26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 8b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T534,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.MSIL.Basic.8.Gen;Trojan.Uztuby Sample 947bf9d7c045… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 947bf9d7c045…. Malware family: Trojan.MSIL.Basic.8.Gen;Trojan.Uztuby. Threat score 100/100. 14/27 AV engines flagged this file. 7 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e","keywords":["Malicious","Trojan.MSIL.Basic.8.Gen;Trojan.Uztuby","malware analysis","sandbox report","threat intelligence","947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e"],"about":{"@type":"SoftwareApplication","name":"947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin","applicationCategory":["peexe","executable","compressed","sfx","rar"],"identifier":"947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.MSIL.Basic.8.Gen;Trojan.Uztuby","antivirusDetections":{"malicious":14,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T56d,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to API "CreateThread failed" (Indicator: "CreateThread"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00000188.00000000.258768.729F1000.00000020.mdmp, 00000000-00000188.00000000.258768.73001000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp, 00000000-00000188.00000001.258802.00229000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp")28:Tc98,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to API "WaitForMultipleObjects error %d, GetLastError %d" (Indicator: "WaitForMultipleObjects"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp, 00000000-00000188.00000001.258802.00229000.00000002.mdmp, 00000000-00000188.00000001.258802.72A05000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp, 00000000-00000188.00000001.258802.00229000.00000002.mdmp, 00000000-00000188.00000001.258802.72A05000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00000188.00000001.258802.00229000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000188.00000001.258802.00229000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00000188.00000001.258802.00229000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00000188.00000001.258802.00229000.00000002.mdmp")29:T57e,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp, 00000000-00000188.00000001.258802.00229000.00000002.mdmp, 00000000-00000188.00000001.258802.72A05000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp, 00000000-00000188.00000001.258802.00229000.00000002.mdmp, 00000000-00000188.00000001.258802.72A05000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp, 00000000-00000188.00000001.258802.00229000.00000002.mdmp")2a:T19fc,Found reference to "REY6vsOsokXmTwMYRC2" (Indicator: "RC2"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "Aes"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00003852-00000BC0-2981236467") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp")2b:T8fc,"nulstart "" "C:\tempdir\node_modules\require-directory\conhost.exe"del /a /q /f "C:\Users\HAPUBWS\AppData\Local\Temp\\QnqnzjW1c4.bat"" (Indicator: "w32tm "; File: "QnqnzjW1c4.bat") Found string "w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2" (Indicator: "w32tm "; Source: "00000000-00007460-00000C47-1603864024") Found string "w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul" (Indicator: "w32tm "; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found string "w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul" (Indicator: "w32tm "; Source: "00000000-00001316.00000000.259931.051F0000.00000004.mdmp") Found string "w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul" (Indicator: "w32tm "; Source: "00000000-00002456.00000000.262787.054E0000.00000004.mdmp, 00000000-00002456.00000001.262792.054E0000.00000004.mdmp") Found string "w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul" (Indicator: "w32tm "; Source: "00000000-00003440.00000001.260850.05230000.00000004.mdmp")3c:T578,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to API "GetVersionInfo" (Indicator: "GetVersion"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp, 00000000-00000188.00000001.258802.00229000.00000002.mdmp, 00000000-00000188.00000001.258802.72A05000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp, 00000000-00000188.00000001.258802.00229000.00000002.mdmp, 00000000-00000188.00000001.258802.72A05000.00000002.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp, 00000000-00000188.00000001.258802.72A05000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00000188.00000001.258802.00229000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00000188.00000001.258802.00229000.00000002.mdmp")3d:T9e5,"conhost.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "conhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "conhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "conhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "conhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "conhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "conhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "conhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "conhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "conhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "conhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "conhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "conhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "conhost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "")3e:T4ed,"conhost.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "conhost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "conhost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "conhost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "conhost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "conhost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "conhost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "conhost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "conhost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB") "conhost.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB")3f:T4bd,"portCommon.exe" called "CopyFileW" to copy C:\containersavesnetSvc\portCommon.exe to new location %PROGRAMFILES%\VMware\sppsvc.exe (UID: 00000000-00003852) "portCommon.exe" called "CopyFileW" to copy C:\containersavesnetSvc\portCommon.exe to new location C:\found.000\dir0008.chk\SppExtComObj.exe (UID: 00000000-00003852) "portCommon.exe" called "CopyFileW" to copy C:\containersavesnetSvc\portCommon.exe to new location %WINDIR%\PLA\Rules\en-US\sedsvc.exe (UID: 00000000-00003852) "portCommon.exe" called "CopyFileW" to copy C:\containersavesnetSvc\portCommon.exe to new location C:\containersavesnetSvc\csrss.exe (UID: 00000000-00003852) "portCommon.exe" called "CopyFileW" to copy C:\containersavesnetSvc\portCommon.exe to new location C:\tempdir\node_modules\require-directory\conhost.exe (UID: 00000000-00003852) "portCommon.exe" called "CopyFileW" to copy C:\containersavesnetSvc\portCommon.exe to new location %PROGRAMFILES%\(x86)\Microsoft\EdgeCore\144.0.3719.104.old\sppsvc.exe (UID: 00000000-00003852) "portCommon.exe" called "CopyFileW" to copy C:\containersavesnetSvc\portCommon.exe to new location C:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\SppExtComObj.exe (UID: 00000000-00003852)40:Te6e6,"" "92.168.0.1" Potential IP "4.0.0.0" found in string "ystem.ServiceModel.Internals,4.0.0.0,,31bf3856ad364e35,MSIL" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.17" "2.5.29.16" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.31" "2.5.29.32" "2.5.29.1" "2.5.4.3" Potential IP "4.0.0.0" found in string "ion=4.0.0.0, Culture=neutral, PublicKeyToken=b03" Potential IP "4.0.0.0" found in string "4.0.0.0," Potential IP "4.0.0.0" found in string "on=4.0.0.0, Cur" Potential IP "4.0.0.0" found in string "on=4.0.0.0, Culture=neutral, Pub" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0," Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, C" Potential IP "4.0.0.0" found in string "ystem.Data.SqlXml,4.0.0.0,,b77a5c561934e089,MSIL" Potential IP "4.0.0.0" found in string "ystem.Numerics,4.0.0.0,,b77a5c561934e089,MSIL" Potential IP "4.0.0.0" found in string "ersion=4.0.0.0, Culture=neutral, Pub" Potential IP "4.0.0.0" found in string "ystem.Runtime.Serialization,4.0.0.0,,b77a5c561934e089"5e:T2c29,Heuristic match: "to9.uk" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Heuristic match: "ipinfo.io" Heuristic match: "cp111468.tw1.ru" Heuristic match: "cript.sh" Heuristic match: "up.cv" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=74408&enterprise=" Pattern match: "https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%d" Pattern match: "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&" Pattern match: "https://wdcp.microsoft.com/wdcp.svc/submitreport" Heuristic match: "ript.sh" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "ystem.windows.fo" Heuristic match: "ystem.co" Heuristic match: "/.net/netclasses/httpwebrequest/connect__group$$/" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315#withcomments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#withcomments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/tr/1999/rec-xpath-19991116" Pattern match: "http://www.w3.org/tr/1999/rec-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#xml" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://schemas.microsoft.com/.netconfiguration/v2.0" Pattern match: "system.web/anonymousidentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browsercaps" Pattern match: "system.web/clienttarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customerrors" Pattern match: "system.web/deployment" Pattern match: "system.web/devicefilters" Pattern match: "system.web/fulltrustassemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthmonitoring" Pattern match: "system.web/hostingenvironment" Pattern match: "system.web/httpcookies" Pattern match: "system.web/httphandlers" Pattern match: "system.web/httpmodules" Pattern match: "system.web/httpruntime" Pattern match: "system.web/identity" Pattern match: "system.web/machinekey" Pattern match: "system.web/membership" Pattern match: "system.web/mobilecontrols" Pattern match: "system.web/pages" Pattern match: "system.web/partialtrustvisibleassemblies" Pattern match: "system.web/processmodel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/rolemanager" Pattern match: "system.web/securitypolicy" Pattern match: "system.web/sessionpagestate" Pattern match: "system.web/sessionstate" Pattern match: "system.web/sitemap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlmappings" Pattern match: "system.web/webcontrols" Pattern match: "system.web/webparts" Pattern match: "system.web/webservices" Pattern match: "system.web/xhtmlconformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputcache" Pattern match: "system.web/caching/outputcachesettings" Pattern match: "system.web/caching/sqlcachedependency" Pattern match: "http://go.microsoft.com/fwlink/?linkid=42127" Pattern match: "system.web/rolh" Heuristic match: "1e.bi" Pattern match: "cp111468.tw1.ru/@zd3bk5wa3rhb1fmzlr0xzlr0x,h2:http://cp111468.tw1.ru/@zd3bk5wa3rhb1fmzlr0x,t:0}y:~,u:$,i:|,l:,,r" Pattern match: "http://cp111468.tw1.ru/@zd3bk5wa3rhb1fmzlr0x,h2:http://cp111468.tw1.ru/@zd3bk5wa3rhb1fmzlr0x,t:0" Pattern match: "http://cp111468.tw1.ru/@zd3bk5wa3rhb1fmzlr0x" Pattern match: "http://cp111468.tw1.ru/" Pattern match: "http://cp111468.tw1.ru/_defaultwindows.php?ym=1yr1lmhslqettuhuywf31kvuul&ukiaxxxycrq8l82kvs7thbt1o2s7=dwgjuxinqh&wgechx449ajmxsts0qwfozg95uyql=6elb6l61uq8&258bcf77c1e29c6ef6c2a5c053a8835b=39abc3050a5e04b5faca9c92974bc625&827e675e45303288a9acb987c1a91280=gm" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "http://cp111468.tw1.ru" Heuristic match: "8.tw1.ru" Heuristic match: "host: cp111468.tw1.ru" Heuristic match: "p111468.tw1.ru" Heuristic match: ".tw1.ru" Heuristic match: "ntrust.net" Heuristic match: "*.api.ipinfo.io" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "www.digicert.com1+0" Pattern match: "www.digicert.com1" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Pattern match: "www.digicert.com1!0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "www.digicert.com1/0-" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "www.microsoft.com/pk" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0" Heuristic match: "soft.net" Heuristic match: "e=system.web.co" Heuristic match: "s\microsoft.net" Heuristic match: "lib.ni" Heuristic match: "pathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.ms" Heuristic match: "prope.re" Heuristic match: "ext=.com" Heuristic match: "ystem.ru" Heuristic match: "cim_operatingsystem.name"5f:T91c1,Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00000188.00000000.258768.729F1000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=74409&enterprise=%ls%dhttps://go.microsoft.com/fwlink/?linkid=74408&enterprise=https://go.microsoft.com/fwlink/?linkid=37020&name=%s&threatid=%u&enterprise=%dpynetsubmitsamplesconsentspynetreportingpclient_public_commodempclient_allowadminelevationacquirepclient_noforcedreboot\?\volume" - Source: "00000000-00000188.00000000.258768.73001000.00000020.mdmp") Found URL "https://go.microsoft.com/fwlink/?linkid=851034&clcid=0x409&httpsigupdate_baseurlforceupdatefrommusignaturedisablenotificationcloudbasedbehaviorblockingsignaturecategoryiddisablescheduledsignatureupdateonbatterysignatureupdatecatchupintervalsignatureslastcheckednissignatureslastupdateddeltaupdatefailurenissignatureversionnissignaturelocation%mpconfig_productappdatapath%\definition" - Source: "00000000-00000188.00000000.258768.73001000.00000020.mdmp") Found URL "https://wdcp.microsoft.com/wdcp.svc/submitreportspynetreportinglocationlocalsettingoverridesubmitsamplesconsentdisableblockatfirstseenheartbeatdelayindaysheartbeatsamplingratessloptionsbypassinternetcheckmapslatencyretrytimeoutthreatseveritydefaultactionemptykeyvaluedisableprivacymode%mpconfig_productappdatapath%\telemetryallowuseruiaccessuilockdownnotification_suppresssuppressrebootnotificationsuppresswdonotificationmpconfig_productcodenamempconfig_productpathmpconfig_productappdatapathmpconfig_productuserappdatapathmpconfig_appdataroot12345678-f0f0-4f3f-b1f3-41cd1905616empconfig_reportingguid\msmplics.dllpconfigut-53e7e780-2330-40c6-94c6-be75e946e933software\microsoft\removaltools\mrtguidfalsemp_config_type_szmp_config_type_dwordmp_config_type_multi_szmp_config_type_binarymp_config_type_nonemp_config_origin_nonemp_config_origin_defaultmp_config_origin_preferencesmp_config_origin_mdm_policymp_config_origin_policy*sof**eof*t%uh%um%uspt%uhp%udp%udt%uh2000-01-01t%02u:%02u:%02umpclient_nouseunifiedschedulingenginelocalsystem2100-01-01t00:00:00d:(a;;fa;;;sy)(a;;frfx;;;ls)maintenanceregularmicrosoft\windows\windows" - Source: "00000000-00000188.00000000.258768.73001000.00000020.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000872.00000000.260388.029E0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000872.00000001.260857.029E0000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\sppextcomobj.exe.configc:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\sppextcomobj.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_useryyy" - Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001316.00000000.259931.03000000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00001316.00000000.259931.051F0000.00000004.mdmp") Found URL "http://cp111468.tw1.ru/@zd3bk5wa3rhb1fmzlr0x" - Source: "00000000-00001316.00000000.259931.051F0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\tempdir\node_modules\require-directory\conhost.exe.configc:\tempdir\node_modules\require-directory\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_user-dd-lectconfigmachine.configpath2path1c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptor\\.\modeaccessrightsshare\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00001316.00000000.259931.051F0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00001316.00000000.259931.051F0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00001316.00000001.261853.03000000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,%ydigicert" - Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0rweris" - Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?secom" - Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mn9iqmgvw,czco!yjroot" - Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00002456.00000000.262787.054E0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\tempdir\node_modules\require-directory\conhost.exe.configc:\tempdir\node_modules\require-directory\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userfire([^'er" - Source: "00000000-00002456.00000000.262787.054E0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00002456.00000000.262787.054E0000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00002456.00000001.262792.054E0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\tempdir\node_modules\require-directory\conhost.exe.configc:\tempdir\node_modules\require-directory\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userfire([^'er" - Source: "00000000-00002456.00000001.262792.054E0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00002456.00000001.262792.054E0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003440.00000000.260428.03100000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003440.00000001.260850.03100000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00003440.00000001.260850.05230000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\windows\pla\rules\en-us\sedsvc.exe.configc:\windows\pla\rules\en-us\sedsvc.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_user]*)bersiconfigmachine.configpath2path1c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptor\\.\modeaccessrightsshare\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00003440.00000001.260850.05230000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00003440.00000001.260850.05230000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003852.00000000.259166.02E90000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003852.00000001.259228.02E90000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00004236.00000000.261375.050B0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\tempdir\node_modules\require-directory\conhost.exe.configc:\tempdir\node_modules\require-directory\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userfire([^'er" - Source: "00000000-00004236.00000000.261375.050B0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00004236.00000000.261375.050B0000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00004236.00000001.261449.050B0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\tempdir\node_modules\require-directory\conhost.exe.configc:\tempdir\node_modules\require-directory\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userfire([^'er" - Source: "00000000-00004236.00000001.261449.050B0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00004236.00000001.261449.050B0000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00004388.00000000.261006.04460000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\tempdir\node_modules\require-directory\conhost.exe.configc:\tempdir\node_modules\require-directory\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userfire([^'er" - Source: "00000000-00004388.00000000.261006.04460000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00004388.00000000.261006.04460000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00004388.00000001.261044.04460000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\tempdir\node_modules\require-directory\conhost.exe.configc:\tempdir\node_modules\require-directory\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userfire([^'er" - Source: "00000000-00004388.00000001.261044.04460000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00004388.00000001.261044.04460000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00004880.00000000.261797.04FF0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\windows\pla\rules\en-us\sedsvc.exe.configc:\windows\pla\rules\en-us\sedsvc.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userfox/" - Source: "00000000-00004880.00000000.261797.04FF0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00004880.00000000.261797.04FF0000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00004880.00000001.261967.04FF0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\windows\pla\rules\en-us\sedsvc.exe.configc:\windows\pla\rules\en-us\sedsvc.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userfox/" - Source: "00000000-00004880.00000001.261967.04FF0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00004880.00000001.261967.04FF0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00005380.00000000.260385.02BF0000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00005380.00000000.260385.04960000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\tempdir\node_modules\require-directory\conhost.exe.configc:\tempdir\node_modules\require-directory\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userfire([^'er" - Source: "00000000-00005380.00000000.260385.04960000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00005380.00000000.260385.04960000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00005380.00000001.260602.02BF0000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00005380.00000001.260602.04960000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\tempdir\node_modules\require-directory\conhost.exe.configc:\tempdir\node_modules\require-directory\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userfire([^'er" - Source: "00000000-00005380.00000001.260602.04960000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00005380.00000001.260602.04960000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00006012.00000000.261661.05220000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\sppextcomobj.exe.configc:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\sppextcomobj.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_user0100']*)nputconfigmachine.configpath2path1c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptor\\.\modeaccessrightsshare\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00006012.00000000.261661.05220000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00006012.00000000.261661.05220000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00006012.00000001.261722.05220000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\sppextcomobj.exe.configc:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\sppextcomobj.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_user0100']*)nputconfigmachine.configpath2path1c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptor\\.\modeaccessrightsshare\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00006012.00000001.261722.05220000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00006012.00000001.261722.05220000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00006384.00000000.262480.04F10000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\windows\pla\rules\en-us\sedsvc.exe.configc:\windows\pla\rules\en-us\sedsvc.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userfox/" - Source: "00000000-00006384.00000000.262480.04F10000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00006384.00000000.262480.04F10000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00006384.00000001.262618.04F10000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\windows\pla\rules\en-us\sedsvc.exe.configc:\windows\pla\rules\en-us\sedsvc.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userfox/" - Source: "00000000-00006384.00000001.262618.04F10000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00006384.00000001.262618.04F10000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00006388.00000000.263597.04E80000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\tempdir\node_modules\require-directory\conhost.exe.configc:\tempdir\node_modules\require-directory\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userko/2p([^pconfigmachine.configpath2path1c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.config" - Source: "00000000-00006388.00000000.263597.04E80000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00006388.00000000.263597.04E80000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00006664.00000000.263148.04CD0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\windows\pla\rules\en-us\sedsvc.exe.configc:\windows\pla\rules\en-us\sedsvc.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userfox/s" - Source: "00000000-00006664.00000000.263148.04CD0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00006664.00000000.263148.04CD0000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00006664.00000001.263254.04CD0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\windows\pla\rules\en-us\sedsvc.exe.configc:\windows\pla\rules\en-us\sedsvc.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userfox/s" - Source: "00000000-00006664.00000001.263254.04CD0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00006664.00000001.263254.04CD0000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00006888.00000000.261793.051D0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\tempdir\node_modules\require-directory\conhost.exe.configc:\tempdir\node_modules\require-directory\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_user0100']*)nputx8" - Source: "00000000-00006888.00000000.261793.051D0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00006888.00000000.261793.051D0000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00006888.00000001.261951.051D0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\tempdir\node_modules\require-directory\conhost.exe.configc:\tempdir\node_modules\require-directory\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_user0100']*)nputx8" - Source: "00000000-00006888.00000001.261951.051D0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00006888.00000001.261951.051D0000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00006896.00000000.261225.04F70000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\sppextcomobj.exe.configc:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\sppextcomobj.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_user0100']*)nputconfigmachine.configpath2path1c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptor\\.\modeaccessrightsshare\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00006896.00000000.261225.04F70000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00006896.00000000.261225.04F70000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00006896.00000001.261274.04F70000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\sppextcomobj.exe.configc:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\sppextcomobj.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_user0100']*)nputconfigmachine.configpath2path1c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptor\\.\modeaccessrightsshare\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00006896.00000001.261274.04F70000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00006896.00000001.261274.04F70000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00007136.00000000.263147.04A20000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\tempdir\node_modules\require-directory\conhost.exe.configc:\tempdir\node_modules\require-directory\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userfire" - Source: "00000000-00007136.00000000.263147.04A20000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007136.00000000.263147.04A20000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00007136.00000001.263216.04A20000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\tempdir\node_modules\require-directory\conhost.exe.configc:\tempdir\node_modules\require-directory\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userfire" - Source: "00000000-00007136.00000001.263216.04A20000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007136.00000001.263216.04A20000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00007376.00000000.261266.045A0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\windows\pla\rules\en-us\sedsvc.exe.configc:\windows\pla\rules\en-us\sedsvc.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userfox/" - Source: "00000000-00007376.00000000.261266.045A0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007376.00000000.261266.045A0000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00007376.00000001.261436.045A0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\windows\pla\rules\en-us\sedsvc.exe.configc:\windows\pla\rules\en-us\sedsvc.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userfox/" - Source: "00000000-00007376.00000001.261436.045A0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007376.00000001.261436.045A0000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00007444.00000000.263027.04B50000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\sppextcomobj.exe.configc:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\sppextcomobj.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_user0100']*)nputconfigmachine.configpath2path1c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptor\\.\modeaccessrightsshare\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00007444.00000000.263027.04B50000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007444.00000000.263027.04B50000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00007444.00000001.263065.04B50000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\sppextcomobj.exe.configc:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\sppextcomobj.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_user0100']*)nputconfigmachine.configpath2path1c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptor\\.\modeaccessrightsshare\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00007444.00000001.263065.04B50000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007444.00000001.263065.04B50000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00007484.00000000.262076.04880000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\sppextcomobj.exe.configc:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\sppextcomobj.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_user0100@']*)@nput@configmachine.configpath2path1c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configpre@executionengine_missingsecuritydescriptor\\.\modeaccessrightsshare\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00007484.00000000.262076.04880000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007484.00000000.262076.04880000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00007484.00000001.262129.04880000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\sppextcomobj.exe.configc:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\sppextcomobj.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_user0100@']*)@nput@configmachine.configpath2path1c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configpre@executionengine_missingsecuritydescriptor\\.\modeaccessrightsshare\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00007484.00000001.262129.04880000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007484.00000001.262129.04880000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00007544.00000000.262332.045A0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\tempdir\node_modules\require-directory\conhost.exe.configc:\tempdir\node_modules\require-directory\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userfire" - Source: "00000000-00007544.00000000.262332.045A0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007544.00000000.262332.045A0000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00007544.00000001.262394.045A0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\tempdir\node_modules\require-directory\conhost.exe.configc:\tempdir\node_modules\require-directory\conhost.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userfire" - Source: "00000000-00007544.00000001.262394.045A0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007544.00000001.262394.045A0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007960.00000000.263490.032C0000.00000004.mdmp") Found URL "http://explorer.exeiexplore.execlipboardrequeststhreadshostport.post" - Source: "00000000-00007960.00000000.263490.05090000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\sppextcomobj.exe.configc:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\sppextcomobj.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_user0100p']*)pnputpconfigmachine.configpath2path1c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configprepexecutionengine_missingsecuritydescriptor\\.\modeaccessrightsshare\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00007960.00000000.263490.05090000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00007960.00000000.263490.05090000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00007960.00000001.263544.032C0000.00000004.mdmp")60:Ta2d,Found string "+ncalrpc:[OLE20090065FE79CC9B9E1D3BEB1D3B]" (Indicator: "ncalrpc"; Source: "00000000-00000188.00000000.258768.03690000.00000004.mdmp, 00000000-00000188.00000001.258802.03690000.00000004.mdmp") Found string "ncalrpc" (Indicator: "ncalrpc"; Source: "00000000-00000188.00000000.258768.73001000.00000020.mdmp") Found string "B+ncalrpc:[OLE7CEB11C768DFD4B81854F3A1E371]" (Indicator: "ncalrpc"; Source: "00000000-00000188.00000001.258802.03690000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00000188.00000001.258802.03690000.00000004.mdmp") Found string "+ncalrpc:[OLE7CEB11C768DFD4B81854F3A1E371]" (Indicator: "ncalrpc"; Source: "00000000-00000188.00000001.258802.03690000.00000004.mdmp") Found string "+ncalrpc:[OLEEE5DC89FD0BF559994518225E30D]" (Indicator: "ncalrpc"; Source: "00000000-00000872.00000001.260857.029E0000.00000004.mdmp") Found string "+ncalrpc:[OLE5D2F5C25677C0707F1C8E6F137E2]" (Indicator: "ncalrpc"; Source: "00000000-00001316.00000000.259931.03000000.00000004.mdmp, 00000000-00001316.00000001.261853.03000000.00000004.mdmp") Found string "B+ncalrpc:[OLE88287DA8B7A332C109CDA5546002]" (Indicator: "ncalrpc"; Source: "00000000-00001316.00000001.261853.03000000.00000004.mdmp") Found string "+ncalrpc:[OLE88287DA8B7A332C109CDA5546002]" (Indicator: "ncalrpc"; Source: "00000000-00001316.00000001.261853.03000000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00001316.00000001.261853.03000000.00000004.mdmp") Found string "+ncalrpc:[OLE18274C3EEB8FB27C44A45979DD75]" (Indicator: "ncalrpc"; Source: "00000000-00002456.00000000.262787.035E0000.00000004.mdmp, 00000000-00002456.00000001.262792.035E0000.00000004.mdmp") Found string "+ncalrpc:[OLE54CC9079A5EB0366F3E40820E6EC]" (Indicator: "ncalrpc"; Source: "00000000-00003440.00000001.260850.03131000.00000004.mdmp") Found string "+ncalrpc:[OLE17D76F64884FAA7E84643C7AC702]" (Indicator: "ncalrpc"; Source: "00000000-00003852.00000000.259166.02E90000.00000004.mdmp, 00000000-00003852.00000001.259228.02E90000.00000004.mdmp") Found string "+ncalrpc:[OLE88287DA8B7A332C109CDA5546002]" (Indicator: "ncalrpc"; Source: "00000000-00003852.00000000.259166.1E2A0000.00000004.mdmp, 00000000-00003852.00000001.259228.1E2A0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00003852.00000000.259166.1E2A0000.00000004.mdmp, 00000000-00003852.00000001.259228.1E2A0000.00000004.mdmp")61:Tae0,Found string -C:\inetpub\wwwroot\*Indicator: \inetpub\wwwroot\ Found string -C:\inetpub\wwwroot\aspnet_client\*Indicator: \inetpub\wwwroot\ Found string -C:\inetpub\wwwroot\aspnet_client\system_web\*Indicator: \inetpub\wwwroot\ Found string -C:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\*Indicator: \inetpub\wwwroot\ Found string -C:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\SppExtComObj.exeIndicator: \inetpub\wwwroot\ Found string -:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\SppExtComObj.exeIndicator: \inetpub\wwwroot\ Found string -C:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727;C:\WINDOWS\SYSTEM32;C:\WINDOWS\system;C:\WINDOWS;.;C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\;%NVM_HOME%;%NVM_SYMLINK%;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\Scripts\;C:\Users\HAPUBWS\AppData\Local\Programs\Python\Python311\;C:\Users\HAPUBWS\AppData\Local\Microsoft\WindowsApps;C:\Program Files\mitmproxy\bin;C:\Users\HAPUBWS\AppData\Roaming\nvm;C:\Program Files\nodejsIndicator: \inetpub\wwwroot\ Found string -C:\Windows\MC:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\SppExtComObj.exeIndicator: \inetpub\wwwroot\ Found string -Indicator: \inetpub\wwwroot\ Found string -:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\sspicli.dllIndicator: \inetpub\wwwroot\ Found string -:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\sppextcomobj.exeIndicator: \inetpub\wwwroot\ Found string -:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\cryptbase.dllIndicator: \inetpub\wwwroot\ Found string -??\c:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\sspicli.dllIndicator: \inetpub\wwwroot\ Found string -C:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\Indicator: \inetpub\wwwroot\ Found string -C:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\SppExtComObj.exe.configIndicator: \inetpub\wwwroot\ Found string -??\c:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\e1ef82546f0b02Indicator: \inetpub\wwwroot\ Found string -schtasks.exe /create /tn "SppExtComObj" /sc ONLOGON /tr "'C:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\SppExtComObj.exe'" /rl HIGHEST /fIndicator: \inetpub\wwwroot\ Found string -schtasks.exe /create /tn "SppExtComObjS" /sc MINUTE /mo 12 /tr "'C:\inetpub\wwwroot\aspnet_client\system_web\2_0_50727\SppExtComObj.exe'" /rl HIGHEST /fIndicator: \inetpub\wwwroot\62:T537,Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00000188.00000000.258768.03690000.00000004.mdmp, 00000000-00000188.00000001.258802.03690000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00000872.00000001.260857.029E0000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00001316.00000000.259931.03000000.00000004.mdmp, 00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found string ":\WINDOWS\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00001316.00000001.261853.1E260000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00002456.00000000.262787.035E0000.00000004.mdmp, 00000000-00002456.00000001.262792.035E0000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00003440.00000001.260850.03131000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00003852.00000000.259166.02E90000.00000004.mdmp, 00000000-00003852.00000001.259228.02E90000.00000004.mdmp")63:T759,Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp, 00000000-00000872.00000001.260857.1DE20000.00000004.mdmp") Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00001316.00000000.259931.051F0000.00000004.mdmp") Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00002456.00000000.262787.054E0000.00000004.mdmp, 00000000-00002456.00000001.262792.054E0000.00000004.mdmp") Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; Source: "00000000-00002456.00000000.262787.054E0000.00000004.mdmp, 00000000-00002456.00000001.262792.054E0000.00000004.mdmp") Found string "" (Indicator: "System.Data.SqlClient"; Source: "00000000-00003440.00000001.260850.05230000.00000004.mdmp") Found string "System.Data.SqlClient" (Indicator: "System.Data.SqlClient"; Source: "00000000-00003440.00000001.260850.05230000.00000004.mdmp")64:T5fe,Found registry query API: "RegOpenKeyExW" in file "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin" Found registry query API: "RegQueryValueExW" in file "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin" Found registry query API: "RegQueryValueExW" in "00000000-00000188.00000000.258768.73091000.00000002.mdmp, 00000000-00000188.00000001.258802.00229000.00000002.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00000188.00000000.258768.73091000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00000188.00000000.258768.73091000.00000002.mdmp, 00000000-00000188.00000001.258802.00229000.00000002.mdmp" Found registry query API: "RegEnumKeyExW" in "00000000-00000188.00000000.258768.73091000.00000002.mdmp" Found registry query API: "RegQueryInfoKeyW" in "00000000-00000188.00000000.258768.73091000.00000002.mdmp" Found registry query API: "RegNotifyChangeKeyValue" in "00000000-00000188.00000000.258768.73091000.00000002.mdmp" Found registry query API: "RegQueryValueA" in "00000000-00000188.00000001.258802.00229000.00000002.mdmp" Found registry query API: "RegOpenKeyA" in "00000000-00000188.00000001.258802.00229000.00000002.mdmp" Found registry query API: "RegEnumKeyExA" in "00000000-00000188.00000001.258802.00229000.00000002.mdmp" Found registry query API: "RegOpenKeyExA" in "00000000-00000188.00000001.258802.00229000.00000002.mdmp" Found registry query API: "RegQueryValueExA" in "00000000-00000188.00000001.258802.00229000.00000002.mdmp"65:T950,"" (Indicator: "password"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp") Found string "Missing password.`" (Indicator: "password"; Source: "00000000-00001316.00000000.259931.051F0000.00000004.mdmp") Found string "bad password." (Indicator: "password"; Source: "00000000-00001316.00000000.259931.051F0000.00000004.mdmp") Found string "Supply a password to use AES encryption." (Indicator: "password"; Source: "00000000-00001316.00000000.259931.051F0000.00000004.mdmp") Found string "This entry requires a password.6" (Indicator: "password"; Source: "00000000-00001316.00000000.259931.051F0000.00000004.mdmp") Found string "The password did not match." (Indicator: "password"; Source: "00000000-00001316.00000000.259931.051F0000.00000004.mdmp") Found string "Missing password.`" (Indicator: "password"; Source: "00000000-00002456.00000000.262787.054E0000.00000004.mdmp, 00000000-00002456.00000001.262792.054E0000.00000004.mdmp") Found string "bad password." (Indicator: "password"; Source: "00000000-00002456.00000000.262787.054E0000.00000004.mdmp, 00000000-00002456.00000001.262792.054E0000.00000004.mdmp") Found string "Supply a password to use AES encryption." (Indicator: "password"; Source: "00000000-00002456.00000000.262787.054E0000.00000004.mdmp, 00000000-00002456.00000001.262792.054E0000.00000004.mdmp") Found string "This entry requires a password.6" (Indicator: "password"; Source: "00000000-00002456.00000000.262787.054E0000.00000004.mdmp, 00000000-00002456.00000001.262792.054E0000.00000004.mdmp")6c:T631,"portCommon.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00003852) "conhost.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00001316) "conhost.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00005380) "SppExtComObj.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00000872) "sedsvc.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00003440) "conhost.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00004388) "SppExtComObj.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00006896) "sedsvc.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00007376) "conhost.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00004236) "SppExtComObj.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00006012) "conhost.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00006888) "sedsvc.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00004880) "SppExtComObj.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00007484) "conhost.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00007544) "SppExtComObj.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00008056) "sedsvc.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00006384) "conhost.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00002456) "SppExtComObj.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00007444) "sedsvc.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00006664) "sedsvc.exe" called an API "AdjustTokenPrivileges" (UID: 00000000-00005520)6d:Tc78,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000188.00000000.258768.03690000.00000004.mdmp, 00000000-00000188.00000001.258802.03690000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}m" (Indicator: "\Device\"; Source: "00000000-00000188.00000000.258768.03690000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}m" (Indicator: "\DosDevices\"; Source: "00000000-00000188.00000000.258768.03690000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0" (Indicator: "\Device\"; Source: "00000000-00000188.00000001.258802.03690000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0" (Indicator: "\DosDevices\"; Source: "00000000-00000188.00000001.258802.03690000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00000872.00000001.260857.029E0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000872.00000001.260857.029E0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00001316.00000000.259931.03000000.00000004.mdmp, 00000000-00001316.00000001.261853.03000000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001316.00000000.259931.03000000.00000004.mdmp, 00000000-00001316.00000001.261853.03000000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00002456.00000000.262787.035E0000.00000004.mdmp, 00000000-00002456.00000001.262792.035E0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002456.00000000.262787.035E0000.00000004.mdmp, 00000000-00002456.00000001.262792.035E0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00003440.00000000.260428.03100000.00000004.mdmp, 00000000-00003440.00000001.260850.03131000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003440.00000001.260850.03131000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00003852.00000000.259166.02E90000.00000004.mdmp, 00000000-00003852.00000001.259228.02E90000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00003852.00000000.259166.02E90000.00000004.mdmp, 00000000-00003852.00000001.259228.02E90000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003852.00000000.259166.1E2A0000.00000004.mdmp, 00000000-00003852.00000001.259228.1E2A0000.00000004.mdmp")6e:T62e,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00000872.00000001.260857.04DB0000.00000004.mdmp, 00000000-00000872.00000001.260857.1DE20000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00001316.00000000.259931.051F0000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00002456.00000000.262787.054E0000.00000004.mdmp, 00000000-00002456.00000001.262792.054E0000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00003440.00000001.260850.03131000.00000004.mdmp, 00000000-00003440.00000001.260850.05230000.00000004.mdmp") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00003852.00000000.259166.1E2A0000.00000004.mdmp, 00000000-00003852.00000000.259166.1E3A0000.00000004.mdmp")6f:T7ed,Found reference to API "SetFileSecurityW" (Indicator: "SetFileSecurityW"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp") Found reference to API "ImpersonateLoggedOnUser" (Indicator: "ImpersonateLoggedOnUser"; Source: "00000000-00000188.00000001.258802.00229000.00000002.mdmp")70:T528,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00000188.00000000.258768.73091000.00000002.mdmp, 00000000-00000188.00000001.258802.00229000.00000002.mdmp, 00000000-00000188.00000001.258802.72A05000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00000188.00000001.258802.00229000.00000002.mdmp") Found reference to API "Win32API|Process and Thread Functions|TerminateProcess|uExitCode" (Indicator: "TerminateProcess"; Source: "00000000-00003852.00000000.259166.1E2A0000.00000004.mdmp, 00000000-00003852.00000000.259166.1E3A0000.00000004.mdmp") Found reference to API "Win32API|Process and Thread Functions|TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003852.00000000.259166.1E2A0000.00000004.mdmp, 00000000-00003852.00000000.259166.1E3A0000.00000004.mdmp")71:T476,Found reference to API "SeSecurityPrivilege" (Indicator: "SeSecurityPrivilege"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to API "SeCreateSymbolicLinkPrivilege" (Indicator: "SeCreateSymbolicLinkPrivilege"; File: "947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin") Found reference to API "SeAssignPrimaryTokenPrivilege" (Indicator: "SeAssignPrimaryTokenPrivilege"; Source: "00000000-00003852.00000000.259166.1E2A0000.00000004.mdmp, 00000000-00003852.00000000.259166.1E3A0000.00000004.mdmp") Found reference to API "SeIncreaseQuotaPrivilege" (Indicator: "SeIncreaseQuotaPrivilege"; Source: "00000000-00003852.00000000.259166.1E2A0000.00000004.mdmp, 00000000-00003852.00000000.259166.1E3A0000.00000004.mdmp") Found reference to API "SeRestorePrivilege" (Indicator: "SeRestorePrivilege"; Source: "00000000-00003852.00000000.259166.1E2A0000.00000004.mdmp, 00000000-00003852.00000000.259166.1E3A0000.00000004.mdmp")72:Ta9d,"nulstart \"\" \"C:\\tempdir\\node_modules\\require-directory\\conhost.exe\"del /a /q /f \"C:\\Users\\HAPUBWS\\AppData\\Local\\Temp\\\\QnqnzjW1c4.bat\"\" (Indicator: \"\"del \") in Source: QnqnzjW1c4.bat","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"69f5a4fa18748e342f0754b1"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00000188.00000000.258768.73091000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00000188.00000000.258768.73091000.00000002.mdmp\")\n Found reference to API \"DeleteFileWWL\" (Indicator: \"DeleteFile\"; Source: \"00000000-00000188.00000001.258802.00229000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"69f5a4fa18748e342f0754b1"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"DisableRealtimeMonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00000188.00000000.258768.729F1000.00000020.mdmp, 00000000-00000188.00000000.258768.73001000.00000020.mdmp\")\n Found string \"DisableIOAVProtection\" (Indicator: \"disableioavprotection\"; Source: \"00000000-00000188.00000000.258768.729F1000.00000020.mdmp, 00000000-00000188.00000000.258768.73001000.00000020.mdmp\")\n Found string \"DisableBehaviorMonitoring\" (Indicator: \"disablebehaviormonitoring\"; Source: \"00000000-00000188.00000000.258768.73001000.00000020.mdmp\")\n Found string \"DisableScriptScanning\" (Indicator: \"disablescriptscanning\"; Source: \"00000000-00000188.00000000.258768.73001000.00000020.mdmp\")\n Found string \"DisableBlockAtFirstSeen\" (Indicator: \"disableblockatfirstseen\"; Source: \"00000000-00000188.00000000.258768.73001000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"69f5a4fa18748e342f0754b1"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"69f5a4fa18748e342f0754b1"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00000188.00000000.258768.73091000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"69f5a4fa18748e342f0754b1"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"69f5a4fa18748e342f0754b1"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00001316-00000C2C-2998312617\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00000872.00000001.260857.04DB0000.00000004.mdmp\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00001316.00000000.259931.051F0000.00000004.mdmp\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00002456.00000000.262787.054E0000.00000004.mdmp\n 00000000-00002456.00000001.262792.054E0000.00000004.mdmp\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00003440.00000001.260850.05230000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"69f5a4fa18748e342f0754b1"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"$70","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"69f5a4fa18748e342f0754b1"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"$71","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"69f5a4fa18748e342f0754b1"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"947bf9d7c04554915b4c68b1152afeff923fcd74ab718e9c63a603fe48a7cd1e.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00000188.00000000.258768.73091000.00000002.mdmp, 00000000-00000188.00000001.258802.00229000.00000002.mdmp, 00000000-00000188.00000001.258802.72A05000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"69f5a4fa18748e342f0754b1"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"portCommon.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\CMD.EXE\"; Value: \"CE4E49783EDADC010000000000000000000000000200000000\")\n \"conhost.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69f5a4fa18748e342f0754b1"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"