d","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-61","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"BinaryTransponder.exe\" has type \"PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections\"- Location: [%LOCALAPPDATA%\\Fusser_Data\\BinaryTransponder.exe]- [targetUID: 00000000-00003824]\n \"SdAppServices.dll\" has type \"PE32 executable for MS Windows 6.00 (DLL) Intel i386 7 sections\"- Location: [%LOCALAPPDATA%\\Fusser_Data\\SdAppServices.dll]- [targetUID: 00000000-00003824]\n \"wblindp2.dll\" has type \"PE32 executable for MS Windows 5.01 (DLL) Intel i386 6 sections\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on AES instruction used in file \"SdAppServices.dll\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-155","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00003824.00000001.138816.72C33000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"BinaryTransponder.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"23010929\"\n \"cx\": \"16\"\n \"cy\": \"16\"}\n \"BinaryTransponder.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"220107dd\"\n \"cx\": \"75\"\n \"cy\": \"23\"}\n \"BinaryTransponder.exe\" called \"CreateCompatibleBitmap\" with parameters {\"hdc\": \"7d0108e4\"\n \"cx\": \"75\"\n \"cy\": \"23\"}","origin":"API Call","mitre_attack_id":"T1113","relevance":5,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Spawned processes are likely due to an injection","description":"Process \"%LOCALAPPDATA%\\Fusser_Data\\BinaryTransponder.exe\" spawned likely due to injection","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":3,"id":"target-413","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Creates new processes"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":106,"dropped_files_count":0,"extracted_files_count":14,"files_written_count":18,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":1,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6985d9e67823bc1dd60ebdf8","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":77,"malware_family":"TrojanDownloader.Rugmi","submit_name":"8ca17f8770bf57d63512f5689c3cfaa0ea286cb553365595cf4ede21411324bf.bin","analysis_start_time":"2026-02-06T12:09:11+00:00","indicators_count":{"informative":172,"suspicious":21,"malicious":0},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":[{"domain":"ocsp.sectigo.com","address":"104.18.38.233","ttl":3590,"country":"-","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]}],"http_requests":[{"host":"ocsp.sectigo.com","host_ip":"172.64.149.23:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBSdE3gf41WAic8Uh9lF92%2BIJqh5qwQUMuuSmv81lkgvKEBCcCA2kVwXheYCEDPXCKiRQFMZ4qW70zm5rW4%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/10.0\nHost: ocsp.sectigo.com","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"host":"ocsp.sectigo.com","host_ip":"172.64.149.23:80","url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCECVgOf5DM4ckJwGXosBI7BU%3D","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBRd0JozUYXMqqW4y4zJTrLcMCRSkAQUgTKSQSsozUbIxKLGKjkS7EipPxQCECVgOf5DM4ckJwGXosBI7BU%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/10.0\nHost: ocsp.sectigo.com","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}],"processes":[{"pid":332,"ppid":0,"name":"msiexec.exe","command_line":"/i \"C:\\8ca17f8770bf57d63512f5689c3cfaa0ea286cb553365595cf4ede21411324bf.bin.msi\"","sha256":"866aeb5dd6fc4e84535cfff1d874dd3ea5f4bdad3b98fa970b0750f557055e51","normalized_path":"%WINDIR%\\System32\\msiexec.exe","uid":"00000000-00000332","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB4ElEQVR4XrWWwdHCIBSEc0s/FJRbWvD8n1JCZrh5+CuwAgvgbgEWgmx08eUFIqDZmR0cguzHA4xd16jT6eS/sZ6vStM0+VZdr1eP7+s5q0SArvur8iEAo/PRJvSFJradfz87HECHo43h1h0L8DH8SICi8CMBisK/AcBgbfQToCTcjI2HkCuVkv2yAnvhTQAYNAzDyvIZAVZXLRNeDZAL/z+fNxWocRJA76+0DtcALdoA7E2owyUAJmr1BgDSJU+FE+AXulwuvu/7/a1AfwpAj6s1wtHGcE6qlQPg83meV+a7vkRfATBodDaMst65MRqrM8Ys1iuHs+egFABnw4Q7PlqbBYAxFhCrkCCEV28BnsVw5xYAQgBAQjAcRhgg9C2AV+FQDoDhaCPAC0JXQa4eIVCqCknlAGT4/X5H1BbCvgFk+O12W1wEQQDn8Hp5tuxn+QFACAnCOQjAcFakGECGQ+iXFbBhpdp6Hq6apx4uBvhUAfTRXF1qHvrnFZDBtDzR3CJYjikG+FSBVLhzOIBhK7Al4VxICLoYYK8C+IxfPxlOAFzD55+QJ4QEKQqH9irAMayC/EEhwHIbFMRyU2oAUhXQAoQMJ4B7XUsJURxeK/5fyAHwZaS/93PJPy8MrQ1+AMo4YS+0bnEUAAAAAElFTkSuQmCC"},{"pid":1744,"ppid":0,"name":"msiexec.exe","command_line":"/V","sha256":"866aeb5dd6fc4e84535cfff1d874dd3ea5f4bdad3b98fa970b0750f557055e51","normalized_path":"%WINDIR%\\system32\\msiexec.exe","uid":"00000000-00001744","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAB4ElEQVR4XrWWwdHCIBSEc0s/FJRbWvD8n1JCZrh5+CuwAgvgbgEWgmx08eUFIqDZmR0cguzHA4xd16jT6eS/sZ6vStM0+VZdr1eP7+s5q0SArvur8iEAo/PRJvSFJradfz87HECHo43h1h0L8DH8SICi8CMBisK/AcBgbfQToCTcjI2HkCuVkv2yAnvhTQAYNAzDyvIZAVZXLRNeDZAL/z+fNxWocRJA76+0DtcALdoA7E2owyUAJmr1BgDSJU+FE+AXulwuvu/7/a1AfwpAj6s1wtHGcE6qlQPg83meV+a7vkRfATBodDaMst65MRqrM8Ys1iuHs+egFABnw4Q7PlqbBYAxFhCrkCCEV28BnsVw5xYAQgBAQjAcRhgg9C2AV+FQDoDhaCPAC0JXQa4eIVCqCknlAGT4/X5H1BbCvgFk+O12W1wEQQDn8Hp5tuxn+QFACAnCOQjAcFakGECGQ+iXFbBhpdp6Hq6apx4uBvhUAfTRXF1qHvrnFZDBtDzR3CJYjikG+FSBVLhzOIBhK7Al4VxICLoYYK8C+IxfPxlOAFzD55+QJ4QEKQqH9irAMayC/EEhwHIbFMRyU2oAUhXQAoQMJ4B7XUsJURxeK/5fyAHwZaS/93PJPy8MrQ1+AMo4YS+0bnEUAAAAAElFTkSuQmCC"},{"pid":3824,"ppid":1744,"name":"BinaryTransponder.exe","command_line":"","sha256":"19d78cd26cbfeb0800508063359f149f271fd7904d1ee0983ec24ba9efcb11e5","normalized_path":"%LOCALAPPDATA%\\Fusser_Data\\BinaryTransponder.exe","parent_uid":"00000000-00001744","uid":"00000000-00003824"}],"all_imported_dlls":["AcLayers.dll","sfc.dll","FWPUCLNT.DLL","pcacli.dll","vssapi.dll","GdiPlus.dll","imagehlp.dll","TextInputFramework.dll","msi.dll","coml2.dll","dwmapi.dll","ws2_32.dll","dnsapi.dll","ntdll.dll","KernelBase.dll","apphelp.dll","cryptsp.dll","mscoree.dll","oleacc.dll","bcryptprimitives.dll","sfc_os.dll","netapi32.dll","wkscli.dll","msisip.dll","rasadhlp.dll","mscoreei.dll","shell32.dll","propsys.dll","netutils.dll","webio.dll","clr.dll","wow64.dll","iertutil.dll","SdAppServices.dll","msvcp_win.dll","advapi32.dll","dhcpcsvc6.dll","dhcpcsvc.dll","vcruntime140_clr0400.dll","WinTypes.dll","gdi32full.dll","imm32.dll","srpapi.dll","wintrust.dll","msihnd.dll","setupapi.dll","rpcrt4.dll","sspicli.dll","cabinet.dll","msimg32.dll","winmm.dll","VxSSL32.dll","ntmarta.dll","ucrtbase.dll","gdi32.dll","comctl32.dll","CoreMessaging.dll","userenv.dll","msvcrt.dll","win32u.dll","nsi.dll","mpr.dll","spp.dll","wow64cpu.dll","urlmon.dll","kernel32.dll","SHCore.dll","powrprof.dll","winnsi.dll","version.dll","CoreUIComponents.dll","bcrypt.dll","ole32.dll","profapi.dll","uxtheme.dll","cryptbase.dll","clbcatq.dll","combase.dll","crypt32.dll","rsaenh.dll","winhttp.dll","wow64win.dll","winmmbase.dll","shlwapi.dll","cfgmgr32.dll","windows.storage.dll","mswsock.dll","OnDemandConnRouteHelper.dll","vsstrace.dll","wininet.dll","oledlg.dll","user32.dll","msasn1.dll","oleaut32.dll","wldp.dll","gpapi.dll","comdlg32.dll","fltLib.dll","IPHLPAPI.DLL","sechost.dll","kernel.appcore.dll","msctf.dll","cryptnet.dll","srclient.dll","fusion.dll","ucrtbase_clr0400.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"BinaryTransponder.exe","sha256":"19d78cd26cbfeb0800508063359f149f271fd7904d1ee0983ec24ba9efcb11e5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"name":"SdAppServices.dll","sha256":"00767658b1ba964e19d0748ca4a66f01ff9e634a9f37c15b175a4c3c547d867c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"name":"wblindp2.dll","sha256":"bb2bcc07c6823d1daa018a1d878fb4480851d604eda99b327c365b0f428454d0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"name":"20f18a.msi","sha256":"8ca17f8770bf57d63512f5689c3cfaa0ea286cb553365595cf4ede21411324bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"name":"1A374813EDB1A6631387E414D3E73232","sha256":"be7ea567f22e5bd7dc12ba5e534b4676d963a4567e57685dc921f70391fd0d4c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"name":"329B6147266C1E26CD774EA22B79EC2E","sha256":"be7ea567f22e5bd7dc12ba5e534b4676d963a4567e57685dc921f70391fd0d4c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"name":"3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95","sha256":"93512715f7835772de4ea09e039308091e9e6bf78ee89514cf04c213b7fb72f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"name":"698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB","sha256":"9b22976ed4d6d3330ce3a9e7ad9c220dc355c7d499429e2b2ce75a41a5d81f95","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"name":"8EC9B1D0ABBD7F98B401D425828828CE_B460DBDB6691F360C14B4617119E5588","sha256":"8111d30f5af915a137ec299c21e45c0b1597604b1584fdc8f97410b3fbc1c32c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"name":"C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141","sha256":"d71c63ed459569c48ecf9cda149110e81f95bacba0928e3edcc72ceaad7454eb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"name":"C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB","sha256":"61725d0b557ab720f09c93cb132f2db7ad671bd371dcefa51770eab207cbe11c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"name":"20f188.msi","sha256":"8ca17f8770bf57d63512f5689c3cfaa0ea286cb553365595cf4ede21411324bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"name":"Thais.zn","sha256":"d772a17a318ee05a386b4a10616b229eb868c215c661910352b0e18efe226384","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"name":"ngen.log","sha256":"ac9aacdfff79beed81fe23f7b0524d1bda47ae04498c77e9acfde2c170b80db7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\8EC9B1D0ABBD7F98B401D425828828CE_B460DBDB6691F360C14B4617119E5588","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\8EC9B1D0ABBD7F98B401D425828828CE_B460DBDB6691F360C14B4617119E5588","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\C8E534EE129F27D55460CE17FD628216_56DB209C155B5A05FCBF555DF7E6D1BB","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\329B6147266C1E26CD774EA22B79EC2E","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\329B6147266C1E26CD774EA22B79EC2E","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\3E3E9689537B6B136ECF210088069D55_EF6C9357BB54DDB629FD2D79F1594F95","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\1A374813EDB1A6631387E414D3E73232","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\1A374813EDB1A6631387E414D3E73232","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"key":"HKCUHKCU\\LOCAL SETTINGS\\MUICACHE\\2F3\\52C64B7E\\","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3824:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3824:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"name":"Local\\SM0:3824:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]},{"name":"SM0:3824:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6985d9e67823bc1dd60ebdf8"}]}]}},"report_ids":{"sandbox_job_ids":["6985d9e67823bc1dd60ebdf8"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Suspicious TrojanDownloader.Rugmi Sample 8ca17f8770bf… — Score 77/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Suspicious verdict for sample 8ca17f8770bf…. Malware family: TrojanDownloader.Rugmi. Threat score 77/100. 1/26 AV engines flagged this file. 0 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/8ca17f8770bf57d63512f5689c3cfaa0ea286cb553365595cf4ede21411324bf"}],["$","meta","4",{"property":"og:title","content":"Suspicious TrojanDownloader.Rugmi Sample 8ca17f8770bf… — Score 77/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Suspicious verdict for sample 8ca17f8770bf…. Malware family: TrojanDownloader.Rugmi. Threat score 77/100. 1/26 AV engines flagged this file. 0 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/8ca17f8770bf57d63512f5689c3cfaa0ea286cb553365595cf4ede21411324bf"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Suspicious TrojanDownloader.Rugmi Sample 8ca17f8770bf… — Score 77/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Suspicious verdict for sample 8ca17f8770bf…. Malware family: TrojanDownloader.Rugmi. Threat score 77/100. 1/26 AV engines flagged this file. 0 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4f","11",{}]]