24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 7a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Uztuby Sample aaded591ef03… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample aaded591ef03…. Malware family: Trojan.Uztuby. Threat score 100/100. 12/28 AV engines flagged this file. 14 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c","keywords":["Malicious","Trojan.Uztuby","malware analysis","sandbox report","threat intelligence","aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c"],"about":{"@type":"SoftwareApplication","name":"DCRatBuild.exe","applicationCategory":["peexe","executable","compressed","sfx","rar"],"identifier":"aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Uztuby","antivirusDetections":{"malicious":12,"total":28},"behavioralIndicators":{"malicious":14,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T762,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to API "WaitForMultipleObjects error %d, GetLastError %d" (Indicator: "WaitForMultipleObjects"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006676.00000000.214458.73525000.00000002.mdmp, 00000000-00006676.00000001.214811.00CD9000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006676.00000000.214458.73525000.00000002.mdmp, 00000000-00006676.00000001.214811.00CD9000.00000002.mdmp") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00006676.00000001.214811.00CD9000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006676.00000001.214811.00CD9000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006676.00000001.214811.00CD9000.00000002.mdmp") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; Source: "00000000-00006676.00000001.214811.00CD9000.00000002.mdmp")26:T44a,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006676.00000000.214458.73525000.00000002.mdmp, 00000000-00006676.00000001.214811.00CD9000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006676.00000000.214458.73525000.00000002.mdmp, 00000000-00006676.00000001.214811.00CD9000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00006676.00000001.214811.00CD9000.00000002.mdmp")27:T53f,Found reference to API "SetFileTime" (Indicator: "SetFileTime"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to API "SetLastWriteTimeUtc" (Indicator: "SetLastWriteTime"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to API "SetCreationTimeUtc" (Indicator: "SetCreationTime"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to API "SetLastAccessTimeUtc" (Indicator: "SetLastAccessTime"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to API "SetLastWriteTime" (Indicator: "SetLastWriteTime"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to API "SetLastWriteTimeUtc" (Indicator: "SetLastWriteTime"; Source: "00000000-00003280.00000000.216419.00AB2000.00000002.mdmp") Found reference to API "SetCreationTimeUtc" (Indicator: "SetCreationTime"; Source: "00000000-00003280.00000000.216419.00AB2000.00000002.mdmp") Found reference to API "SetLastAccessTimeUtc" (Indicator: "SetLastAccessTime"; Source: "00000000-00003280.00000000.216419.00AB2000.00000002.mdmp") Found reference to API "SetLastWriteTime" (Indicator: "SetLastWriteTime"; Source: "00000000-00003280.00000000.216419.00AB2000.00000002.mdmp")28:T1ba2,Found reference to "HMACSHA1" (Indicator: "HMAC"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") file/memory contains long string with (Indicator: "DeriveBytes"; File: "Idle.exe") file/memory contains long string with (Indicator: "HashAlgorithm"; File: "Idle.exe") file/memory contains long string with (Indicator: "HMAC"; File: "Idle.exe") file/memory contains long string with (Indicator: "HMACSHA1"; File: "Idle.exe") file/memory contains long string with (Indicator: "Rfc2898DeriveBytes"; File: "Idle.exe") file/memory contains long string with (Indicator: "SHA1Managed"; File: "Idle.exe") file/memory contains long string with (Indicator: "SHA256Managed"; File: "Idle.exe") file/memory contains long string with (Indicator: "SymmetricAlgorithm"; File: "Idle.exe") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00000852.00000000.215737.04AC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00000852.00000000.215737.04AC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00000852.00000000.215737.04AC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00000852.00000000.215737.04AC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00000852.00000000.215737.04AC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00000852.00000000.215737.04AC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00000852.00000000.215737.04AC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00000852.00000000.215737.04AC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00000852.00000000.215737.04AC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00000852.00000000.215737.04AC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00000852.00000000.215737.04AC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00000852.00000000.215737.04AC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00000852.00000000.215737.04AC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00000852.00000000.215737.04AC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00000852.00000000.215737.04AC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00000852.00000000.215737.04AC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00000852.00000000.215737.04AC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00000852.00000000.215737.04AC0000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00000852.00000000.215737.04AC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00000852.00000000.215737.04AC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00000852.00000000.215737.04AC0000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00000852.00000000.215737.04AC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00000852.00000000.215737.04AC0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00000852.00000000.215737.04AC0000.00000004.mdmp")29:T966,"" "27.0.0.1" Potential IP "4.0.0.0" found in string "rsion=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" />", Potential IP "4.0.0.0" found in string "n=4.0.0.0 Culture=neutr", Potential IP "4.0.0.0" found in string "sion=4.0.0.0 Culture=neutral PI", Potential IP "4.0.0.0" found in string "rsion=4.0.0.0 ", "92.168.0.2", Potential IP "4.0.0.0" found in string "ystem.Core 4.0.0.0 b77a5c561934e089 MSIL", Potential IP "4.0.0.0" found in string "ystem.Runtime.Serialization.Formatters.Soap 4.0.0.0 b03f5f7f11d50a3a MSIL", Potential IP "4.0.0.0" found in string "ion=4.0.0.0 Culture=neutral PublicKeyToken=b03", Potential IP "4.0.0.0" found in string "n=4.0.0.0 "58:T1c3a,Heuristic match: "to9.uk" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Heuristic match: "ipinfo.io" Heuristic match: "api.telegram.org" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "microsoft.net/framework64/v4.0.30319/" Heuristic match: "ystem.windows.fo" Heuristic match: "/.net/netclasses/httpwebrequest/connect__group$$/" Pattern match: "http://www.w3.org/2000/09/xmldsig#dsa-sha1" Pattern match: "http://www.w3.org/2000/09/xmldsig#rsa-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#rsa-sha512" Pattern match: "http://www.w3.org/2000/09/xmldsig#sha1" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha256" Pattern match: "http://www.w3.org/2001/04/xmlenc#sha512" Pattern match: "http://www.w3.org/2001/04/xmlenc#ripemd160" Pattern match: "http://www.w3.org/2001/04/xmlenc#des-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#tripledes-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-tripledes" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes128-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes128" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes192-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes192" Pattern match: "http://www.w3.org/2001/04/xmlenc#aes256-cbc" Pattern match: "http://www.w3.org/2001/04/xmlenc#kw-aes256" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315" Pattern match: "http://www.w3.org/tr/2001/rec-xml-c14n-20010315#withcomments" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#" Pattern match: "http://www.w3.org/2001/10/xml-exc-c14n#withcomments" Pattern match: "http://www.w3.org/2000/09/xmldsig#base64" Pattern match: "http://www.w3.org/tr/1999/rec-xpath-19991116" Pattern match: "http://www.w3.org/tr/1999/rec-xslt-19991116" Pattern match: "http://www.w3.org/2000/09/xmldsig#enveloped-signature" Pattern match: "http://www.w3.org/2002/07/decrypt#xml" Pattern match: "http://www.w3.org/2000/09/xmldsig#" Pattern match: "http://www.w3.org/2001/04/xmlenc#" Pattern match: "http://www.w3.org/2000/09/xmldsig#hmac-sha1" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-md5" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-ripemd160" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha384" Pattern match: "http://www.w3.org/2001/04/xmldsig-more#hmac-sha512" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://schemas.microsoft.com/.netconfiguration/v2.0" Pattern match: "system.web/anonymousidentification" Pattern match: "system.web/authentication" Pattern match: "system.web/authorization" Pattern match: "system.web/browsercaps" Pattern match: "system.web/clienttarget" Pattern match: "system.web/compilation" Pattern match: "system.web/customerrors" Pattern match: "system.web/deployment" Pattern match: "system.web/devicefilters" Pattern match: "system.web/fulltrustassemblies" Pattern match: "system.web/globalization" Pattern match: "system.web/healthmonitoring" Pattern match: "system.web/hostingenvironment" Pattern match: "system.web/httpcookies" Pattern match: "system.web/httphandlers" Pattern match: "system.web/httpmodules" Pattern match: "system.web/httpruntime" Pattern match: "system.web/identity" Pattern match: "system.web/machinekey" Pattern match: "system.web/membership" Pattern match: "system.web/mobilecontrols" Pattern match: "system.web/pages" Pattern match: "system.web/partialtrustvisibleassemblies" Pattern match: "system.web/processmodel" Pattern match: "system.web/profile" Pattern match: "system.web/protocols" Pattern match: "system.web/rolemanager" Pattern match: "system.web/securitypolicy" Pattern match: "system.web/sessionpagestate" Pattern match: "system.web/sessionstate" Pattern match: "system.web/sitemap" Pattern match: "system.web/trace" Pattern match: "system.web/trust" Pattern match: "system.web/urlmappings" Pattern match: "system.web/webcontrols" Pattern match: "system.web/webparts" Pattern match: "system.web/webservices" Pattern match: "system.web/xhtmlconformance" Pattern match: "system.web/caching" Pattern match: "system.web/caching/cache" Pattern match: "system.web/caching/outputcache" Pattern match: "system.web/caching/outputcachesettings" Pattern match: "system.web/caching/sqlcachedependency" Pattern match: "http://chsk.stayland.space/@=ejn1ugn3qgn,h2:http://chsk.stayland.space/@=ejn1ugn3qgn,t:0" Pattern match: "http://chsk.stayland.space/@=ejn1ugn3qgn" Pattern match: "http://chsk.stayland.space/" Pattern match: "http://chsk.stayland.space/4d74e561.php?ize=wxc&6sa8srwid=6gxcs9q616xujgz7nb&0e1c87f60437dda343e45916fdc2743a=f845db6f696530254592842314482b3e&5b4eefcb6afa91dfc3231907e347a9c7=qz1ydokr2m2ctz5uznwmwykrmmmzjnwatz4qmzzitmijzmhrdz4itn&ize=wxc&6sa8srwid=6gxcs9q" Pattern match: "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/groupsid" Pattern match: "http://www.w3.org/2001/xmlschema#string" Pattern match: "http://schemas.microsoft.com/ws/2008/06/identity/claims/role" Pattern match: "http://chsk.stayland.space" Heuristic match: "e;.ws" Pattern match: "microsoft.net/assembly/gac_msil/system/v4.0_4.0.0.0__b77a5c561934e089/system.dll" Heuristic match: "ystem.drawing.ni" Pattern match: "http://go.mic" Pattern match: "http://schemas.microsoft.com/clr/" Pattern match: "http://schemas.microsoft.com/clr/assem/" Pattern match: "http://schemas.microsoft.com/clr/ns/" Pattern match: "http://schemas.microsoft.com/clr/nsassem/" Heuristic match: "microsoft.net" Heuristic match: "c:\windows\microsoft.net" Pattern match: "microsoft.net/assembly/gac_64/mscorlib/v4.0_4.0.0.0__b77a5c561934e089/mscorlib.dll" Heuristic match: "cim_operatingsystem.name" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is" Heuristic match: "onic.zip.forms.passworddialog.re" Heuristic match: "soft.net" Pattern match: "http://www.validationtest.contoso.com/test%d.html" Heuristic match: "9f52\mscorlib.ni" Heuristic match: "ider,system.co"59:Tb26,Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000420.00000000.216136.03300000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00000852.00000000.215737.02730000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\providerperfdllnetdhcp\idle.exe.configc:\providerperfdllnetdhcp\idle.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configpath2path1c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptor\\.\modeaccessrightsshare\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00000852.00000000.215737.04AC0000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00000852.00000000.215737.04AC0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00003280.00000000.216419.02FC0000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004348.00000000.215178.02840000.00000004.mdmp") Found URL "http://user.configfile:.configfile://datadirectoryc:\providerperfdllnetdhcp\runtimedhcp.exe.configc:\providerperfdllnetdhcp\runtimedhcp.exesystem.net/machine/exe/roaming_user/local_usermachine/exe/roaming_userconfigmachine.configpath2path1c:\windows\microsoft.net\framework64\v4.0.30319\config\machine.configexecutionengine_missingsecuritydescriptor\\.\modeaccessrightsshare\\?\config_base_unrecognized_elementsystem.security.cryptography.randomnumbergeneratorcryptonamemappingoidmapmscorlibmachine.configconfigurationcryptographysettingsc:\windows\microsoft.net\framework64\v4.0.30319\config\c:\users\hapubws\appdata\roaming\microsoft\clr" - Source: "00000000-00004348.00000000.215178.04D70000.00000004.mdmp") Found URL "http://www.w3.org/2000/09/xmldsig" - Source: "00000000-00004348.00000000.215178.04D70000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004348.00000001.215430.02847000.00000004.mdmp") Found URL "http://go.mic3a0f@52,6h@00000000000000000000000000009e1dsectstem.data" - Source: "00000000-00004348.00000001.215430.0286E000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004440.00000000.216423.02C40000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00004572.00000000.216424.02CE0000.00000004.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00006676.00000000.214458.73511000.00000020.mdmp")5a:T8a3,Found string "+ncalrpc:[OLE89B49843953830D723C6E9F56354]" (Indicator: "ncalrpc"; Source: "00000000-00000852.00000000.215737.02730000.00000004.mdmp") Found string "B+ncalrpc:[OLEA3A7C98EE05085D1C80B9D10F058]" (Indicator: "ncalrpc"; Source: "00000000-00004348.00000000.215178.02840000.00000004.mdmp, 00000000-00004348.00000000.215178.1DAF0000.00000004.mdmp, 00000000-00004348.00000001.215430.0286E000.00000004.mdmp") Found string "+ncalrpc:[OLED284F7228CAACDB679107F92A66F]" (Indicator: "ncalrpc"; Source: "00000000-00004348.00000000.215178.02840000.00000004.mdmp, 00000000-00004348.00000001.215430.0286E000.00000004.mdmp") Found string "+ncalrpc:[OLEA3A7C98EE05085D1C80B9D10F058]" (Indicator: "ncalrpc"; Source: "00000000-00004348.00000000.215178.1DAF0000.00000004.mdmp, 00000000-00004348.00000001.215430.1DAF0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00004348.00000000.215178.1DAF0000.00000004.mdmp") Found string "B+ncalrpc:[OLE24444EEAD98C4A2420736B15B646]" (Indicator: "ncalrpc"; Source: "00000000-00004348.00000001.215430.0286E000.00000004.mdmp") Found string "+ncalrpc:[OLE24444EEAD98C4A2420736B15B646]" (Indicator: "ncalrpc"; Source: "00000000-00004348.00000001.215430.1E702000.00000004.mdmp") Found string "+ncalrpc:[OLE1B205DFEB987A90893555D5A7A80]" (Indicator: "ncalrpc"; Source: "00000000-00005052.00000000.216242.033C0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00006676.00000001.214811.02D20000.00000004.mdmp") Found string "+ncalrpc:[OLE77C95EA264FD2D939580B425B98F]" (Indicator: "ncalrpc"; Source: "00000000-00006676.00000001.214811.02D20000.00000004.mdmp") Found string "B+ncalrpc:[OLE24444EEAD98C4A2420736B15B646]" (Indicator: "ncalrpc"; Source: "00000000-00006676.00000001.214811.02D20000.00000004.mdmp") Found string "+ncalrpc:[OLE24444EEAD98C4A2420736B15B646]" (Indicator: "ncalrpc"; Source: "00000000-00006676.00000001.214811.02D20000.00000004.mdmp") Found string "+ncalrpc:[OLEEDEEF44BF304369C539AF2FBD150]" (Indicator: "ncalrpc"; Source: "00000000-00007768.00000000.216421.02D60000.00000004.mdmp")5b:T765,Found reference to API "GetDC" (Indicator: "GetDC"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to API "CreateDC" (Indicator: "CreateDC"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00000852.00000000.215737.04AC0000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003280.00000000.216419.00AB2000.00000002.mdmp") Found reference to API "CreateDC" (Indicator: "CreateDC"; Source: "00000000-00003280.00000000.216419.00AB2000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00003280.00000000.216419.00AB2000.00000002.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00003280.00000000.216419.00AB2000.00000002.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00004348.00000000.215178.04D70000.00000004.mdmp, 00000000-00004348.00000001.215430.02D60000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004348.00000001.215430.1E702000.00000004.mdmp")5c:T994,"" (Indicator: "password"; Source: "00000000-00000852.00000000.215737.1DB40000.00000004.mdmp") Found string "issing password." (Indicator: "password"; Source: "00000000-00003280.00000000.216419.00AB2000.00000002.mdmp") Found string "ad password" (Indicator: "password"; Source: "00000000-00003280.00000000.216419.00AB2000.00000002.mdmp") Found string "upply a password to use AES encryption." (Indicator: "password"; Source: "00000000-00003280.00000000.216419.00AB2000.00000002.mdmp") Found string "his entry requires a password." (Indicator: "password"; Source: "00000000-00003280.00000000.216419.00AB2000.00000002.mdmp") Found string "he password did not match." (Indicator: "password"; Source: "00000000-00003280.00000000.216419.00AB2000.00000002.mdmp") Found string "issing password." (Indicator: "password"; Source: "00000000-00004348.00000001.215430.1E702000.00000004.mdmp") Found string "ad password" (Indicator: "password"; Source: "00000000-00004348.00000001.215430.1E702000.00000004.mdmp") Found string "upply a password"" (Indicator: "password"; Source: "00000000-00004348.00000001.215430.1E702000.00000004.mdmp"), Found string "he password did not match." (Indicator: "password"; Source: "00000000-00004348.00000001.215430.1E702000.00000004.mdmp")62:T688,Found string "\device\mup\" (Indicator: "\Device\"; Source: "00000000-00000420.00000000.216136.03313000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00000852.00000000.215737.02730000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000852.00000000.215737.02730000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00004348.00000000.215178.02840000.00000004.mdmp, 00000000-00004348.00000001.215430.0286E000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00004348.00000000.215178.02840000.00000004.mdmp, 00000000-00004348.00000001.215430.0286E000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00004348.00000000.215178.1DAF0000.00000004.mdmp, 00000000-00004348.00000001.215430.1DAF0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00005052.00000000.216242.033C0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006676.00000000.214458.02D20000.00000004.mdmp, 00000000-00006676.00000001.214811.02D20000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00007768.00000000.216421.02D60000.00000004.mdmp")63:T47a,Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin") Found reference to API "Win32API|Process and Thread Functions|TerminateProcess|uExitCode" (Indicator: "TerminateProcess"; Source: "00000000-00004348.00000000.215178.1DAF0000.00000004.mdmp") Found reference to API "Win32API|Process and Thread Functions|TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00004348.00000000.215178.1DAF0000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00006676.00000000.214458.73525000.00000002.mdmp, 00000000-00006676.00000001.214811.00CD9000.00000002.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00006676.00000001.214811.00CD9000.00000002.mdmp")64:T95a,"++*+(6+(I s;}!s<}"}i{!(*^ L}+(I *:(I (,*&( *2"+*(+2#+*(+2$+*(+2%+*(+2&+*(+2'+*(+2(+*(+2)+*(+2*+*(+2++*(+2,+*(+2-+*(+2.+*(+2/+*(+20+*(+21+*(+22+*(+23+*(+24+*(+25+*(+26+*(+27+*(+28+*(+29+*(+2:+*(+2;+*(+2<+*(+2=+*(+2>+*(+2?+*(+2@+*(+2A+*(+2B+*(+2C+*(+2D+*(+2E+*(+2F+*(+2G+*(+2H+*(+2I+*(+2J+*(+2K+*(+2L+*(+0 | :&~S~P~~ f888~ ξf889~T 88XR~W~: ~U~ f8~U~~ f( o; ~ f( (N((N(Q9~S~R~[~U~~ f( o; ~ f( (N((T(E~U~~ f( o; ~ f( (N((H,XR~](WXF:~S~P~~ f( o; (E~ ξf( (H9~e~Y~: ~U~ f( ~U~~ f( o; ~ f( (N((N(Q~U~~ f( o; ~ f( (N(~U~~ f( o; ~ f( (N((Z&~f (]~h~h~h~h~h~h~~ f( o; ~ f( (`~ f( (`~ rf( (`~ if( ~i(c(`~ xf( ~j(c(`~ Kf( ~R~k~ ^f( ~ f( ~ f( (f(E(`s< ~ls= ~ f( (i(+ ~h~ ֿf( ~ f( o; (`~h~ f( ~ f( o; (`~h~ f( ~ f( o; (`&~S~P~~ f( o; (E~ ξf( (H-"9~p~n(l(o(? ~p~n(l(o (@ &sA ~q(r~s~p~n(l(o(B ~p~n(l(o(C ~p~n(l(o(D (u~_(WsE ~v~t(x({~a(Ws= ~U~ kf( ~w(~(F U~ Jf( (G (N~{~y(~ ef( ~U~ 4f( (N(~~}(~(( ~~ f( ~ f( ~ hf( ( ~~}( (~ ~ Kf( ~~ Bf( o; ~ 9f( ~~ f( o; ~ f( ~(~(~ f( (&8~ls= ~ Kf( ~~ Bf( o; ~ f( ~~ f( o; ~ ܽf( ~(~((i&&* 8( 8o; 8(E8( 8(H8(K88( 8ALvh&0 ~~ f888~ ξf889 8k~~ ½f8a8f~ f8a(H o ~ f( ~o ~ f( ~o ~ rf( ~o ~ if( ( o ~ xf( ( o ~ Kf( ~ ^f( ~ f( ~ f( ( o o ~ f( %o o ~~ f( o; o ~ ξf( ( 9},s= ~ kf( ( (F ~ Jf( (G ( o ~ ef( ~ 4f( ( o ~ jf( ~ f( ~ hf( ( o o! ~ Kf( ~~ Bf( o; ~ Ǻf( ~~ f( o; ~ f( (" ($ ~ f( o% &8s= ~ Kf( ~~ Bf( o; ~ f( ~~ f( o; ~ ܽf( (" ($ ( &+( 8( 8o; 8( 8&*( 82o; 8-o 8(( 8-( 8(A708 + X+ +++(K +(J ++&݁98} (8y8~8T8QJ oL XRXTXoM YT+gXJoN ~3XR+\XT-+.~XJ3XXJ:ZXJXT+XXJXTXJ:2XXJYT:XJ+0 +}8~T8}{%,U.?8rX8q8r8s{"+r+vTXJXJXJXTXJY-J*(-{"{-1 {@J* 8}8|8}88888(80~88~~+888~888sz +4,~ L~ f( ({ (&-X-,i2~R (EH(8w8v(8q8p8t8s(8n,-~c(W9*(8 80H~@+5_b~@+*c_b`~@+c_b`~@+c`h*++++0 ,_+N,Z+Y{++U+V{,+R+SX},+M+N{+%X+F+F{, _},, _%Y,=*+++ ++++++0 8{*8<8{'8{(3:,o*,88{)8{&88{' X}' _{&{' X}' _b`{*_b`}){*X}*{)n-_b-% Yj_i*82868:8>8R8Q8U8Y8X0 888{6T8JEJ-+8p8q8q}78q{7/*8h{7 X}7(+}6(}8{8/*{8X}8(+{7{8X}:{:L}4}6(}9{9/*{9X}9(+L}3}=}6+AX(TXJ/*(+{3~>{=XJҜ{=X}={={92{3s>}5}3}=}6+<{4X{=TXJX}=XJ%}<{={:3*{5(%_,/*2}+0D88{"88888{T8JYE0/8, 8{"8($Y% /9'*{${!(% _, /#%:X/*}%}$}*~ Y}~ Y}{1J}X{!{(TXJ/*-{!{(+{XJX} }:{%{!(/*~}~}{1K }X{!{(TXJ%-/*{!{(+{XJX}{"{{(({Y,} <* 88('8888888#0|~+\~8X8Y~++&+,-,-++,"+o| ++++~(-+(/** 88(8+4J0 +f8g{-8c8dX}--+^ 3,+Uz,+V{++R+S{, X},Ҝ--{, _},*88 88+sx ++++088{-8X%}-8 18z8{,8Y _8-v 8-Y0c{,/Z0L{+{+{,(y {,X},*{+{,X},{+%X %Y0*(*8483878>sx 8@8@8D 8J8Q08X8Y8Z8_L8Z8[(%%c8S8TbY {z}@8GEy8(%TJLXT+SX(%TX(%TXJLio4 &XJs9XJ(&XXJXJXTXJJ2+wL%K(i L%E(i (iYo~ ()- o rp 4rps zrsps zo * 88sB8888 8 8 8+08 88T+Q8%X88{)Ҝ88{)d})88{*Y}*YJXT{*10-J*X{({'YTXJ1XJ{&{'(y {'X}'{'{(Y_,4{&X{'TXJX}'XJ _})}*JX* 88888888805@848488XT+D8X88XJT8XJ18XJ4%JXTXXJXTXJi2TX TXT+uXJJJXJXJY_bXTXJ 2?XXJ _TXJ _TXXJXJXJYXJY_cXTXXJXTXJ>XJN}.X T XT8$XJ _TJ XJ XJY_bYT(XJ _T+E{.(XJ(XJeb XJ`hXXJ XJ Y_bXT(X(XJ XT(XJ$XJ2 X XJYT XJ ( 8?8>(#89( 8482810I88~ %X9&88 _-888-e~V *8,,@_-?_b~ %X-X +7_b~ %XbX~ %XbX-~ %XX- -~~~(~ (( ~~~( i((~,( &-*888888 888` 02rprp, 8%-~S~rp8,98~~8-~~8rp88~~+3+4(L~(&-() +(+,~c(W*sI 8((H8Fs 8O(8Y(8f(8f 8eI0S+/, f%, a+$+&~-Y+~--++*++*+++++(/++(!+0|4%F+Q-B4%M+A,4%N+1%,4%I+!--*(i +(i +(i +(i +0 L8:9&,\+8%X88 2,`+-8%X8 8 2+8%X %,62+%X 2s>/ L +%X 2,s>0* 8H8P8T8W8X8f8i8k8s0\4%L+91-%,4%G+'2-%,͍4%J+>*(i +(i +(i +0 4%J8^?L%H8Q@ NA LB-\8/+-~A8)08(Xb8&-~B%X88 2+&~A8 Xb(~B%X 2::+(~A X b(9~B%X 2+~AXb(~B%X 2NCLD:3 +(~Cb(9~D9X 2*(i 8(i 8 888(8 888{z}O/ˁelf N-?> ^Q`'§}6e}ZkEUGh!_@clhJp.eZULb㈯CتX%IW%i˪ ξ|-:|&|; FdPeCpUre/^ËMFdn{g$̥StX5p^dj740%%X x-Z^>nQ/zn)d-in?̲5xvܠS@5nLK Įeӷ茱PP s)L-FViQ6GՀ˶'f =Q5hH_Zj@ !UJ\v9dmw%P(Kb"Pgvoc'J5Gfr]>JpmfawW1Vtn~Km0Kֹ-4gAJsY49q[_`<[Y渗l_sXЄ|58n/Zm7 SNڸgB07Qan8F/޼( 2SJ@XҢՏjUSX\xߙAuQq1HgBQ໫1MhEZr YK@;DzPfXQ.k@aABSJBv4.0.30319l#-dp#Strings'#US(#GUID(#Blobw( %3PNf I tH, T mW W u T W / f G L 1 W Z L8 8 _ a ( P8 ''' _ 4 = f9& G A' t8 F8 $-I X 1 2 3 4446 7 89 99&;+< .=1??AEB ECOCOCOC OCOC j AOC OC SF TI UL VO ZR \U dX f[ g^ ia kd# lg% nj( om* qp, rs. tv1 uy3 w|6 x8 z; |= ~@ B ! % ( , / 2 5 9 < ? B E H L At|Z|31133331VVVV 3333 6633 31311113333333333 $$////// //#9"9%E(P'P*\,\.a1m0m3x658;:=@?B! %$(,+/25#9.8.<=?=BBEMHMLRKRP_O_TlSlWzZ]a`edhlk !"#$%&'()*+ -./0123456789:;<=>?@ABDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~CH# 'Ox0 s# {# 4m8 7@8h# # # :`;#=@>#>? @(AA$C+`C0C8D?G4HJG $L*$RKXZ$L|$R$_K0LeNl$vO}S$_,TG$# # # $GUVG# # %DWs# C% W[%s# X8Yj% Ft%F%F)%FZ%F%F)%F4%F>%FJ%FU%F.%Ff&Fr&F}&F*&F7&FD&FQ&F^&Fk&Fx&F&F&F&F&F&F&Fk&F(&F3&F4&FG'F'FW!'Fd.'Fq;'FH'FU'Fb'Fo'F|'F'F'2y2y O P NN^P I. .I~ 2Q;8I* =Y! CY CY,IYD aJ iD qJ Y5NyTIZ``,dk$puaza> V1 IB II* R !yd!U !iAdiC!Q)Y a.i q3:> LE7Lt LPLLCY1 k. 1T^A.g{.IALInAs@z6YI D Ll { b Y51! !b91p16L V&A.A.I Q Y )p 8 ak)Ei LIgNQWi.yH^ 1dLPTX..CjjCc#CtLt x!EY~ 'P E FP!G`!Hp!I!J8"KH"LX"M"N - !}k~~~~~~~~~~~~~~~Ldarg_0Ldarg_1Microsoft.Win32ToInt32Ldarg_2Dictionary`2m000043Ldarg_3Int64Ldc_I4MD5Int16get_UTF8UIDtypeIDmmiKHH6M54HVHget_ASCIISystem.IOLdarg_Sget_Xget_Yvalue__UploadDatamscorlibSubSystem.Collections.Genericget_IsStaticReadThreadOnLoadAddSystem.Collections.SpecializedAppendDynamicMethodmethodReplaceOpCodeFromImageEndInvokeBeginInvokeIDisposableRuntimeFieldHandleRuntimeMethodHandleResolveMethodHandleget_ModuleHandleRuntimeTypeHandleResolveTypeHandleGetMethodFromHandleGetTypeFromHandleRectangleget_Moduleget_Nameget_MachineNameConfigPluginNameget_UserNameElapsedTimeDateTimeOnStealerDoneget_FieldTypeValueTypeSecurityProtocolTypeget_ReturnTypeownerTypeget_ParameterTypeSystem.CoreMethodBaseCloseDisposeCreateCreateDelegateCreateGetStringDelegateMulticastDelegateCompilerGeneratedAttributeAttributeUsageAttributeAssemblyFileVersionAttributeCompilationRelaxationsAttributeRuntimeCompatibilityAttributeReadByteTryGetValueSetValueSaveget_SizeDeserializedwoQN1OowL251Plugin1VDvC7y0FbnQfBuildTagConfigget_PngSystem.Threadingget_EncodingSystem.Drawing.ImagingFromBase64StringEscapeDataStringDownloadStringToStringGetStringSystem.DrawingWorkLogComputeHashMathPathget_Widthget_LengthUriAsyncCallbackcallbackTransformFinalBlockCallTailcallset_SecurityProtocolGetManifestResourceStreamMemoryStreamget_ItemSystemSymmetricAlgorithmHashAlgorithmICryptoTransformEnumTimeSpanCopyFromScreenget_PrimaryScreenget_MetadataTokenMinCopyPixelOperationSystem.Web.Script.SerializationSystem.ReflectionNameValueCollectionWebHeaderCollectionArgumentOutOfRangeExceptionInvalidOperationExceptionFormatExceptionInternFieldInfoMethodInfoMemberInfoParameterInfoBitmapSleepCharAesCryptoServiceProviderStringBuilderServicePointManagerCurrentUserEnterToLowerJavaScriptSerializerGetILGenerator.ctor.cctorMonitorCreateDecryptorCreateEncryptordummy_ptrGraphicsGetFieldsget_BoundsGetMethodsSystem.Runtime.CompilerServicesOpCodesScannedDirectoriesGetModulesCreateMemberRefsDelegatesGetBytesBindingFlagsStringsget_TicksSystem.Windows.FormsSystem.Web.Extensionsget_Charsget_HeadersRuntimeHelpersGetParametersHostAddressAttributeTargetsConcatImageFormatPixelFormatObjectobjectSystem.NetRetPUcCx3SuTQiftget_HeightSystem.Reflection.EmitOnInitExitIAsyncResultWorkResultresultWebClientEnvironmentConvertCallvirtSystem.Textget_NowInitializeArrayToArrayCreateSubKeyOpenSubKeyRegistryKeySystem.Security.CryptographyGetExecutingAssemblydummyCopyRegistryop_EqualityEmptyMemberRefsProxy{f2553ab1-f51b-48e1-afcd-a5919dfaf2e2}{a939bb7b-371d-4ab2-995f-90bbdebb96f2}{cbfe422f-504f-4f14-b6b8-eb7310dbb04a}~~~~~~~~~~~~~versionaSelected compression algorithm is not supported.Unknown Header122M{cbfe422f-504f-4f14-b6b8-eb7310dbb04a}#oO~z\V4 ?_ :18V6N5 - A Q U1Y ]ae 5ei m u u 5 - 0 ] ! ! `XTX X X \`d T\XdXlX\\ XX`\X8LX\d` xt| - A Q U 1Y ]a e 5e i m u $ ( 5 0 4 TWrapNonExceptionThrowslD@--1MUUUUUiMi $% lL 5Ѝ _CorDllMainmscoree.dll% @0HX4VS_VERSION_INFO? StringFileInfo000004B0$FileVersion$InternalName(LegalCopyright OriginalFilename(ProductVersion Assembly VersionDVarFileInfo$Translation>"6b:T4fd,16/26 Antivirus vendors marked spawned process "winlogon.exe" (PID: 7932) as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked spawned process "WinStore.App.exe" (PID: 7188) as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked spawned process "sppsvc.exe" (PID: 5052) as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked spawned process "taskhostw.exe" (PID: 744) as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked spawned process "msdtc.exe" (PID: 3280) as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked spawned process "fontdrvhost.exe" (PID: 4440) as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked spawned process "Idle.exe" (PID: 7768) as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked spawned process "dwm.exe" (PID: 4572) as malicious (classified as "MSIL.Stealer" with 61% detection rate) 16/26 Antivirus vendors marked spawned process "conhost.exe" (PID: 5504) as malicious (classified as "MSIL.Stealer" with 61% detection rate)6c:T665,YARA signature "MALWARE_Win_DCRat" matched file "dwm.exe" as "DCRat payload" (Author: ditekSHen) YARA signature "MALWARE_Win_DCRat" matched file "msdtc.exe" as "DCRat payload" (Author: ditekSHen) YARA signature "MALWARE_Win_DCRat" matched file "sppsvc.exe" as "DCRat payload" (Author: ditekSHen) YARA signature "MALWARE_Win_DCRat" matched file "smss.exe" as "DCRat payload" (Author: ditekSHen) YARA signature "MALWARE_Win_DCRat" matched file "sihost.exe" as "DCRat payload" (Author: ditekSHen) YARA signature "MALWARE_Win_DCRat" matched file "Runtimedhcp.exe" as "DCRat payload" (Author: ditekSHen) YARA signature "MALWARE_Win_DCRat" matched file "winlogon.exe" as "DCRat payload" (Author: ditekSHen) YARA signature "MALWARE_Win_DCRat" matched file "RuntimeBroker.exe" as "DCRat payload" (Author: ditekSHen) YARA signature "MALWARE_Win_DCRat" matched file "WinStore.App.exe" as "DCRat payload" (Author: ditekSHen) YARA signature "MALWARE_Win_DCRat" matched file "dllhost.exe" as "DCRat payload" (Author: ditekSHen) YARA signature "MALWARE_Win_DCRat" matched file "taskhostw.exe" as "DCRat payload" (Author: ditekSHen) YARA signature "MALWARE_Win_DCRat" matched file "conhost.exe" as "DCRat payload" (Author: ditekSHen) YARA signature "MALWARE_Win_DCRat" matched file "fontdrvhost.exe" as "DCRat payload" (Author: ditekSHen) YARA signature "MALWARE_Win_DCRat" matched file "wininit.exe" as "DCRat payload" (Author: ditekSHen) YARA signature "MALWARE_Win_DCRat" matched file "Idle.exe" as "DCRat payload" (Author: ditekSHen) YARA signature "MALWARE_Win_DCRat" matched file "sample.bin" as "DCRat payload" (Author: ditekSHen)6d:T43c,Spawned process "nuldel /a /q /f \"\" (Indicator: \"w32tm \"; File: \"aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin\"), Found string \"@echo offw32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nulstart \"\" \"\" (Indicator: \"w32tm \"; File: \"aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin\")\n Found string \"w32tm /stripchart /computer:localhost /period:5 /dataonly /samples:2 1>nul\" (Indicator: \"w32tm \"; Source: \"00000000-00003280.00000000.216419.00AB2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-519","sources":[{"report_type":"sandbox","report_id":"69dbb2b9baac174af90739c2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"69dbb2b9baac174af90739c2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"69dbb2b9baac174af90739c2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00006676-37245-75-00CD5341\n GetProcessHeap@KERNEL32.DLL at 00000000-00006676-37245-77-00CD52DC\n GetProcessHeap@KERNEL32.DLL at 00000000-00006676-37245-80-00CD52C5","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"69dbb2b9baac174af90739c2"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$36","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"69dbb2b9baac174af90739c2"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"Runtimedhcp.exe\" queries volume information of \"C:\\providerPerfdllNetDhcp\\Runtimedhcp.exe\" at 00000000-00004348-00000C17-2353076687\n \"Idle.exe\" queries volume information of \"C:\\providerPerfdllNetDhcp\\Idle.exe\" at 00000000-00000852-00000C17-2361562750\n \"Idle.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Web.Extensions\\v4.0_4.0.0.0__31bf3856ad364e35\\System.Web.Extensions.dll\" at 00000000-00000852-00000C17-2365493387\n \"Idle.exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_64\\System.Web\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Web.dll\" at 00000000-00000852-00000C17-2367107521","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"69dbb2b9baac174af90739c2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00000852.00000000.215737.04AC0000.00000004.mdmp, 00000000-00000852.00000000.215737.1DB40000.00000004.mdmp\")\n Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00004348.00000000.215178.04D70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"69dbb2b9baac174af90739c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in file \"aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin\"\n Found registry query API: \"RegQueryValueExW\" in file \"aaded591ef03e4240cb99b86eeb6f7cb0b862580690dd67d6171a8834558f93c.bin\"\n Found registry query API: \"RegQueryValueA\" in \"00000000-00006676.00000001.214811.00CD9000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyA\" in \"00000000-00006676.00000001.214811.00CD9000.00000002.mdmp\"\n Found registry query API: \"RegEnumKeyExA\" in \"00000000-00006676.00000001.214811.00CD9000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExA\" in \"00000000-00006676.00000001.214811.00CD9000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExA\" in \"00000000-00006676.00000001.214811.00CD9000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00006676.00000001.214811.00CD9000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00006676.00000001.214811.00CD9000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69dbb2b9baac174af90739c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"file/memory contains long string(File: \"Idle.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"69dbb2b9baac174af90739c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"LsaLookupSids2\" (Indicator: \"LsaLookupSids\"; Source: \"00000000-00000420.00000000.216136.03313000.00000004.mdmp\")\n Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00006676.00000001.214811.00CD9000.00000002.mdmp\")\n Found reference to API \"GetUserNameW\" (Indicator: \"GetUserName\"; Source: \"00000000-00006676.00000001.214811.00CD9000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69dbb2b9baac174af90739c2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"