26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T48f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mint.Zard.Generic Sample ab0c6d4640de… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ab0c6d4640de…. Malware family: Mint.Zard.Generic. Threat score 100/100. 11/27 AV engines flagged this file. 7 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","keywords":["Malicious","Mint.Zard.Generic","malware analysis","sandbox report","threat intelligence","ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","executable"],"identifier":"ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mint.Zard.Generic","antivirusDetections":{"malicious":11,"total":27},"behavioralIndicators":{"malicious":7,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T8ff,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "file") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "file") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "file") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "file") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "file") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; File: "file") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; File: "file") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; File: "file") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp")28:Tbe9,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "file") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "file") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "file") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "file") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "file") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp")29:T485,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "file") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "file") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp")2a:T71e,"wuu0nt.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\INTERFACE\{D8F6AD5B-B44F-4BCC-88FD-EB3473DB7502}\PROXYSTUBCLSID32") "wuu0nt.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{D8F6AD5B-B44F-4BCC-88FD-EB3473DB7502}\PROXYSTUBCLSID32") "wuu0nt.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{D8F6AD5B-B44F-4BCC-88FD-EB3473DB7502}\PROXYSTUBCLSID32") "wuu0nt.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\INTERFACE\{D8F6AD5B-B44F-4BCC-88FD-EB3473DB7502}\PROXYSTUBCLSID32") "wuu0nt.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\MS-AVAILABLENETWORKS") "wuu0nt.exe" (Access type: "OPEN"; Path: "HKCU\MS-AVAILABLENETWORKS\APPLICATION") "wuu0nt.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\MS-AVAILABLENETWORKS\APPLICATION") "wuu0nt.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\MS-AVAILABLENETWORKS\SHELL\OPEN") "wuu0nt.exe" (Access type: "OPEN"; Path: "HKCU\MS-AVAILABLENETWORKS\SHELL\OPEN\COMMAND") "wuu0nt.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\MS-AVAILABLENETWORKS\SHELL\OPEN\COMMAND") "wuu0nt.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\MS-AVAILABLENETWORKS\SHELL\OPEN\COMMAND") "wuu0nt.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\MS-AVAILABLENETWORKS\SHELL\OPEN\COMMAND") "wuu0nt.exe" (Access type: "OPEN"; Path: "HKCU\APPLICATIONS\LAUNCHWINAPP.EXE") "wuu0nt.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\APPLICATIONS\LAUNCHWINAPP.EXE") "wuu0nt.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\APPLICATIONS\LAUNCHWINAPP.EXE") "wuu0nt.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\APPLICATIONS\LAUNCHWINAPP.EXE") "wuu0nt.exe" (Access type: "OPEN"; Path: "HKCU\APPLICATIONS\LAUNCHWINAPP.EXE\SHELL")2b:T9af,"file.exe" queried SystemProcessInformation at 00000000-00006596-00000C15-856802484 [PID: 6596] "file.exe" queried SystemProcessInformation at 00000000-00006596-00000C15-856812334 [PID: 6596] "file.exe" queried SystemProcessInformation at 00000000-00006596-00000C15-856999200 [PID: 6596] "file.exe" queried SystemProcessInformation at 00000000-00006596-00000C15-857007681 [PID: 6596] "wuu0nt.exe" queried SystemProcessInformation at 00000000-00001304-00000C15-857623547 [PID: 1304] "wuu0nt.exe" queried SystemProcessInformation at 00000000-00001304-00000C15-857633243 [PID: 1304] "wuu0nt.exe" queried SystemProcessInformation at 00000000-00001304-00000C15-857791166 [PID: 1304] "wuu0nt.exe" queried SystemProcessInformation at 00000000-00001304-00000C15-857800736 [PID: 1304] "wuu0nt.exe" queried SystemProcessInformation at 00000000-00001304-00000C15-858380890 [PID: 1304] "wuu0nt.exe" queried SystemProcessInformation at 00000000-00001304-00000C15-858389968 [PID: 1304] "wuu0nt.exe" queried SystemProcessInformation at 00000000-00001304-00000C15-859408908 [PID: 1304] "wuu0nt.exe" queried SystemProcessInformation at 00000000-00001304-00000C15-859418396 [PID: 1304] "wuu0nt.exe" queried SystemProcessInformation at 00000000-00001304-00000C15-860078071 [PID: 1304] "wuu0nt.exe" queried SystemProcessInformation at 00000000-00001304-00000C15-860087796 [PID: 1304] "wuu0nt.exe" queried SystemProcessInformation at 00000000-00001304-00000C15-860604020 [PID: 1304] "wuu0nt.exe" queried SystemProcessInformation at 00000000-00001304-00000C15-860612902 [PID: 1304] "wuu0nt.exe" queried SystemProcessInformation at 00000000-00001304-00000C15-860897630 [PID: 1304] "wuu0nt.exe" queried SystemProcessInformation at 00000000-00001304-00000C15-860907924 [PID: 1304] "imgcache.exe" queried SystemProcessInformation at 00000000-00007368-00000C15-859886184 [PID: 7368] "imgcache.exe" queried SystemProcessInformation at 00000000-00007368-00000C15-859904867 [PID: 7368] "imgcache.exe" queried SystemProcessInformation at 00000000-00007368-00000C15-860115369 [PID: 7368] "imgcache.exe" queried SystemProcessInformation at 00000000-00007368-00000C15-860124732 [PID: 7368] "imgcache.exe" queried SystemProcessInformation at 00000000-00007368-00000C15-860727375 [PID: 7368] "imgcache.exe" queried SystemProcessInformation at 00000000-00007368-00000C15-860735930 [PID: 7368] "imgcache.exe" queried SystemProcessInformation at 00000000-00007368-00000C15-861011379 [PID: 7368]2c:Tb90,Assembly shows XOR instruction xor ebx 01h in Stream UID: 45137-63-004014B0 Assembly shows XOR instruction xor eax 3Dh in Stream UID: 45137-929-00436440 Assembly shows XOR instruction xor al byte ptr [edx+007D7534h] in Stream UID: 45137-934-0042AF11 Assembly shows XOR instruction xor eax 43h in Stream UID: 45137-934-0042AF11 Assembly shows XOR instruction xor eax 3Dh in Stream UID: 45137-934-0042AF11 Assembly shows XOR instruction xor al byte ptr [edx+007D7540h] in Stream UID: 45137-937-00429308 Assembly shows XOR instruction xor eax 43h in Stream UID: 45137-937-00429308 Assembly shows XOR instruction xor ecx 3Dh in Stream UID: 45137-937-00429308 Assembly shows XOR instruction xor al byte ptr [edx+007D754Ch] in Stream UID: 45137-937-00429308 Assembly shows XOR instruction xor al byte ptr [edx+007D7534h] in Stream UID: 45137-937-00429308 Assembly shows XOR instruction xor al byte ptr [edx+007D7534h] in Stream UID: 45137-938-0042970C Assembly shows XOR instruction xor eax 43h in Stream UID: 45137-938-0042970C Assembly shows XOR instruction xor al byte ptr [edx+007D7540h] in Stream UID: 45137-938-0042970C Assembly shows XOR instruction xor edx 3Dh in Stream UID: 45137-938-0042970C Assembly shows XOR instruction xor al byte ptr [edx+007D73A0h] in Stream UID: 45137-939-004286CC Assembly shows XOR instruction xor eax 43h in Stream UID: 45137-939-004286CC Assembly shows XOR instruction xor al byte ptr [edx+007D755Ch] in Stream UID: 45137-939-004286CC Assembly shows XOR instruction xor ecx 3Dh in Stream UID: 45137-939-004286CC Assembly shows XOR instruction xor al byte ptr [edx+007D73B8h] in Stream UID: 45137-939-004286CC Assembly shows XOR instruction xor al byte ptr [ecx+007D73C0h] in Stream UID: 45137-939-004286CC Assembly shows XOR instruction xor cl byte ptr [edx+eax] in Stream UID: 45137-942-0042A244 Assembly shows XOR instruction xor al byte ptr [ebp+edx+00h] in Stream UID: 45137-943-0042A198 Assembly shows XOR instruction xor eax 43h in Stream UID: 45137-943-0042A198 Assembly shows XOR instruction xor ecx 3Dh in Stream UID: 45137-944-0042A46F Assembly shows XOR instruction xor al byte ptr [edx+007D7440h] in Stream UID: 45137-944-0042A46F Assembly shows XOR instruction xor eax 43h in Stream UID: 45137-944-0042A46F Assembly shows XOR instruction xor al byte ptr [edx+007D7540h] in Stream UID: 45137-945-00428214 Assembly shows XOR instruction xor eax 43h in Stream UID: 45137-945-00428214 Assembly shows XOR instruction xor edx 3Dh in Stream UID: 45137-945-00428214 Assembly shows XOR instruction xor eax 01h in Stream UID: 45137-1016-0043D92C Assembly shows XOR instruction xor edx 3Dh in Stream UID: 45137-1326-00436160 Assembly shows XOR instruction xor edx 3Dh in Stream UID: 45137-1365-004399E1 Assembly shows XOR instruction xor edx 3Dh in Stream UID: 45137-1367-0043A0B1 Assembly shows XOR instruction xor edx 3Dh in Stream UID: 45137-1389-0043C0412d:Tce8,Contains base64 string in header "http" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "client/1" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "1Content" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Type" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "streamAccept" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1Host: tonapi.ioUser-Agent: Go-http-client/1.1Content-Type: application/octet-streamAccept-Encoding: gzip" Contains base64 string in header "POST" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "orbs" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "http" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "client/2" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "0Content" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "Type" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "Encoding" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip" Contains base64 string in header "gzip" in header "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2Host: ton.access.orbs.networkUser-Agent: Go-http-client/2.0Content-Type: application/jsonAccept-Encoding: gzip"2e:T9488,Found XOR loop in file "wuu0nt.exe" at offset 327808; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 330272; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 375484; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 382193; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 384000; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 410036; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 428693; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 506878; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 533506; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 549259; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 691163; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 968393; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 968849; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 1028659; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 1030176; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 1093438; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 1185863; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 1187184; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 1235883; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 1387213; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 1439436; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 1476166; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 1551347; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 1553478; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 1718842; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 1808038; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 1900318; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 1924686; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 2003573; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 2041595; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 2237411; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 2382341; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 2473162; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 2643908; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 2717510; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 2729514; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 2992046; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 3004754; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 3049541; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 3063149; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 3121726; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 3167402; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 3176525; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 3280277; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 3382572; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 3505430; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 3630848; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 3677552; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 3746572; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 3814625; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 3833362; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 3923450; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 3973141; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 3991534; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 4046373; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 4047307; code bytes = 30d0 Found XOR loop in file "wuu0nt.exe" at offset 294989; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 340901; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 377387; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 470918; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 603527; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 607841; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 613873; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 652132; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 782922; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 846566; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 849162; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 1007457; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 1019289; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 1169859; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 1183219; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 1227393; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 1329156; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 1531891; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 1833176; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 1908729; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 1982536; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 2031908; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 2200570; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 2284764; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 2371091; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 2523209; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 2527265; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 2723143; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 2823373; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 2849091; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 3081010; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 3175645; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 3317855; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 3342343; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 3364379; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 3513368; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 3515887; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 3610117; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 3634377; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 3660465; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 3874572; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 3927266; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 3931165; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 3991377; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 3992263; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 4013058; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 4043383; code bytes = 33c1 Found XOR loop in file "wuu0nt.exe" at offset 335555; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 352148; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 375252; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 388049; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 445293; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 513697; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 540817; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 589483; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 613024; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 757541; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 783421; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 816859; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 846293; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 884305; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 963210; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 977986; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 984053; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 1060838; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 1284401; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 1377770; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 1393569; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 1396506; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 1415470; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 1538016; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 1567391; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 1570073; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 1623599; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 1765129; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 1786159; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 1815477; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 1915110; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 1975235; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 2153365; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 2192077; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 2321163; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 2335669; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 2363015; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 2521060; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 2571052; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 2575940; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 2621042; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 2738648; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 2891390; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 2899999; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 2922042; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 2934309; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 3003782; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 3051452; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 3078889; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 3079842; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 3125957; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 3179060; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 3271308; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 3309950; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 3325481; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 3328050; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 3412123; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 3418093; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 3447611; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 3559729; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 3568129; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 3716763; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 3757986; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 3908866; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 4040754; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 4043348; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 4046334; code bytes = 8030 Found XOR loop in file "wuu0nt.exe" at offset 4047288; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 132713; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 237430; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 286672; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 293003; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 318428; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 427219; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 477744; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 498601; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 533427; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 684379; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 813101; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 863562; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 892735; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 903991; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 929211; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 997955; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 1087804; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 1093565; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 1118822; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 1173466; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 1236057; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 1264439; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 1292764; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 1380001; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 1413455; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 1486802; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 1516365; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 1540406; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 1589314; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 1660975; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 1847302; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 1899124; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 1909554; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 1931370; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 2046824; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 2061657; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 2400689; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 2499205; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 2500013; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 2541040; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 2606489; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 2627501; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 2637723; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 2695328; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 2933233; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 3108920; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 3182730; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 3206187; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 3245469; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 3251418; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 3339840; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 3529266; code bytes = 30d0 Found XOR loop in file "imgcache.exe" at offset 42595; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 47379; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 232398; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 267503; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 313411; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 359416; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 483302; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 523686; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 636794; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 638153; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 939286; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 981230; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 994217; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 1109678; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 1217679; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 1307409; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 1395610; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 1423788; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 1432068; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 1501766; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 1509261; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 1554672; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 1570957; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 1578857; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 1676030; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 1798862; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 1816686; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 1831787; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 1846322; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 2034458; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 2074137; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 2074946; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 2106671; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 2268200; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 2292965; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 2298463; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 2308021; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 2366895; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 2415512; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 2506763; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 2522734; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 2611168; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 2639510; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 2646005; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 2656289; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 2669993; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 2673339; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 2674242; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 2928502; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 2938960; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 2977010; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 3177452; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 3227610; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 3389978; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 3496578; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 3539447; code bytes = 33c1 Found XOR loop in file "imgcache.exe" at offset 86365; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 166598; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 188651; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 391900; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 450629; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 458319; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 504155; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 674811; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 697187; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 785116; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 809576; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 815033; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 1037025; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 1037682; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 1062441; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 1092777; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 1101399; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 1116329; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 1144731; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 1145006; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 1177759; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 1213278; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 1243904; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 1276560; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 1278696; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 1361332; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 1421019; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 1474804; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 1525902; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 1590071; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 1661881; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 1974002; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 2006909; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 2036383; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 2054732; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 2084310; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 2132960; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 2172191; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 2222931; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 2223257; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 2240542; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 2322622; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 2551371; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 2666745; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 2953965; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 2955301; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 2959816; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 3086541; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 3131978; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 3132980; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 3167575; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 3198650; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 3260435; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 3265396; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 3291611; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 3298476; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 3380164; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 3400872; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 3422936; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 3448201; code bytes = 8030 Found XOR loop in file "imgcache.exe" at offset 3512354; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 327808; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 330272; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 375484; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 382193; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 384000; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 410036; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 428693; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 506878; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 533506; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 549259; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 691163; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 968393; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 968849; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1028659; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1030176; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1093438; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1185863; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1187184; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1235883; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1387213; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1439436; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1476166; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1551347; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1553478; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1718842; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1808038; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1900318; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1924686; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2003573; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2041595; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2237411; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2382341; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2473162; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2643908; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2717510; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2729514; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2992046; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3004754; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3049541; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3063149; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3121726; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3167402; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3176525; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3280277; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3382572; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3505430; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3630848; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3677552; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3746572; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3814625; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3833362; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3923450; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3973141; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3991534; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4046373; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4047307; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 294989; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 340901; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 377387; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 470918; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 603527; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 607841; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 613873; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 652132; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 782922; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 846566; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 849162; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1007457; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1019289; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1169859; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1183219; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1227393; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1329156; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1531891; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1833176; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1908729; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1982536; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2031908; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2200570; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2284764; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2371091; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2523209; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2527265; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2723143; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2823373; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2849091; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3081010; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3175645; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3317855; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3342343; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3364379; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3513368; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3515887; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3610117; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3634377; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3660465; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3874572; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3927266; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3931165; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3991377; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3992263; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4013058; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4043383; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 335555; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 352148; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 375252; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 388049; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 445293; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 513697; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 540817; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 589483; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 613024; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 757541; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 783421; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 816859; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 846293; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 884305; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 963210; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 977986; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 984053; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1060838; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1284401; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1377770; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1393569; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1396506; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1415470; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1538016; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1567391; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1570073; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1623599; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1765129; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1786159; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1815477; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1915110; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1975235; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2153365; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2192077; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2321163; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2335669; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2363015; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2521060; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2571052; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2575940; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2621042; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2738648; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2891390; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2899999; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2922042; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2934309; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3003782; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3051452; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3078889; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3079842; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3125957; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3179060; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3271308; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3309950; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3325481; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3328050; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3412123; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3418093; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3447611; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3559729; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3568129; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3716763; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3757986; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3908866; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4040754; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4043348; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4046334; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4047288; code bytes = 80302f:T478,Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "file") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; File: "file") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "file") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp")30:T534,Found system information discovery API: "GetEnvironmentStringsW" in file "file" Found system information discovery API: "ExpandEnvironmentStringsW" in file "file" Found system information discovery API: "GetUserObjectInformationW" in file "file" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00001304.00000000.155821.007D9000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00001304.00000000.155821.007D9000.00000004.mdmp" Found system information discovery API: "GetUserObjectInformationW" in "00000000-00006596.00000000.155766.007AB000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00006596.00000000.155766.007D9000.00000004.mdmp" Found system information discovery API: "NtQuerySystemInformation" in "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp" Found system information discovery API: "RtlNtStatusToDosError" in "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp" Found system information discovery API: "GetMonitorInfoW" in "00000000-00007368.00000000.155968.05C00000.00000004.mdmp"31:T572,"wuu0nt.exe" called "GetWindowTextW" (UID: 00000000-00001304) "wuu0nt.exe" called "GetWindowTextW" with parameter "Network Flyout" - (UID: 00000000-00001304) "wuu0nt.exe" called "GetWindowTextW" with parameter "AutoIt v3" - (UID: 00000000-00001304) "wuu0nt.exe" called "GetWindowTextW" with parameter "%PROGRAMFILES%\Wireshark\dumpcap.exe" - (UID: 00000000-00001304) "wuu0nt.exe" called "GetWindowTextW" with parameter "%PROGRAMFILES%\mitmproxy\bin\_internal\mitmproxy_windows\windows-redirector.exe" - (UID: 00000000-00001304) "wuu0nt.exe" called "GetWindowTextW" with parameter "%PROGRAMFILES%\Wireshark\tshark.exe" - (UID: 00000000-00001304) "wuu0nt.exe" called "GetWindowTextW" with parameter "%WINDIR%\system32\cmd.exe" - (UID: 00000000-00001304) "wuu0nt.exe" called "GetWindowTextW" with parameter "Settings" - (UID: 00000000-00001304) "wuu0nt.exe" called "GetWindowTextW" with parameter "Microsoft OneNote 2010 - Windows taskbar" - (UID: 00000000-00001304) "wuu0nt.exe" called "GetWindowTextW" with parameter "DnDControlTitle" - (UID: 00000000-00001304) "wuu0nt.exe" called "GetWindowTextW" with parameter "VMSwitchUserControlTitle" - (UID: 00000000-00001304) "wuu0nt.exe" called "GetWindowTextW" with parameter "vmtoolsdControlWndTitle" - (UID: 00000000-00001304) "wuu0nt.exe" called "GetWindowTextW" with parameter "Windows Shell Experience Host" - (UID: 00000000-00001304)32:T2278,"file.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006596) "file.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006596) "file.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006596) "wuu0nt.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001304) "wuu0nt.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001304) "wuu0nt.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001304) "wuu0nt.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001304) "wuu0nt.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e4904c9202000000ac161575e0b578770cccde775401048000020000ac934c920000000000000000ce0400005ce8e077eeb47877ce0400009723d9a3ac1615755401048026b5787784de880640921775ce040000ac1615759723d9a34cde880680de88063ce18806f0fb797707d2d3d2feffffffa4de8806e5642875 (UID: 00000000-00001304) "imgcache.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000b0000009e29de7798cc7a0300000000280000002400000000007903c0ee5e000000000000000000000000000000000000000000d007810030000000000000000b0000000000810000000000ba000000000000000000000060ca7a0358b379030b000000000000002000000000008100d0018100d40b810000000000d00b810000000000b8ee5e0050f5dd7798cc7a0320ef5e006cef5e00 (UID: 00000000-00007368) "imgcache.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007368) "imgcache.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007368) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007072) "rundll32.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007072) "rundll32.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000e0ac777efc7f0000000000000000000051ed1b80fc7f000000000000fc7f0000000000000000000032f5629885590000000001001a00010040dd2c80fc7f00008fec1b80fc7f0000e0ac777efc7f0000e0ac777efc7f0000000000000000000000000000fc7f0000ffffff7ffd4c000000000000000000000000000000000000d8ce6b7efc7f00002a0000000000000069c3247efc7f0000310000000000000088010000000000008c01000000000000110001100000000050f0a76f6800000003a3b97ffc7f000050f0a76f6800000000000000000000002b00000000000000000000000000000020b02a7efc7f0000b43f297efc7f0000e0ce6b7e (UID: 00000000-00007072)33:T13ea,Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "file") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "file") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "file") Found reference to API "197517,3972,110,,EnumWindows,user32.dll,"00:40:34.687",RX=0,PX=0" (Indicator: "EnumWindows"; Source: "00000000-00001304.00000000.155821.03690000.00000004.mdmp") Found reference to API "303353,3972,109,,GetWindowTextW,user32.dll,"00:40:36.390",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00001304.00000001.157743.03690000.00000004.mdmp, 00000000-00001304.00000002.159662.03690000.00000004.mdmp, 00000000-00001304.00000003.165085.03690000.00000004.mdmp") Found reference to API "0304667383,3972,109,,GetWindowTextW,user32.dll,"00:40:59.296",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00001304.00000001.157743.03690000.00000004.mdmp, 00000000-00001304.00000002.159662.03690000.00000004.mdmp, 00000000-00001304.00000003.165085.03690000.00000004.mdmp") Found reference to API "0302782525,3972,109,,GetWindowTextW,user32.dll,"00:40:59.296",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00001304.00000001.157743.03690000.00000004.mdmp, 00000000-00001304.00000002.159662.03690000.00000004.mdmp, 00000000-00001304.00000003.165085.03690000.00000004.mdmp") Found reference to API "0303199139,3972,109,,GetWindowTextW,user32.dll,"00:40:59.296",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00001304.00000001.157743.03690000.00000004.mdmp, 00000000-00001304.00000002.159662.03690000.00000004.mdmp, 00000000-00001304.00000003.165085.03690000.00000004.mdmp") Found reference to API "0302389757,3972,109,,GetWindowTextW,user32.dll,"00:40:59.296",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00001304.00000001.157743.03690000.00000004.mdmp, 00000000-00001304.00000002.159662.03690000.00000004.mdmp, 00000000-00001304.00000003.165085.03690000.00000004.mdmp") Found reference to API "0305325781,3972,110,,EnumWindows,user32.dll,"00:40:59.296",RX=0,PX=0" (Indicator: "EnumWindows"; Source: "00000000-00001304.00000001.157743.03690000.00000004.mdmp, 00000000-00001304.00000002.159662.03690000.00000004.mdmp, 00000000-00001304.00000003.165085.03690000.00000004.mdmp") Found reference to API "0304342817,3972,109,,GetWindowTextW,user32.dll,"00:40:59.296",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00001304.00000001.157743.03690000.00000004.mdmp, 00000000-00001304.00000002.159662.03690000.00000004.mdmp, 00000000-00001304.00000003.165085.03690000.00000004.mdmp") Found reference to API "0302587859,3972,109,,GetWindowTextW,user32.dll,"00:40:59.296",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00001304.00000001.157743.03690000.00000004.mdmp, 00000000-00001304.00000002.159662.03690000.00000004.mdmp, 00000000-00001304.00000003.165085.03690000.00000004.mdmp") Found reference to API "0305144845,3972,109,,GetWindowTextW,user32.dll,"00:40:59.296",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00001304.00000001.157743.03690000.00000004.mdmp, 00000000-00001304.00000002.159662.03690000.00000004.mdmp, 00000000-00001304.00000003.165085.03690000.00000004.mdmp") Found reference to API "0304958821,3972,109,,GetWindowTextW,user32.dll,"00:40:59.296",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00001304.00000001.157743.03690000.00000004.mdmp, 00000000-00001304.00000002.159662.03690000.00000004.mdmp, 00000000-00001304.00000003.165085.03690000.00000004.mdmp") Found reference to API "0302878827,3972,109,,GetWindowTextW,user32.dll,"00:40:59.296",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00001304.00000001.157743.03690000.00000004.mdmp, 00000000-00001304.00000002.159662.03690000.00000004.mdmp, 00000000-00001304.00000003.165085.03690000.00000004.mdmp") Found reference to API "0304863879,3972,109,,GetWindowTextW,user32.dll,"00:40:59.296",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00001304.00000001.157743.03690000.00000004.mdmp, 00000000-00001304.00000002.159662.03690000.00000004.mdmp, 00000000-00001304.00000003.165085.03690000.00000004.mdmp") Found reference to API "0302042367,3972,109,,GetWindowTextW,user32.dll,"00:40:59.296",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00001304.00000001.157743.03690000.00000004.mdmp, 00000000-00001304.00000002.159662.03690000.00000004.mdmp, 00000000-00001304.00000003.165085.03690000.00000004.mdmp") Found reference to API "0303937555,3972,109,,GetWindowTextW,user32.dll,"00:40:59.296",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00001304.00000001.157743.03690000.00000004.mdmp, 00000000-00001304.00000002.159662.03690000.00000004.mdmp, 00000000-00001304.00000003.165085.03690000.00000004.mdmp") Found reference to API "0305240741,3972,109,,GetWindowTextW,user32.dll,"00:40:59.296",RX=0,PX=0" (Indicator: "GetWindowText"; Source: "00000000-00001304.00000001.157743.03690000.00000004.mdmp, 00000000-00001304.00000002.159662.03690000.00000004.mdmp, 00000000-00001304.00000003.165085.03690000.00000004.mdmp")34:Tc1f,"imgcache.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "SEARCHLIST"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "PROFILENAMESERVER"; Value: "")35:T4f7,"imgcache.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "imgcache.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "imgcache.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "imgcache.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\043E4AD5D7CD1251BED7D5DEB038CDA7ED1481B7"; Key: "BLOB") "imgcache.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "imgcache.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "imgcache.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "imgcache.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "imgcache.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\4C27431717565A3A07F3E6D0032C4258949CF9EC"; Key: "BLOB") "imgcache.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\525C47FB3A5E0655FBD4BE963CA1E94D5FECB43D"; Key: "BLOB")36:T851,"wuu0nt.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001304) "wuu0nt.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001304) "wuu0nt.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00001304) "wuu0nt.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001304) "wuu0nt.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00001304) "wuu0nt.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001304) "wuu0nt.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00001304) "wuu0nt.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00001304) "wuu0nt.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00001304) "wuu0nt.exe" called "LoadLibrary" with a parameter MLANG.dll (UID: 00000000-00001304) "wuu0nt.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00001304) "wuu0nt.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00001304) "imgcache.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00007368) "imgcache.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00007368) "imgcache.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00007368) "imgcache.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00007368) "imgcache.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00007368) "imgcache.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00007368) "imgcache.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00007368) "imgcache.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00007368) "imgcache.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00007368) "imgcache.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00007368) "imgcache.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00007368)37:T61a0,"file.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006596) "file.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006596) "file.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006596) "file.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006596) "file.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006596) "file.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006596) "file.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006596) "file.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006596) "file.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006596) "file.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00006596) "file.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00006596) "file.exe" called "GetProcAddress" with a parameter QueryFullProcessImageNameW (UID: 00000000-00006596) "file.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00006596) "file.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00006596) "file.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00006596) "file.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00006596) "file.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00006596) "file.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00006596) "file.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00006596) "file.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00006596) "wuu0nt.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter NtQueryInformationProcess (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter QueryFullProcessImageNameW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter CreateWindowExW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter PeekMessageW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter GetCursorPos (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter GetLastInputInfo (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter FlushInstructionCache (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter NtAllocateVirtualMemory (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter NtProtectVirtualMemory (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter HeapAlloc (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter SetCurrentDirectoryW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter NtCreateFile (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter NtWriteFile (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter NtReadFile (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter NtClose (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter NtQueryInformationFile (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter CreateDirectoryW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter MoveFileExW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter FlushFileBuffers (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter SetFileTime (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter RemoveDirectoryW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter WTSGetActiveConsoleSessionId (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter WTSQueryUserToken (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter ImpersonateLoggedOnUser (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter RegOpenCurrentUser (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter GetProcessId (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter Thread32First (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter Thread32Next (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter OpenThread (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter CreateProcessInternalW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter WinExec (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter CopyFileW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter CopyFileA (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter CopyFileExW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter MoveFileW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter CreateMutexA (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter CreateMutexExW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter CreateProcessAsUserW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter CreateProcessWithTokenW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter CreateProcessWithLogonW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter ShellExecuteExW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter ShellExecuteW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter NtCreateUserProcess (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter NtUnmapViewOfSection (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter NtTerminateProcess (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter MulDiv (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter Process32First (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter Process32Next (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter PSCreateAdapterFromPropertyStore (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter PropVariantToBSTR (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter CoGetMalloc (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter GetUrlCacheEntryBinaryBlob (UID: 00000000-00001304) "wuu0nt.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00001304) "imgcache.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter WriteConsoleW (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter WerGetFlags (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter WaitForMultipleObjects (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter VirtualQuery (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter VirtualFree (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter SwitchToThread (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter SuspendThread (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter SetWaitableTimer (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter SetUnhandledExceptionFilter (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter SetProcessPriorityBoost (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter ResumeThread (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter RaiseFailFastException (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter PostQueuedCompletionStatus (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter SetThreadContext (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter GetThreadContext (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter GetSystemDirectoryA (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter GetQueuedCompletionStatusEx (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter GetProcessAffinityMask (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter GetErrorMode (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter GetEnvironmentStringsW (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter GetCurrentThreadId (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter FreeEnvironmentStringsW (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter CreateIoCompletionPort (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter CreateEventA (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter NtCreateWaitCompletionPacket (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter NtAssociateWaitCompletionPacket (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter NtCancelWaitCompletionPacket (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter timeBeginPeriod (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter timeEndPeriod (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter SetFileCompletionNotificationModes (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter WSAEnumProtocolsW (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter GetDesktopWindow (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter EnumDisplayMonitors (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter GetMonitorInfoW (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter GetCursorInfo (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter SetProcessDPIAware (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter GetComputerNameExW (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter CreateMutexW (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter closesocket (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter setsockopt (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter bind (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter getsockname (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter getsockopt (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter WSARecvFrom (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter WSASendTo (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter WSAGetOverlappedResult (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter FormatMessageW (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter CancelIoEx (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter socket (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter getpeername (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter Process32FirstW (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter Process32NextW (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter CertCreateCertificateContext (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter CertAddCertificateContextToStore (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter CertGetCertificateChain (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter CertVerifyCertificateChainPolicy (UID: 00000000-00007368) "imgcache.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00007368) "rundll32.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007072) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007072) "rundll32.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007072) "rundll32.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007072) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007072) "rundll32.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007072) "rundll32.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007072)38:T42e,Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; File: "file") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; File: "file") Found reference to API "CreateProcessWithTokenW" (Indicator: "CreateProcess"; File: "file") Found reference to API "CreateProcessInternalW" (Indicator: "CreateProcess"; File: "file") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API "CreateProcessInternalW" (Indicator: "CreateProcess"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API "CreateProcessAsUserW" (Indicator: "CreateProcess"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API "CreateProcessWithTokenW" (Indicator: "CreateProcess"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API "CreateProcessW" (Indicator: "CreateProcess"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp")39:Tf31e,Found reference to API (Indicator: "RegCloseKey"; File: "file") Found reference to API (Indicator: "RegQueryValueExW"; File: "file") Found reference to API (Indicator: "RegOpenKeyExW"; File: "file") Found reference to API (Indicator: "GetUserNameW"; File: "file") Found reference to API (Indicator: "GetStockObject"; File: "file") Found reference to API (Indicator: "SelectObject"; File: "file") Found reference to API (Indicator: "SetLastError"; File: "file") Found reference to API (Indicator: "EnterCriticalSection"; File: "file") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "file") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "file") Found reference to API (Indicator: "CreateEventW"; File: "file") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "file") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "file") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "file") Found reference to API (Indicator: "SetThreadPriority"; File: "file") Found reference to API (Indicator: "GetUserDefaultLangID"; File: "file") Found reference to API (Indicator: "OutputDebugStringA"; File: "file") Found reference to API (Indicator: "GetExitCodeProcess"; File: "file") Found reference to API (Indicator: "GetThreadPriority"; File: "file") Found reference to API (Indicator: "GetOEMCP"; File: "file") Found reference to API (Indicator: "GetVersionExW"; File: "file") Found reference to API (Indicator: "HeapReAlloc"; File: "file") Found reference to API (Indicator: "RaiseException"; File: "file") Found reference to API (Indicator: "SetProcessAffinityMask"; File: "file") Found reference to API (Indicator: "VirtualFree"; File: "file") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "file") Found reference to API (Indicator: "SetErrorMode"; File: "file") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "file") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "file") Found reference to API (Indicator: "CloseHandle"; File: "file") Found reference to API (Indicator: "GetSystemDefaultLCID"; File: "file") Found reference to API (Indicator: "GetStartupInfoA"; File: "file") Found reference to API (Indicator: "HeapFree"; File: "file") Found reference to API (Indicator: "WaitForSingleObject"; File: "file") Found reference to API (Indicator: "CompareStringW"; File: "file") Found reference to API (Indicator: "GetFileAttributesW"; File: "file") Found reference to API (Indicator: "LocalFree"; File: "file") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "file") Found reference to API (Indicator: "GetLocaleInfoW"; File: "file") Found reference to API (Indicator: "LCMapStringW"; File: "file") Found reference to API (Indicator: "GetPrivateProfileStringW"; File: "file") Found reference to API (Indicator: "DuplicateHandle"; File: "file") Found reference to API (Indicator: "SetEvent"; File: "file") Found reference to API (Indicator: "FindAtomA"; File: "file") Found reference to API (Indicator: "GetHandleInformation"; File: "file") Found reference to API (Indicator: "GetConsoleMode"; File: "file") Found reference to API (Indicator: "GetACP"; File: "file") Found reference to API (Indicator: "CreateEventA"; File: "file") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "file") Found reference to API (Indicator: "GetCurrentThreadId"; File: "file") Found reference to API (Indicator: "HeapAlloc"; File: "file") Found reference to API (Indicator: "GetCommandLineW"; File: "file") Found reference to API (Indicator: "GetProcessHeap"; File: "file") Found reference to API (Indicator: "LoadLibraryA"; File: "file") Found reference to API (Indicator: "SetEnvironmentVariableA"; File: "file") Found reference to API (Indicator: "Sleep"; File: "file") Found reference to API (Indicator: "SetStdHandle"; File: "file") Found reference to API (Indicator: "TlsGetValue"; File: "file") Found reference to API (Indicator: "GetCurrentProcessId"; File: "file") Found reference to API (Indicator: "GetTickCount"; File: "file") Found reference to API (Indicator: "GetModuleHandleW"; File: "file") Found reference to API (Indicator: "GetTimeFormatW"; File: "file") Found reference to API (Indicator: "VirtualAlloc"; File: "file") Found reference to API (Indicator: "MulDiv"; File: "file") Found reference to API (Indicator: "GetProcAddress"; File: "file") Found reference to API (Indicator: "VirtualQuery"; File: "file") Found reference to API (Indicator: "GetLastError"; File: "file") Found reference to API (Indicator: "FreeConsole"; File: "file") Found reference to API (Indicator: "VerLanguageNameW"; File: "file") Found reference to API (Indicator: "GetCPInfo"; File: "file") Found reference to API (Indicator: "DeleteCriticalSection"; File: "file") Found reference to API (Indicator: "GetAtomNameA"; File: "file") Found reference to API (Indicator: "InitializeCriticalSection"; File: "file") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "file") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "file") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "file") Found reference to API (Indicator: "TryEnterCriticalSection"; File: "file") Found reference to API (Indicator: "AddAtomA"; File: "file") Found reference to API (Indicator: "GetModuleHandleA"; File: "file") Found reference to API (Indicator: "GetStartupInfoW"; File: "file") Found reference to API (Indicator: "LoadLibraryW"; File: "file") Found reference to API (Indicator: "DeleteAtom"; File: "file") Found reference to API (Indicator: "GetConsoleWindow"; File: "file") Found reference to API (Indicator: "CreateSemaphoreA"; File: "file") Found reference to API (Indicator: "IsDBCSLeadByteEx"; File: "file") Found reference to API (Indicator: "ReleaseSemaphore"; File: "file") Found reference to API (Indicator: "GetCurrentProcess"; File: "file") Found reference to API (Indicator: "GetDateFormatW"; File: "file") Found reference to API (Indicator: "TerminateProcess"; File: "file") Found reference to API (Indicator: "GetCurrentThread"; File: "file") Found reference to API (Indicator: "ReleaseMutex"; File: "file") Found reference to API (Indicator: "GetModuleFileNameW"; File: "file") Found reference to API (Indicator: "CreateMutexA"; File: "file") Found reference to API (Indicator: "FormatMessageA"; File: "file") Found reference to API (Indicator: "WideCharToMultiByte"; File: "file") Found reference to API (Indicator: "GetNumberFormatW"; File: "file") Found reference to API (Indicator: "TlsSetValue"; File: "file") Found reference to API (Indicator: "ResetEvent"; File: "file") Found reference to API (Indicator: "MultiByteToWideChar"; File: "file") Found reference to API (Indicator: "LeaveCriticalSection"; File: "file") Found reference to API (Indicator: "GetPrivateProfileIntW"; File: "file") Found reference to API (Indicator: "EnumWindows"; File: "file") Found reference to API (Indicator: "ShowWindow"; File: "file") Found reference to API (Indicator: "UnregisterClassW"; File: "file") Found reference to API (Indicator: "BeginPaint"; File: "file") Found reference to API (Indicator: "PeekMessageW"; File: "file") Found reference to API (Indicator: "SetForegroundWindow"; File: "file") Found reference to API (Indicator: "GetForegroundWindow"; File: "file") Found reference to API (Indicator: "ReleaseDC"; File: "file") Found reference to API (Indicator: "LoadCursorW"; File: "file") Found reference to API (Indicator: "CreateWindowExW"; File: "file") Found reference to API (Indicator: "GetWindowTextW"; File: "file") Found reference to API (Indicator: "PostQuitMessage"; File: "file") Found reference to API (Indicator: "MessageBoxW"; File: "file") Found reference to API (Indicator: "GetShellWindow"; File: "file") Found reference to API (Indicator: "FillRect"; File: "file") Found reference to API (Indicator: "UpdateWindow"; File: "file") Found reference to API (Indicator: "DispatchMessageW"; File: "file") Found reference to API (Indicator: "GetDC"; File: "file") Found reference to API (Indicator: "SetWindowTextW"; File: "file") Found reference to API (Indicator: "IsWindow"; File: "file") Found reference to API (Indicator: "GetDesktopWindow"; File: "file") Found reference to API (Indicator: "DefWindowProcW"; File: "file") Found reference to API (Indicator: "TranslateMessage"; File: "file") Found reference to API (Indicator: "LoadIconW"; File: "file") Found reference to API (Indicator: "InvalidateRect"; File: "file") Found reference to API (Indicator: "DestroyWindow"; File: "file") Found reference to API (Indicator: "GetClientRect"; File: "file") Found reference to API (Indicator: "GetSystemMetrics"; File: "file") Found reference to API (Indicator: "OleUninitialize"; File: "file") Found reference to API (Indicator: "CoInitializeEx"; File: "file") Found reference to API (Indicator: "CoUninitialize"; File: "file") Found reference to API (Indicator: "OleInitialize"; File: "file") Found reference to API (Indicator: "CoInitializeSecurity"; File: "file") Found reference to API (Indicator: "GetComputerNameW"; File: "file") Found reference to API (Indicator: "GetComputerNameA"; File: "file") Found reference to API (Indicator: "GetComputerNameExW"; File: "file") Found reference to API (Indicator: "OpenProcessToken"; File: "file") Found reference to API (Indicator: "DuplicateTokenEx"; File: "file") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "file") Found reference to API (Indicator: "Process32First"; File: "file") Found reference to API (Indicator: "Process32Next"; File: "file") Found reference to API (Indicator: "ProcessIdToSessionId"; File: "file") Found reference to API (Indicator: "WTSGetActiveConsoleSessionId"; File: "file") Found reference to API (Indicator: "WTSQueryUserToken"; File: "file") Found reference to API (Indicator: "CreateFileW"; File: "file") Found reference to API (Indicator: "WriteFile"; File: "file") Found reference to API (Indicator: "CreateProcessW"; File: "file") Found reference to API (Indicator: "DeleteFileW"; File: "file") Found reference to API (Indicator: "RtlGetVersion"; File: "file") Found reference to API (Indicator: "CreateProcessAsUserW"; File: "file") Found reference to API (Indicator: "CreateProcessWithTokenW"; File: "file") Found reference to API (Indicator: "VirtualAllocEx"; File: "file") Found reference to API (Indicator: "WriteProcessMemory"; File: "file") Found reference to API (Indicator: "NtUnmapViewOfSection"; File: "file") Found reference to API (Indicator: "InitializeProcThreadAttributeList"; File: "file") Found reference to API (Indicator: "UpdateProcThreadAttribute"; File: "file") Found reference to API (Indicator: "DeleteProcThreadAttributeList"; File: "file") Found reference to API (Indicator: "CreateEnvironmentBlock"; File: "file") Found reference to API (Indicator: "DestroyEnvironmentBlock"; File: "file") Found reference to API (Indicator: "ReadProcessMemory"; File: "file") Found reference to API (Indicator: "NtWriteVirtualMemory"; File: "file") Found reference to API (Indicator: "NtGetContextThread"; File: "file") Found reference to API (Indicator: "NtSetContextThread"; File: "file") Found reference to API (Indicator: "VirtualQueryEx"; File: "file") Found reference to API (Indicator: "VirtualProtectEx"; File: "file") Found reference to API (Indicator: "NtProtectVirtualMemory"; File: "file") Found reference to API (Indicator: "NtReadVirtualMemory"; File: "file") Found reference to API (Indicator: "GetProcessWindowStation"; File: "file") Found reference to API (Indicator: "GetThreadDesktop"; File: "file") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "file") Found reference to API (Indicator: "NtQueryInformationProcess"; File: "file") Found reference to API (Indicator: "QueryFullProcessImageNameW"; File: "file") Found reference to API (Indicator: "GetTempPathW"; File: "file") Found reference to API (Indicator: "ExitProcess"; File: "file") Found reference to API (Indicator: "ConvertStringSidToSidW"; File: "file") Found reference to API (Indicator: "SetTokenInformation"; File: "file") Found reference to API (Indicator: "GetTokenInformation"; File: "file") Found reference to API (Indicator: "CreateDirectoryW"; File: "file") Found reference to API (Indicator: "ReadFile"; File: "file") Found reference to API (Indicator: "GetFileSize"; File: "file") Found reference to API (Indicator: "SetFilePointer"; File: "file") Found reference to API (Indicator: "GetFileSizeEx"; File: "file") Found reference to API (Indicator: "CreateProcessInternalW"; File: "file") Found reference to API (Indicator: "NtCreateSection"; File: "file") Found reference to API (Indicator: "NtMapViewOfSection"; File: "file") Found reference to API (Indicator: "SetEndOfFile"; File: "file") Found reference to API (Indicator: "Thread32First"; File: "file") Found reference to API (Indicator: "Thread32Next"; File: "file") Found reference to API (Indicator: "OpenThread"; File: "file") Found reference to API (Indicator: "VirtualProtect"; File: "file") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "AddAtomA"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "CreateSemaphoreA"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "DeleteAtom"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "FindAtomA"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetAtomNameA"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleWindow"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetHandleInformation"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetNumberFormatW"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntW"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetProcessAffinityMask"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetThreadPriority"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultLangID"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "IsDBCSLeadByteEx"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "SetProcessAffinityMask"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "SetThreadPriority"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "VerLanguageNameW"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameW"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameA"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "NtProtectVirtualMemory"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "NtReadVirtualMemory"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "NtCreateSection"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "NtMapViewOfSection"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "NtUnmapViewOfSection"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "Thread32First"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "Thread32Next"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "OpenThread"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "GetThreadDesktop"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "GetUserObjectInformationW"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "ProcessIdToSessionId"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "WTSGetActiveConsoleSessionId"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "WTSQueryUserToken"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "DuplicateTokenEx"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "ConvertStringSidToSidW"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "SetTokenInformation"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "Process32First"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "Process32Next"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "MulDiv"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "ReadProcessMemory"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtectEx"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessInternalW"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "QueryFullProcessImageNameW"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessAsUserW"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessWithTokenW"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "DeleteProcThreadAttributeList"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "CreateEnvironmentBlock"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "DestroyEnvironmentBlock"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "NtGetContextThread"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "NtSetContextThread"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "VirtualQueryEx"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API (Indicator: "GetUserNameW"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetStockObject"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "AddAtomA"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "CreateSemaphoreA"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "DeleteAtom"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "FindAtomA"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetAtomNameA"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleWindow"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetDateFormatW"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetHandleInformation"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetNumberFormatW"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetPrivateProfileIntW"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetPrivateProfileStringW"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetProcessAffinityMask"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDefaultLCID"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetThreadPriority"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultLCID"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetUserDefaultLangID"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "IsDBCSLeadByteEx"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableA"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "SetProcessAffinityMask"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "SetThreadPriority"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "VerLanguageNameW"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API (Indicator: "InitializeConditionVariable"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "SleepConditionVariableCS"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "WakeAllConditionVariable"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "RtlDllShutdownInProgress"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "MessageBoxW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "LoadIconW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "DispatchMessageW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "RegisterClassW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "DefWindowProcW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "LoadCursorW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "IsWow64Process2"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "CreateSemaphoreExW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "GetSystemWow64Directory2W"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "AttachConsole"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockExclusive"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "OpenSemaphoreW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "ReleaseSRWLockShared"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "FreeConsole"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexExW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "AcquireSRWLockShared"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "CLSIDFromString"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "DebugBreak"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "SearchPathW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "CharNextW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "Wow64EnableWow64FsRedirection"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "CreateActCtxW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "ActivateActCtx"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "DeactivateActCtx"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "ReleaseActCtx"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "QueryActCtxW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "PathIsRelativeW"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "RtlImageNtHeader"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "NtQueryInformationToken"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "NtOpenProcessToken"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "NtClose"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00007368.00000000.155968.03790000.00000004.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found reference to API (Indicator: "CancelIoEx"; Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found reference to API (Indicator: "getpeername"; Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found reference to API (Indicator: "WSASend"; Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found reference to API (Indicator: "GetCursorInfo"; Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found reference to API (Indicator: "AddDllDirectory"; Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found reference to API (Indicator: "WSAGetOverlappedResult"; Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp")3a:T404,Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "file") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "file") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp")3b:T680,":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001304.00000000.155821.03690000.00000004.mdmp 00000000-00001304.00000001.157743.03690000.00000004.mdmp 00000000-00001304.00000002.159662.03690000.00000004.mdmp 00000000-00001304.00000003.165085.03690000.00000004.mdmp "ng\Microsoft\Windows\Start Menu\Programs\Startup" (Indicator: "ng\microsoft\windows\start menu\programs\startup") in Source: 00000000-00001304.00000000.155821.03690000.00000004.mdmp 00000000-00001304.00000001.157743.03690000.00000004.mdmp 00000000-00001304.00000002.159662.03690000.00000004.mdmp 00000000-00001304.00000003.165085.03690000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wuu0nt.url" (Indicator: "??\c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\wuu0nt.url") in Source: 00000000-00001304.00000000.155821.03690000.00000004.mdmp 00000000-00001304.00000001.157743.03690000.00000004.mdmp 00000000-00001304.00000002.159662.03690000.00000004.mdmp 00000000-00001304.00000003.165085.03690000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\wuu0nt.lnk" (Indicator: "??\c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\wuu0nt.lnk") in Source: 00000000-00001304.00000000.155821.03690000.00000004.mdmp 00000000-00001304.00000001.157743.03690000.00000004.mdmp 00000000-00001304.00000002.159662.03690000.00000004.mdmp 00000000-00001304.00000003.165085.03690000.00000004.mdmp3c:T6c5,"\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00001304.00000000.155821.03690000.00000004.mdmp 00000000-00001304.00000001.157743.03690000.00000004.mdmp 00000000-00001304.00000002.159662.03690000.00000004.mdmp 00000000-00001304.00000003.165085.03690000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0823B6F8-F499-4D5E-B88" in Source: 00000000-00001304.00000000.155821.03690000.00000004.mdmp 00000000-00001304.00000001.157743.03690000.00000004.mdmp 00000000-00001304.00000002.159662.03690000.00000004.mdmp 00000000-00001304.00000003.165085.03690000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\Capabilities" in Source: 00000000-00001304.00000000.155821.03690000.00000004.mdmp 00000000-00001304.00000001.157743.03690000.00000004.mdmp 00000000-00001304.00000002.159662.03690000.00000004.mdmp 00000000-00001304.00000003.165085.03690000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00001304.00000000.155821.03690000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00006596.00000000.155766.03900000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006596.00000000.155766.03900000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.80.1!7" in Source: 00000000-00007368.00000001.157888.037C9000.00000004.mdmp3d:T8e4,Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6596:168:WilStaging_02" Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6596:168:WilStaging_02" Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\MeBjAaAa_pEVwfI1QNW3QvEPYlsZuZwvQ" Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\MeBjAaAa__eh_shmem3_gcc_tdm_" Process file.exe created mutex with name "MeBjAaAa__eh_shmem3_gcc_tdm_" Process file.exe created mutex with name "MeBjAaAa_pEVwfI1QNW3QvEPYlsZuZwvQ" Process file.exe created mutex with name "SM0:6596:168:WilStaging_02" Process file.exe created mutex with name "Local\SM0:6596:168:WilStaging_02" Process wuu0nt.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1304:168:WilStaging_02" Process wuu0nt.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1304:168:WilStaging_02" Process wuu0nt.exe created mutex with name "\Sessions\1\BaseNamedObjects\BiAfAaAa_pEVwfI1QNW3QvEPYlsZuZwvQ" Process wuu0nt.exe created mutex with name "\Sessions\1\BaseNamedObjects\BiAfAaAa__eh_shmem3_gcc_tdm_" Process wuu0nt.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1304:64:WilError_01" Process wuu0nt.exe created mutex with name "BiAfAaAa_pEVwfI1QNW3QvEPYlsZuZwvQ" Process wuu0nt.exe created mutex with name "SM0:1304:64:WilError_01" Process wuu0nt.exe created mutex with name "Local\SM0:1304:64:WilError_01" Process wuu0nt.exe created mutex with name "Local\SM0:1304:168:WilStaging_02" Process wuu0nt.exe created mutex with name "SM0:1304:168:WilStaging_02" Process wuu0nt.exe created mutex with name "BiAfAaAa__eh_shmem3_gcc_tdm_" Process wuu0nt.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1304:64:WilError_01" Process wuu0nt.exe created mutex with name "\BaseNamedObjects\SyncRootManager" Process imgcache.exe created mutex with name "\BaseNamedObjects\WEBR_QHGLAINUNW9A" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7072:304:WilStaging_02" Process rundll32.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7072:304:WilStaging_02" Process rundll32.exe created mutex with name "Local\SM0:7072:304:WilStaging_02"3e:Tb1e,"\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00001304.00000000.155821.03690000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0823B6F8-F499-4D5E-B88" in Source: 00000000-00001304.00000000.155821.03690000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\Capabilities" in Source: 00000000-00001304.00000000.155821.03690000.00000004.mdmp "stry\Machine\Software\Classes\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}" in Source: 00000000-00001304.00000000.155821.03690000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00001304.00000001.157743.03690000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0823B6F8-F499-4D5E-B88" in Source: 00000000-00001304.00000001.157743.03690000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\Capabilities" in Source: 00000000-00001304.00000001.157743.03690000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00001304.00000002.159662.03690000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0823B6F8-F499-4D5E-B88" in Source: 00000000-00001304.00000002.159662.03690000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\Capabilities" in Source: 00000000-00001304.00000002.159662.03690000.00000004.mdmp "\REGISTRY\MACHINE\Software\Microsoft\WindowsRuntime" in Source: 00000000-00001304.00000003.165085.03690000.00000004.mdmp ":\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\WindowsPowerShell\v1.0\\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0823B6F8-F499-4D5E-B88" in Source: 00000000-00001304.00000003.165085.03690000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Applets\Paint\Capabilities" in Source: 00000000-00001304.00000003.165085.03690000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers" in Source: 00000000-00006596.00000000.155766.03900000.00000004.mdmp "STRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006596.00000000.155766.03900000.00000004.mdmp "Software\Microsoft\Cryptography\OID\EncodingType 0\CryptDllFindOIDInfo\1.3.6.1.4.1.311.80.1!7" in Source: 00000000-00007368.00000001.157888.037C9000.00000004.mdmp3f:T15d0,"GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Date: Fri 16 Oct 2026 12:32:46 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a4b7168f3a0636e8-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B2277616C6C6574223A7B2261646472657373223A22303A33313339333632653331333933363265333233303338326533313338303030303030303030303030....... "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Date: Fri 16 Oct 2026 12:32:54 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a4b716c38b689456-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B2277616C6C6574223A7B2261646472657373223A22303A33313339333632653331333933363265333233303338326533313338303030303030303030303030....... "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Date: Fri 16 Oct 2026 12:33:24 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a4b7177bee9d3824-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B2277616C6C6574223A7B2261646472657373223A22303A33313339333632653331333933363265333233303338326533313338303030303030303030303030....... "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Date: Fri 16 Oct 2026 12:33:53 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a4b718329b87cf0e-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B2277616C6C6574223A7B2261646472657373223A22303A33313339333632653331333933363265333233303338326533313338303030303030303030303030....... "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Date: Fri 16 Oct 2026 12:34:22 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a4b718e96fc4eb36-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B2277616C6C6574223A7B2261646472657373223A22303A33313339333632653331333933363265333233303338326533313338303030303030303030303030....... "GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1 Host: tonapi.io User-Agent: Go-http-client/1.1 Content-Type: application/octet-stream Accept-Encoding: gzip" Response ==> HTTP/1.1 200 OK Date: Fri 16 Oct 2026 12:34:51 GMT Content-Type: application/json; charset=utf-8 Transfer-Encoding: chunked Connection: keep-alive Server: cloudflare access-control-allow-origin: * access-control-allow-credentials: true access-control-allow-methods: GET POST OPTIONS access-control-allow-headers: DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type Authorization X-Tonapi-Client X-Capability F Content-Encoding: gzip cf-cache-status: DYNAMIC vary: accept-encoding CF-RAY: a4b7199c2fa8cf26-SJC alt-svc: h3=":443"; ma=86400 with response body ==>7B2277616C6C6574223A7B2261646472657373223A22303A33313339333632653331333933363265333233303338326533313338303030303030303030303030.......40:Td5d,"file.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 743f0000 "file.exe" loaded module "NTDLL.DLL" at base 77da0000 "file.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74320000 "wuu0nt.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 743f0000 "wuu0nt.exe" loaded module "COMCTL32.DLL" at base 74590000 "wuu0nt.exe" loaded module "KERNEL32.DLL" at base 754a0000 "wuu0nt.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 742a0000 "wuu0nt.exe" loaded module "ADVAPI32.DLL" at base 77090000 "wuu0nt.exe" loaded module "RPCRT4.DLL" at base 778e0000 "wuu0nt.exe" loaded module "SSPICLI.DLL" at base 747c0000 "wuu0nt.exe" loaded module "NTDLL.DLL" at base 77da0000 "wuu0nt.exe" loaded module "SHELL32.DLL" at base 75570000 "wuu0nt.exe" loaded module "WTSAPI32.DLL" at base 74260000 "wuu0nt.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74320000 "wuu0nt.exe" loaded module "%WINDIR%\SYSWOW64\ONECOREUAPCOMMONPROXYSTUB.DLL" at base 73e00000 "wuu0nt.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 754a0000 "wuu0nt.exe" loaded module "USER32.DLL" at base 74830000 "wuu0nt.exe" loaded module "%WINDIR%\SYSWOW64\IEFRAME.DLL" at base 72ee0000 "wuu0nt.exe" loaded module "PROPSYS.DLL" at base 740e0000 "wuu0nt.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 740e0000 "wuu0nt.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 75100000 "wuu0nt.exe" loaded module "SECUR32.DLL" at base 72e00000 "wuu0nt.exe" loaded module "MLANG.DLL" at base 72dc0000 "wuu0nt.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 77b10000 "wuu0nt.exe" loaded module "WININET.DLL" at base 72af0000 "wuu0nt.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWS.STORAGE.DLL" at base 74ad0000 "wuu0nt.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 77410000 "wuu0nt.exe" loaded module "%WINDIR%\SYSWOW64\\WINDOWS.STATEREPOSITORYPS.DLL" at base 72a00000 "wuu0nt.exe" loaded module "%WINDIR%\SYSWOW64\SHELL32.DLL" at base 75570000 "imgcache.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 743f0000 "imgcache.exe" loaded module "KERNEL32.DLL" at base 754a0000 "imgcache.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 753e0000 "imgcache.exe" loaded module "NTDLL.DLL" at base 77da0000 "imgcache.exe" loaded module "WINMM.DLL" at base 72ac0000 "imgcache.exe" loaded module "POWRPROF.DLL" at base 747e0000 "imgcache.exe" loaded module "WS2_32.DLL" at base 77870000 "imgcache.exe" loaded module "USER32.DLL" at base 74830000 "imgcache.exe" loaded module "ADVAPI32.DLL" at base 77090000 "imgcache.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 739f0000 "imgcache.exe" loaded module "IPHLPAPI.DLL" at base 743c0000 "imgcache.exe" loaded module "RPCRT4.DLL" at base 778e0000 "imgcache.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 73900000 "imgcache.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 738b0000 "imgcache.exe" loaded module "CRYPT32.DLL" at base 76920000 "imgcache.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73880000 "imgcache.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 753e0000 "rundll32.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffc74c40000 "rundll32.exe" loaded module "SHELL32.DLL" at base 7ffc7e190000 "rundll32.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffc7ab0000041:T504,"wuu0nt.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "wuu0nt.exe" touched "Network" (Path: "HKCU\WOW6432NODE\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") "wuu0nt.exe" touched "Internet Shortcut" (Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{FBF23B40-E3F0-101B-8488-00AA003E56F8}") "wuu0nt.exe" touched "Property System Both Class Factory" (Path: "HKCU\WOW6432NODE\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}\TREATAS") "wuu0nt.exe" touched "Microsoft Url History Service" (Path: "HKCU\WOW6432NODE\CLSID\{3C374A40-BAE4-11CF-BF7D-00AA006946EE}\TREATAS") "wuu0nt.exe" touched "ShellItemArray Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{CDC82860-468D-4D4E-B7E7-C298FF23AB2C}\TREATAS") "wuu0nt.exe" touched "PSFactoryBuffer" (Path: "HKCU\WOW6432NODE\CLSID\{B196B286-BAB4-101A-B69C-00AA00341D07}\TREATAS") "wuu0nt.exe" touched "Sync root manager" (Path: "HKCU\WOW6432NODE\CLSID\{F324E4F9-8496-40B2-A1FF-9617C1C9AFFE}\TREATAS") "wuu0nt.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "wuu0nt.exe" touched "ShellItem Shell Namespace helper" (Path: "HKCU\WOW6432NODE\CLSID\{9AC9FBE1-E0A2-4AD6-B4EE-E212013EA917}\TREATAS")42:T5c2,"file" file has an entrypoint instructions - "mov dword ptr [0x7d9058], 1,jmp 0x401170,nop ,mov dword ptr [0x7d9058], 0,jmp 0x401170,nop ,sub esp, 0x1c,mov eax, dword ptr [esp + 0x20],mov dword ptr [esp], eax,call 0x41e7a8,test eax, eax,sete al,add esp, 0x1c,movzx eax, al,neg eax,ret ,nop ,nop ,nop ,push ebp,mov ebp, esp,sub esp, 0x18,mov dword ptr [esp], 0x401510,call 0x4014d0,leave ,ret ,lea esi, [esi],lea esi, [esi],nop ,ret ,nop ,nop ,nop ," "wuu0nt.exe" file has an entrypoint instructions - "mov dword ptr [0x7d9058], 1,jmp 0x401170,nop ,mov dword ptr [0x7d9058], 0,jmp 0x401170,nop ,sub esp, 0x1c,mov eax, dword ptr [esp + 0x20],mov dword ptr [esp], eax,call 0x41e7a8,test eax, eax,sete al,add esp, 0x1c,movzx eax, al,neg eax,ret ,nop ,nop ,nop ,push ebp,mov ebp, esp,sub esp, 0x18,mov dword ptr [esp], 0x401510,call 0x4014d0,leave ,ret ,lea esi, [esi],lea esi, [esi],nop ,ret ,nop ,nop ,nop ," "imgcache.exe" file has an entrypoint instructions - "pushal ,mov esi, 0xcb5015,lea edi, [esi - 0x8b4015],push edi,mov ebp, esp,lea ebx, [esp - 0x3e80],xor eax, eax,push eax,cmp esp, ebx,jne 0x1015f48,inc esi,inc esi,push ebx,push 0xc139c3,push edi,add ebx, 4,push ebx,push 0x360f15,push esi,add ebx, 4,push ebx,push eax,mov dword ptr [ebx], 0x20003,push ebp,push edi,mov edi, 0,push esi,push ebx,sub esp, 0x64,mov edx, dword ptr [esp + 0x78],mov dword ptr [esp + 0x5c], 0,lea eax, [edx + 4],mov dword ptr [esp + 0x60], eax,mov eax, 1,movzx ecx, byte ptr [edx + 2],"43:T40c,"file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "wuu0nt.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "wuu0nt.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "wuu0nt.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "wuu0nt.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SLANGUAGE") "wuu0nt.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "ICOUNTRY") "wuu0nt.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SCOUNTRY") "imgcache.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "imgcache.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "imgcache.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY") "rundll32.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "rundll32.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US")44:T614,The input sample is signed with a certificate issued by "CN=SSL.com SSL Intermediate CA ECC R2, O=SSL Corp, L=Houston, ST=Texas, C=US" (SHA1: F8:86:35:01:72:60:D4:0B:9E:B4:17:BE:E7:37:37:91:1B:63:0E:59; see report for more information) The input sample is signed with a certificate issued by "CN=SSL.com Root Certification Authority ECC, O=SSL Corporation, L=Houston, ST=Texas, C=US" (SHA1: 92:19:61:2E:90:1C:49:04:F9:83:5E:E8:C2:AD:D5:4F:F0:B7:97:FD; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Atlas R3 DV TLS CA 2026 Q2, O=GlobalSign nv-sa, C=BE" (SHA1: 43:73:33:AB:BC:05:B7:FC:F3:56:7F:D7:00:31:93:88:47:3D:DE:5B; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3" (SHA1: 37:08:77:93:79:80:7F:7C:FD:3C:9C:5E:62:83:55:15:F3:CC:62:0C; see report for more information) The input sample is signed with a certificate issued by "CN=WE1, O=Google Trust Services, C=US" (SHA1: DD:F1:7F:7F:7F:4B:23:84:79:68:8B:E8:E9:F2:1F:C1:30:9B:C3:37; see report for more information) The input sample is signed with a certificate issued by "CN=GTS Root R4, O=Google Trust Services LLC, C=US" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information) The input sample is signed with a certificate issued by "CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information)45:T400,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "file") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "file") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp")46:T581,"file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "")47:Tb12,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "FILE.EXE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "FILE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "")48:T410,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment by using API string Matched sigs: Able to identify sandbox environment running process Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Possibly tries to evade analysis by sleeping multiple times Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: The input sample contains the RDTSCP instruction Matched sigs: Contains ability to delay the execution of current thread49:T583,"file.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\SettingSync\wuu0nt.exe" "file.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\SettingSync\wuu0nt.exe:Zone.Identifier" "file.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\SettingSync\wuu0nt.exe" "file.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\SettingSync\wuu0nt.exe:Zone.Identifier" "wuu0nt.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu" "wuu0nt.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs" "wuu0nt.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup" "wuu0nt.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCache" "wuu0nt.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\INetCookies" "wuu0nt.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "wuu0nt.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu" "wuu0nt.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs" "wuu0nt.exe" touched file "%APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup" "wuu0nt.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCache" "wuu0nt.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\INetCookies" "wuu0nt.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History"4a:T811,"file.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "file.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "file.exe" trying to access non-existent file "C:\FLTLIB.DLL" "file.exe" trying to access non-existent file "C:\MSVCP140.DLL" "file.exe" trying to access non-existent file "C:\MSVCP140.dll" "file.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "file.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "file.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\SettingSync\WUU0NT.EXE" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\SettingSync\wuu0nt.exe" "wuu0nt.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "wuu0nt.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "wuu0nt.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\SettingSync\FLTLIB.DLL" "wuu0nt.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\SettingSync\MSVCP140.DLL" "wuu0nt.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\SettingSync\MSVCP140.dll" "wuu0nt.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\SettingSync\VCRUNTIME140.DLL" "wuu0nt.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\SettingSync\VCRUNTIME140.dll" "wuu0nt.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\SettingSync\CRYPTSP.DLL" "wuu0nt.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\SettingSync\WINNLSRES.DLL" "wuu0nt.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\SettingSync\winnlsres.dll" "wuu0nt.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL"4b:T541,"file.exe" trying to access non-existent file "C:\FILE.EXE.LOCAL" "file.exe" trying to access non-existent file "C:\file.exe.Local\" "wuu0nt.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\SettingSync\WUU0NT.EXE.LOCAL" "wuu0nt.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\SettingSync\wuu0nt.exe.Local\" "wuu0nt.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\wuu0nt.exe:ZONE.IDENTIFIER" "wuu0nt.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\SettingSync\wuu0nt.exe:ZONE.IDENTIFIER" "wuu0nt.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WUU0NT.LNK" "wuu0nt.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\WUU0NT.URL" "wuu0nt.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\cversions_v2\imgcache.exe:ZONE.IDENTIFIER" "imgcache.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}" "imgcache.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}" "imgcache.exe" trying to access non-existent file "\Device\RasAcd"4c:T413,Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00007368-00000C2C-861487925") Found reference to API "WSARecvFrom" (Indicator: "WSARecv"; Source: "00000000-00007368-00000C2C-862799762") Found reference to API "WSASendTo" (Indicator: "WSASend"; Source: "00000000-00007368-00000C2C-862826324") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00007368-00000C2C-863084750") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00007368-00000C2C-863085038") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found reference to API "WSASendTo" (Indicator: "WSASend"; Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp")4d:T202f,Heuristic match: "6n.sk" Heuristic match: "4nr.sg" Heuristic match: "/:.jp" Heuristic match: "tonapi.io" Pattern match: "remoteadministratortool.ton/resolve" Pattern match: "https://gcc.gnu.org/bugs/" Pattern match: "http://schemas.microsoft.com/smi/2005/windowssettings" Heuristic match: "cloudflare-dns.com" Heuristic match: "sa1atik.cn" Heuristic match: "s;.vbe;.js;.jse;.ws" Heuristic match: "pt@.pt" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Heuristic match: "system.activityhistory.id" Heuristic match: "system.identityprovider.name" Heuristic match: "system.sam.name" Heuristic match: "system.structuredquery.virtual.cc" Heuristic match: "system.structuredquery.virtual.to" Heuristic match: "system.structuredquery.is" Heuristic match: "system.protocol.name" Heuristic match: "system.appusermodel.id" Heuristic match: "system.structuredquerytype.implicit.is" Heuristic match: "loudflare-dns.com" Heuristic match: "-dns.com" Pattern match: "http://www.w3.org/2001/xmlschema-instance" Pattern match: "https://sa1atik.cn/sa1at/" Heuristic match: "dns.google.com" Pattern match: "https://1.1.1.1/dns-query?name=dns.google" Pattern match: "https://dns.google/resolve?name=1.1.1.1" Pattern match: "https://1.1.1.1/dns-query?name=1.1.1.1" Pattern match: "https://1.1.1.1/dns-query?name=google.com" Pattern match: "https://dns.google/resolve?name=dns.google" Pattern match: "https://dns.google/resolve?name=google.com" Pattern match: "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crltls" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist" Pattern match: "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl" Pattern match: "http://crl.comodoca.com/aaacertificateservices.crl" Pattern match: "http://crl.usertrust.com/utn-userfirst-object.crl" Pattern match: "www.camerfirma.com/address" Heuristic match: "secom trust.net" Heuristic match: "entrust.net" Pattern match: "www.digicert.com" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "www.digicert.com1" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "www.entrust.net/legal-terms" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "www.xrampsecurity.com1$0" Pattern match: "http://crl.xrampsecurity.com/xgca.crl0" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%20ev%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist0f" Pattern match: "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" Pattern match: "directory.d-trust.net/cn=d-trust%20root%20class%203%20ca%202%202009,o=d-trust%20gmbh,c=de?certificaterevocationlist0c" Pattern match: "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0" Heuristic match: "*.cloudflare-dns.com" Pattern match: "crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0" Pattern match: "http://crl.securetrust.com/stca.crl" Pattern match: "www.entrust.net/cps" Pattern match: "http://crl.xrampsecurity.com/xgca.crl" Pattern match: "http://www.usertrust.com1" Pattern match: "https://cloudflare-dns.com/dns-query?name=dns.google&type=a" Pattern match: "www.xrampsecurity.com" Pattern match: "http://www.usertrust.comutn-userfirst-object" Pattern match: "http://www.chambersign.org10" Heuristic match: "putin@kremlin.ru" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://policy.camerfirma.com0" Pattern match: "www.digicert.com1!0" Heuristic match: "m .ph" Pattern match: "0www.entrust.net/cps" Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com1+0" Pattern match: "http://www.quovadisglobal.com/cps0" Heuristic match: "lookup sa1atik.cn" Pattern match: "https://dns.google/resolve?name=dns.google&type=a" Pattern match: "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl" Heuristic match: "*.dns.google.com" Pattern match: "c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crl0" Heuristic match: "global.fastly.net" Heuristic match: "j.sni.global.fastly.net" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "https://www.alphassl.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "http://ocsp.thawte.com0" Pattern match: "https://www.thawte.com/cps07" Pattern match: "http://crl.thawte.com/thawtepca-g3.crl0" Pattern match: "www.digicert.com1/0-" Pattern match: "http://ocsp.digicert.com0k" Pattern match: "http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Heuristic match: "ntrust.net" Heuristic match: ".sni.global.fastly.net" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^" Pattern match: "www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0" Heuristic match: "u.com" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "www.microsoft.com/pkiops/docs/repository.htm" Pattern match: "http://cert.startcom.org/sfsca-crl.crl0+" Pattern match: "http://crl.startcom.org/sfsca-crl.crl0" Pattern match: "http://cert.startcom.org/policy.pdf05" Pattern match: "http://cert.startcom.org/intermediate.pdf0" Pattern match: "http://cert.startcom.org/policy.pdf0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "http://repository.swisssign.com/0" Heuristic match: "rt.com" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "crl.microsoft.com/pki/crl/products/mic*" Pattern match: "www.insidersurveys.windows.com06" Pattern match: "www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl" Pattern match: "crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0" Pattern match: "www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://microsoft.com0"4e:T303b,Found URL "https://gcc.gnu.org/bugs/):" - Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00007368.00000000.155968.03790000.00000004.mdmp") Found URL "https://sa1atik.cn/sa1at/" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=dns.googler" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "https://dns.google/resolve?name=1.1.1.1https://1.1.1.1/dns-query?name=1.1.1.1pxwz" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=google.comcommonprogramfiles=c:\program" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "https://dns.google/resolve?name=dns.googlei<66666666666666666666666666666666666666666666d*p" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "https://dns.google/resolve?name=dns.google&type=ahttps://dns.google/resolve?name=google.com:j+7ht7hcomputername=desktop-fvvf82agodebug=netdns=windowshomepath=\users\hapubwsnumber_of_processors=8processor_architecture=x86processor_architew6432=amd64processor_revision=4f00programdata=c:\programdatapublic=c:\users\publicsystemroot=c:\windowsuserdomain=desktop-fvvf82auserprofile=c:\users\hapubwsczoycw?" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "http://c.pki.goog/mitmproxy-236356893075616227624110519622398477259530153583.crltls:" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crlu/" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl(c)" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "http://crl.usertrust.com/utn-userfirst-object.crl(c)" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0&" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crl0addtrust" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_ev_2009.crl0" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "http://www.d-trust.net/crl/d-trust_root_class_3_ca_2_2009.crl0okk,%$rdtpm" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl0um2wy\0+=u?e%l/$kk" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crlstarfield" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "http://crl.xrampsecurity.com/xgca.crld-trust" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectsalt" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-objectgeotrust" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "https://cloudflare-dns.com/dns-query?name=dns.google&type=atls13" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectthe" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "http://www.usertrust.comutn-userfirst-objectaffirmtrust" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "http://www.chambersign.org1" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "http://policy.camerfirma.com0+,t" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "http://policy.camerfirma.com0i$y'o)yrez3__68vr1[g-hlp]iskc" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "http://www.quovadisglobal.com/cps0g0e1quovadis" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=dns.googlehttps://dns.google/resolve?name=google.comi<66666666666666666666666666666666666666666666d*p" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "https://1.1.1.1/dns-query?name=google.comhttps://cloudflare-dns.com/dns-query?name=dns.google&type=ahttps://dns.google/resolve?name=dns.google&type=acloudflare-dns.comdagmtdns.googlezhttps://1.1.1.1/dns-query?name=google.com" - Source: "00000000-00007368.00000000.155968.05C00000.00000004.mdmp") Found URL "http://crls.ssl.com/mitmproxy-236356893075616227624110519622398477259530153583.crl\thmnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007368.00000001.157888.037C9000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.2.840.10045.3.1.4@eckp1.2.156.11235.1.1.2.1ecdp1.2.156.11235.1.1.2.1@eckp1.2.840.10045.3.1.1ecdp1.2.840.10045.3.1.1@eckp1.2.840.10045.3.1.7ecdp1.2.840.10045.3.1.2ecdp1.2.840.10045.3.1.6ecdp1.2.840.10045.3.1.6@eckp1.2.840.10045.3.1.1ecdp1.2.840.10045.3.1.1ecdp1.2.840.10045.3.1.7ecdp1.2.840.10045.3.1.3ecdp1.2.840.10045.3.1.1@eckp1.2.840.10045.3.1.5@eckp1.2.840.10045.3.1.4ecdp1.2.840.10045.3.1.3@eckp1.2.840.10045.3.1.5ecdp1.2.840.10045.3.1.7@eckp1.2.840.10045.3.1.7ecdp1.2.840.10045.3.1.7@eckp1.2.840.10045.3.1.2@eckp" - Source: "00000000-00007368.00000001.157888.037C9000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mic*t_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00007368.00000001.157888.037C9000.00000004.mdmp") Found URL "http://www.microsoft.com0washington1redmond1microsoft" - Source: "00000000-00007368.00000001.157888.037C9000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.132.0.35ecdp" - Source: "00000000-00007368.00000001.157888.037C9000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crlhhttp://crl.microsoft.com/pki/crl/products/miccertrulispca_2009-04-02.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccertrulispca_2009-04-02.crt0+" - Source: "00000000-00007368.00000001.157888.037C9000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0!:ctxcg" - Source: "00000000-00007368.00000001.157888.037C9000.00000004.mdmp") Found URL "http://microsoft.com0k" - Source: "00000000-00007368.00000001.157888.037C9000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0t<" - Source: "00000000-00007368.00000001.157888.037C9000.00000004.mdmp") Found URL "http://microsoft.com0" - Source: "00000000-00007368.00000001.157888.037C9000.00000004.mdmp")4f:T8b1,Found string "+ncalrpc:[OLE9CCDFDA0105EDFC7C05F8B84F10D]" (Indicator: "ncalrpc"; Source: "00000000-00001304.00000000.155821.03690000.00000004.mdmp, 00000000-00001304.00000001.157743.03690000.00000004.mdmp, 00000000-00001304.00000002.159662.03690000.00000004.mdmp, 00000000-00001304.00000003.165085.03690000.00000004.mdmp") Found string "B+ncalrpc:[OLE9CCDFDA0105EDFC7C05F8B84F10D]" (Indicator: "ncalrpc"; Source: "00000000-00001304.00000000.155821.03690000.00000004.mdmp, 00000000-00001304.00000001.157743.03690000.00000004.mdmp, 00000000-00001304.00000002.159662.03690000.00000004.mdmp, 00000000-00001304.00000003.165085.03690000.00000004.mdmp") Found string "+ncalrpc:[OLE4F27CF9BB1F5F049EC1694D9B912]" (Indicator: "ncalrpc"; Source: "00000000-00001304.00000000.155821.03690000.00000004.mdmp, 00000000-00001304.00000001.157743.03690000.00000004.mdmp, 00000000-00001304.00000002.159662.03690000.00000004.mdmp, 00000000-00001304.00000003.165085.03690000.00000004.mdmp") Found string "+ncalrpc:[OLE5E4A3458DE809193B818A675C070]" (Indicator: "ncalrpc"; Source: "00000000-00001304.00000000.155821.03690000.00000004.mdmp, 00000000-00001304.00000001.157743.03690000.00000004.mdmp, 00000000-00001304.00000002.159662.03690000.00000004.mdmp, 00000000-00001304.00000003.165085.03690000.00000004.mdmp") Found string "F+ncalrpc:[OLE4F27CF9BB1F5F049EC1694D9B912]" (Indicator: "ncalrpc"; Source: "00000000-00001304.00000000.155821.03690000.00000004.mdmp, 00000000-00001304.00000001.157743.03690000.00000004.mdmp, 00000000-00001304.00000002.159662.03690000.00000004.mdmp, 00000000-00001304.00000003.165085.03690000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00001304.00000000.155821.03690000.00000004.mdmp, 00000000-00001304.00000001.157743.03690000.00000004.mdmp, 00000000-00001304.00000002.159662.03690000.00000004.mdmp, 00000000-00001304.00000003.165085.03690000.00000004.mdmp") Found string "-+ncalrpc:[OLE5E4A3458DE809193B818A675C070]" (Indicator: "ncalrpc"; Source: "00000000-00001304.00000001.157743.03690000.00000004.mdmp, 00000000-00001304.00000002.159662.03690000.00000004.mdmp, 00000000-00001304.00000003.165085.03690000.00000004.mdmp")50:T98f,Found reference to API "GetDC" (Indicator: "GetDC"; File: "file") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "file") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007368.00000000.155968.03790000.00000004.mdmp, 00000000-00007368.00000001.157888.03790000.00000004.mdmp, 00000000-00007368.00000002.159810.03790000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007368.00000000.155968.03790000.00000004.mdmp, 00000000-00007368.00000001.157888.03790000.00000004.mdmp, 00000000-00007368.00000002.159810.03790000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007368.00000000.155968.03790000.00000004.mdmp, 00000000-00007368.00000001.157888.03790000.00000004.mdmp, 00000000-00007368.00000002.159810.03790000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007368.00000000.155968.03790000.00000004.mdmp, 00000000-00007368.00000001.157888.03790000.00000004.mdmp, 00000000-00007368.00000002.159810.03790000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007368.00000000.155968.03790000.00000004.mdmp, 00000000-00007368.00000001.157888.03790000.00000004.mdmp, 00000000-00007368.00000002.159810.03790000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007368.00000000.155968.03790000.00000004.mdmp, 00000000-00007368.00000001.157888.03790000.00000004.mdmp, 00000000-00007368.00000002.159810.03790000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007368.00000000.155968.03790000.00000004.mdmp, 00000000-00007368.00000001.157888.03790000.00000004.mdmp, 00000000-00007368.00000002.159810.03790000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007368.00000000.155968.03790000.00000004.mdmp, 00000000-00007368.00000001.157888.03790000.00000004.mdmp, 00000000-00007368.00000002.159810.03790000.00000004.mdmp")51:T790,Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "file") Found reference to API "WTSQueryUserToken" (Indicator: "WTSQueryUserToken"; File: "file") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; File: "file") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; File: "file") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; File: "file") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "file") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API "GetProcessWindowStation" (Indicator: "GetProcessWindowStation"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API "GetUserObjectInformationW" (Indicator: "GetUserObjectInformation"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API "WTSQueryUserToken" (Indicator: "WTSQueryUserToken"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "NtQueryInformationProcess"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API "NtQueryInformationToken" (Indicator: "NtQueryInformationToken"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp")52:T618,Found string "ystem.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00001304.00000000.155821.07570000.00000002.mdmp") Found string "ystem.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00001304.00000000.155821.07570000.00000002.mdmp") Found string "ystem.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00001304.00000000.155821.07570000.00000002.mdmp") Found string "ystem.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00001304.00000000.155821.07570000.00000002.mdmp") Found string "System.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00001304.00000001.157743.075C0000.00000002.mdmp") Found string "System.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00001304.00000001.157743.075C0000.00000002.mdmp") Found string "System.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00001304.00000001.157743.075C0000.00000002.mdmp") Found string "System.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00001304.00000001.157743.075C0000.00000002.mdmp") Found string "ECDSA" (Indicator: "ecdsa"; Source: "00000000-00007368.00000001.157888.03790000.00000004.mdmp, 00000000-00007368.00000001.157888.037C9000.00000004.mdmp, 00000000-00007368.00000002.159810.03790000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00007368.00000001.157888.03790000.00000004.mdmp, 00000000-00007368.00000002.159810.03790000.00000004.mdmp")53:Tc56,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "file") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "file") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "file") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "file") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "file") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "file") Found reference to API "Process32First" (Indicator: "Process32First"; File: "file") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "file") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; File: "file") Found reference to API "Thread32First" (Indicator: "Thread32First"; File: "file") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; File: "file") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API "Thread32First" (Indicator: "Thread32First"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API "Thread32Next" (Indicator: "Thread32Next"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp")54:T404,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "file") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "file") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp")55:T6e6,Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "file") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "file") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "file") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "file") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "file") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00001304.00000000.155821.007D9000.00000004.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00006596.00000000.155766.007D9000.00000004.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp")56:T482,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001304.00000000.155821.03690000.00000004.mdmp, 00000000-00001304.00000001.157743.03690000.00000004.mdmp, 00000000-00001304.00000002.159662.03690000.00000004.mdmp, 00000000-00001304.00000003.165085.03690000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006596.00000000.155766.03900000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00006596.00000000.155766.03900000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\rundll32.exe" (Indicator: "\Device\"; Source: "00000000-00007072.00000000.156068.DD6C0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007072.00000000.156068.DD6C0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007368.00000000.155968.03790000.00000004.mdmp, 00000000-00007368.00000001.157888.03790000.00000004.mdmp, 00000000-00007368.00000002.159810.03790000.00000004.mdmp")57:Tfdc,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SANDBOXFILTER"; Key: "SUPPORTEDFEATURES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WCIFS"; Key: "SUPPORTEDFEATURES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WOF"; Key: "SUPPORTEDFEATURES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FILEINFO"; Key: "SUPPORTEDFEATURES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\MICROSOFT\WINDOWS\SETTINGSYNC\WUU0NT.EXE"; Value: "") "wuu0nt.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\CVERSIONS_V2\IMGCACHE.EXE"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGLEVEL"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\CRYPT32"; Key: "DIAGMATCHANYMASK"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}"; Key: "SEARCHLIST"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D27478B9-2058-11E8-B41F-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPRACOEXISTENCEENABLED"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "SEARCHLIST"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTRATIONENABLED"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "REGISTERADAPTERNAME"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DOMAIN"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPDOMAIN"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPV6DOMAIN"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "NAMESERVER"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "PROFILENAMESERVER"; Value: "") "imgcache.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{D03DB0C1-2729-4674-A875-8625DD784300}"; Key: "DHCPNAMESERVER"; Value: "")58:T6d5,"wuu0nt.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN"; Key: "1"; Value: ""%LOCALAPPDATA%\wuu0nt.exe"") "wuu0nt.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER\RUN"; Key: "WUU0NT"; Value: ""%LOCALAPPDATA%\wuu0nt.exe"") "wuu0nt.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "wuu0nt.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT"; Key: "CACHEPREFIX"; Value: "000000") "wuu0nt.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES"; Key: "CACHEPREFIX"; Value: "Cookie:") "wuu0nt.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY"; Key: "CACHEPREFIX"; Value: "Visited:") "wuu0nt.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELL EXTENSIONS\CACHED"; Key: "{F2506CD7-82C2-43D9-A1D3-F85F5EFE7D09} {7F9185B0-CB92-43C5-80A9-92277A4F7B54} 0XFFFF"; Value: "0100000000000000B4B1C76A6A5DDD0100") "wuu0nt.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\SHELL\MUICACHE"; Key: "C:\WINDOWS\SYSTEM32\LAUNCHWINAPP.EXE.FRIENDLYAPPNAME"; Value: "Launch Windows App") "wuu0nt.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\SHELL\MUICACHE"; Key: "C:\WINDOWS\SYSTEM32\LAUNCHWINAPP.EXE.APPLICATIONCOMPANY"; Value: "Microsoft Corporation") "imgcache.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\2FD\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US")59:T107b,"imgcache.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "37ca560" "pszBlobType": "RSAPUBLICBLOB" "phKey": "78807a0398807e03" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "imgcache.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "37ca400" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b8817a035280fd35" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "imgcache.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "37ca400" "pszBlobType": "RSAPUBLICBLOB" "phKey": "d8827a03e281fd35" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "imgcache.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "37ca560" "pszBlobType": "RSAPUBLICBLOB" "phKey": "58817a0320897e03" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "imgcache.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "37ca400" "pszBlobType": "RSAPUBLICBLOB" "phKey": "78837a0382816e16" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "imgcache.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "37ca560" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b8837a0320897e03" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "imgcache.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "37ca400" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b8807a03828d8a15" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "imgcache.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "37ca560" "pszBlobType": "RSAPUBLICBLOB" "phKey": "78817a0320897e03" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "imgcache.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "37ca400" "pszBlobType": "RSAPUBLICBLOB" "phKey": "78827a03128d3d35" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "imgcache.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "37ca560" "pszBlobType": "RSAPUBLICBLOB" "phKey": "18807a0320897e03" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "imgcache.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "37ca400" "pszBlobType": "RSAPUBLICBLOB" "phKey": "78817a03828d8a15" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "imgcache.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "37ca560" "pszBlobType": "RSAPUBLICBLOB" "phKey": "f8837a0320897e03" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "imgcache.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "37ca400" "pszBlobType": "RSAPUBLICBLOB" "phKey": "f8837a032280fd35" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "imgcache.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "37ca560" "pszBlobType": "RSAPUBLICBLOB" "phKey": "78807a0320897e03" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "imgcache.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "37ca400" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b8827a03128d3d35" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "imgcache.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "37ca400" "pszBlobType": "RSAPUBLICBLOB" "phKey": "78807a032280fd35" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "imgcache.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "37ca400" "pszBlobType": "RSAPUBLICBLOB" "phKey": "18807a03828d8a15" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "imgcache.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "37ca560" "pszBlobType": "RSAPUBLICBLOB" "phKey": "b8807a0320897e03" "pbInput": "RSA1" "cbInput": "291" "dwFlags": "0"} "imgcache.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "37ca400" "pszBlobType": "RSAPUBLICBLOB" "phKey": "78807a03028a1b30" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "imgcache.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "37ca400" "pszBlobType": "RSAPUBLICBLOB" "phKey": "78817a03128d3d35" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "imgcache.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "37ca400" "pszBlobType": "RSAPUBLICBLOB" "phKey": "38807a03128d3d35" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"}5a:T5c54,"POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Fri 16 Oct 2026 12:32:55 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1792153975.092172 VS0 VE25 X-Served-By: cache-lax-kwhp1940097-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Fri 16 Oct 2026 12:32:56 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1792153976.275942 VS0 VE27 X-Served-By: cache-lax-kwhp1940020-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Fri 16 Oct 2026 12:32:57 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1792153977.467067 VS0 VE0 X-Served-By: cache-lax-kwhp1940145-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Fri 16 Oct 2026 12:32:59 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1792153980.644518 VS0 VE39 X-Served-By: cache-lax-kwhp1940104-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Fri 16 Oct 2026 12:33:00 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1792153981.851596 VS0 VE1 X-Served-By: cache-lax-kwhp1940037-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Fri 16 Oct 2026 12:33:02 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1792153982.001286 VS0 VE0 X-Served-By: cache-lax-kwhp1940037-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Fri 16 Oct 2026 12:33:04 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1792153985.663313 VS0 VE14 X-Served-By: cache-lax-kwhp1940046-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Fri 16 Oct 2026 12:33:05 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1792153986.839044 VS0 VE0 X-Served-By: cache-lax-kwhp1940045-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Fri 16 Oct 2026 12:33:07 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1792153987.999680 VS0 VE0 X-Served-By: cache-lax-kwhp1940112-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Fri 16 Oct 2026 12:33:24 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1792154005.528119 VS0 VE0 X-Served-By: cache-lax-kwhp1940055-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Fri 16 Oct 2026 12:33:25 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1792154006.685769 VS0 VE21 X-Served-By: cache-lax-kwhp1940071-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Fri 16 Oct 2026 12:33:26 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1792154007.854680 VS0 VE0 X-Served-By: cache-lax-kwhp1940039-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Fri 16 Oct 2026 12:33:29 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1792154009.021527 VS0 VE0 X-Served-By: cache-lax-kwhp1940081-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Fri 16 Oct 2026 12:33:30 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1792154010.205160 VS0 VE352 X-Served-By: cache-lax-kwhp1940115-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Fri 16 Oct 2026 12:33:31 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1792154012.666304 VS0 VE0 X-Served-By: cache-lax-kwhp1940091-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Fri 16 Oct 2026 12:33:33 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1792154014.831938 VS0 VE23 X-Served-By: cache-lax-kwhp1940123-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Fri 16 Oct 2026 12:33:35 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1792154015.039552 VS0 VE28 X-Served-By: cache-lax-kwhp1940135-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Fri 16 Oct 2026 12:33:36 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1792154016.186509 VS0 VE0 X-Served-By: cache-lax-kwhp1940046-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Fri 16 Oct 2026 12:33:53 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1792154033.392175 VS0 VE24 X-Served-By: cache-lax-kwhp1940093-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Fri 16 Oct 2026 12:33:54 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1792154035.588512 VS0 VE0 X-Served-By: cache-lax-kwhp1940081-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Fri 16 Oct 2026 12:33:55 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1792154036.772424 VS0 VE24 X-Served-By: cache-lax-kwhp1940092-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Fri 16 Oct 2026 12:33:57 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1792154038.932256 VS0 VE0 X-Served-By: cache-lax-kwhp1940027-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Fri 16 Oct 2026 12:33:59 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1792154039.110364 VS0 VE0 X-Served-By: cache-lax-kwhp1940105-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Fri 16 Oct 2026 12:34:00 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1792154040.282969 VS0 VE63 X-Served-By: cache-lax-kwhp1940038-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body "POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2 Host: ton.access.orbs.network User-Agent: Go-http-client/2.0 Content-Type: application/json Accept-Encoding: gzip" with payload::==> "{"address":"Ef_lZ1T4NCb2mwkme9h2rJfESCE0W34ma9lWp7-_uY3zXDvq","method":"dnsresolve","stack":[["tvm.Slice","te6cckEBAQEAEgAAIHRvbgB3ZWJyYXR4YXllMQDAQn8n"],["num","105311596331855300602201538317979276640056460191511695660591596829410056223515"]]}" HTTP/2 200 OK Content-Type: application/json Date: Fri 16 Oct 2026 12:34:02 GMT Access-Control-Allow-Origin: * Access-Control-Allow-Headers: X-API-key X-API-key X-Ton-Client-Version DNT X-CustomHeader Keep-Alive User-Agent X-Requested-With If-Modified-Since Cache-Control Content-Type X-Timer: S1792154043.504844 VS0 VE23 X-Served-By: cache-lax-kwhp1940082-LAX Retry-After: 0 X-Cache: HIT Accept-Ranges: bytes X-Cache-Hits: 0 Strict-Transport-Security: max-age=300 Via: 1.1 varnish with no response body1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792154213925,"unified_at":"2026-10-16T12:36:53.925Z","metadata":{"hashes":{"sha256":"ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","sha1":"5c9653c8915831ff1b4868e0dcbea0c0e431ad76","md5":"78b6e15065dba4e35b56b32ee15b932b","sha512":"a809cf10fc12bea87374fc5dcfcc4ace8d8e19c8c05ae0291750c6a6c40f3ce5667e3418509c1ca27314ac33978321cfea71ea1ba9637217e944af5e208c9dd9","ssdeep":"98304:JZt8q8z6L6IOJmGX8fnkJRKfe4frahk/JEZZdJffniGbJ4:Tt8qbzGmGXhKfFEk/JEfdpiKm","ssdeep_chunks":["98304:JZt8q8z","98304:Zt8q8z6","98304:t8q8z6L","98304:8q8z6L6","98304:q8z6L6I","98304:8z6L6IO","98304:z6L6IOJ","98304:6L6IOJm","98304:L6IOJmG","98304:6IOJmGX","98304:IOJmGX8","98304:OJmGX8f","98304:JmGX8fn","98304:mGX8fnk","98304:GX8fnkJ","98304:X8fnkJR","98304:8fnkJRK","98304:fnkJRKf","98304:nkJRKfe","98304:kJRKfe4","98304:JRKfe4f","98304:RKfe4fr","98304:Kfe4fra","98304:fe4frah","98304:e4frahk","98304:4frahk/","98304:frahk/J","98304:rahk/JE","98304:ahk/JEZ","98304:hk/JEZZ","98304:k/JEZZd","98304:/JEZZdJ","98304:JEZZdJf","98304:EZZdJff","98304:ZZdJffn","98304:ZdJffni","98304:dJffniG","98304:JffniGb","98304:ffniGbJ","98304:fniGbJ4","196608:JZt8q8z","196608:Zt8q8z6","196608:t8q8z6L","196608:8q8z6L6","196608:q8z6L6I","196608:8z6L6IO","196608:z6L6IOJ","196608:6L6IOJm","196608:L6IOJmG","196608:6IOJmGX","196608:IOJmGX8","196608:OJmGX8f","196608:JmGX8fn","196608:mGX8fnk","196608:GX8fnkJ","196608:X8fnkJR","196608:8fnkJRK","196608:fnkJRKf","196608:nkJRKfe","196608:kJRKfe4","196608:JRKfe4f","196608:RKfe4fr","196608:Kfe4fra","196608:fe4frah","196608:e4frahk","196608:4frahk/","196608:frahk/J","196608:rahk/JE","196608:ahk/JEZ","196608:hk/JEZZ","196608:k/JEZZd","196608:/JEZZdJ","196608:JEZZdJf","196608:EZZdJff","196608:ZZdJffn","196608:ZdJffni","196608:dJffniG","196608:JffniGb","196608:ffniGbJ","196608:fniGbJ4","98304:Tt8qbzG","98304:t8qbzGm","98304:8qbzGmG","98304:qbzGmGX","98304:bzGmGXh","98304:zGmGXhK","98304:GmGXhKf","98304:mGXhKfF","98304:GXhKfFE","98304:XhKfFEk","98304:hKfFEk/","98304:KfFEk/J","98304:fFEk/JE","98304:FEk/JEf","98304:Ek/JEfd","98304:k/JEfdp","98304:/JEfdpi","98304:JEfdpiK","98304:EfdpiKm"],"imphash":"1c71063094fd0a496838ee494281fbf7","pehash":"ab64b4cd1f28b702f75eab1d4b1e8623127a4566"},"file_info":{"file_name":"file.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":4048384,"entropy":8,"compile_timestamp":"2022-01-26T03:31:12","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792110333000,"last_seen":1792153929000,"last_multi_scan":1792153929000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":10,"import_count":0,"export_count":0,"embedded_file_count":4,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":288972,"raw_size":289280},{"name":".data","virtual_address":"0x48000","virtual_size":3549108,"raw_size":3549184},{"name":".rdata","virtual_address":"0x3ab000","virtual_size":185556,"raw_size":185856},{"name":".bss","virtual_address":"0x3d9000","virtual_size":3188},{"name":".idata","virtual_address":"0x3da000","virtual_size":6132,"raw_size":6144},{"name":".CRT","virtual_address":"0x3dc000","virtual_size":56,"raw_size":512},{"name":".tls","virtual_address":"0x3dd000","virtual_size":8,"raw_size":512},{"name":".rsrc","virtual_address":"0x3de000","virtual_size":4640,"raw_size":4640},{"name":".reloc","virtual_address":"0x3e0000","virtual_size":10256,"raw_size":10752},{"name":".00cfg","virtual_address":"0x3e3000","virtual_size":8638464}],"section_names":[".text",".data",".rdata",".bss",".idata",".CRT",".tls",".rsrc",".reloc",".00cfg"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["salatstealer","criminal","informationstealer","rat","windows-server-utility","suspicious"]},"stats":{"av":{"malicious_count":11,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":92},"sandbox_signatures":{"informative_count":201,"suspicious_count":16,"malicious_count":7,"total":224},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[PSW]/Win32.ReaderDB","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_100.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Mint.Zard.39","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Heur.Mint.Zard.39 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Agent_AGen.HOB trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Agent.NNO.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Mint.Zard.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to create new processes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled task-related activity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Observed Powershell command strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"},{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Persistence","technique":"Network Logon Script","attack_id":"T1037.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1037/003","identifiers":[{"type":"informative","value":"Able to establish enduring access through network startup procedures"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Reference explorer.exe process"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"informative","value":"Contains ability to unmap view of a section from a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Credential Access","technique":"Input Capture","attack_id":"T1056","attack_id_wiki":"https://attack.mitre.org/techniques/T1056","identifiers":[{"type":"informative","value":"Contains ability to register/read input devices (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Queries TCP/IP interface details"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Able to query system locale information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Tries to access LNK files (Windows shortcut)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Able to identify sandbox environment running process"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"The input sample contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Queries list of installed browsers"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops temp files"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"suspicious","value":"Sends UDP traffic"},{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"suspicious","value":"Calls an API typically used to import asymmetric cryptographic keys into a CSP"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Able to modify Windows Defender exclusions (Powershell command string)"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"},{"type":"informative","value":"Contains ability to modify Windows Defender preferences (Powershell command string)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"},{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"malicious","value":"Tries to hide tracks of having downloaded a file from the internet"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Contains CRYPTO related strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Stealth","technique":"Clear Persistence","attack_id":"T1070.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/009","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Stealth","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Stealth","technique":"Rundll32","attack_id":"T1218.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1218/011","identifiers":[{"type":"malicious","value":"Detected Rundll32 process execution"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Stealth","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Stealth","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify Windows Defender exclusions (Powershell command string)","description":"Found reference string \"Add-MpPreference -ExclusionPath $updpath\" (Indicator: \"add-mppreference\"; Source: \"00000000-00007368.00000000.155968.05C00000.00000004.mdmp\")\n Found reference string \"Add-MpPreference -ExclusionPath $ProgramFilesX86\" (Indicator: \"add-mppreference\"; Source: \"00000000-00007368.00000000.155968.05C00000.00000004.mdmp\")\n Found reference string \"Add-MpPreference -ExclusionPath $AppData\" (Indicator: \"add-mppreference\"; Source: \"00000000-00007368.00000000.155968.05C00000.00000004.mdmp\")\n Found reference string \"Add-MpPreference -ExclusionPath $LocalAppData\" (Indicator: \"add-mppreference\"; Source: \"00000000-00007368.00000000.155968.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-980","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"file\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"file\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"file\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")\n Found reference to API \"NtOpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007368.00000000.155968.03790000.00000004.mdmp, 00000000-00007368.00000001.157888.03790000.00000004.mdmp, 00000000-00007368.00000002.159810.03790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00007368.00000000.155968.05C00000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00007368.00000000.155968.05C00000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-\"; Source: \"00000000-00007368.00000000.155968.05C00000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\"; Source: \"00000000-00007368.00000000.155968.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"file\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00007368.00000001.157888.037C9000.00000004.mdmp, 00000000-00007368.00000002.159810.03790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"file.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"file.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"wuu0nt.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"wuu0nt.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"imgcache.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"rundll32.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2b","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00001992]\n Process \"WerFault.exe\" [UID: 00000000-00007936]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"file\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"file\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"file\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"file\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 45137-63-004014B0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero\n Raw size of \".00cfg\" is zero\n Raw size of \"UPX0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptEncrypt\" (Indicator: \"CryptEncrypt\"; Source: \"00000000-00007368.00000000.155968.03790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2c","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001304.00000000.155821.03690000.00000004.mdmp, 00000000-00001304.00000001.157743.03690000.00000004.mdmp, 00000000-00001304.00000002.159662.03690000.00000004.mdmp, 00000000-00001304.00000003.165085.03690000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00006596.00000000.155766.03900000.00000004.mdmp\")\n Found string \":\\WINDOWS\\System32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00007072.00000000.156068.DD6C0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00007368.00000000.155968.03790000.00000004.mdmp, 00000000-00007368.00000001.157888.03790000.00000004.mdmp, 00000000-00007368.00000002.159810.03790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00007368.00000001.157888.037C9000.00000004.mdmp, 00000000-00007368.00000002.159810.03790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2d","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.96857","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Contains CRYPTO related strings\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2e","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"GetUserNameW\" (Source: \"00000000-00001304.00000000.155821.007D9000.00000004.mdmp\")\n Found string \"ystem.Identity.QualifiedUserName\" (Source: \"00000000-00001304.00000000.155821.07570000.00000002.mdmp\")\n Found string \"ystem.Identity.UserName\" (Source: \"00000000-00001304.00000000.155821.07570000.00000002.mdmp\")\n Found string \"ystem.UserName\" (Source: \"00000000-00001304.00000000.155821.07570000.00000002.mdmp\")\n Found string \"System.Identity.UserName\" (Source: \"00000000-00001304.00000001.157743.075C0000.00000002.mdmp\")\n Found string \"System.Identity.QualifiedUserName\" (Source: \"00000000-00001304.00000001.157743.075C0000.00000002.mdmp\")\n Found string \"System.UserName\" (Source: \"00000000-00001304.00000001.157743.075C0000.00000002.mdmp\")\n Found string \"GetUserNameW\" (Source: \"00000000-00006596.00000000.155766.007D9000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"VGAuthService.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00007368.00000000.155968.05330000.00000004.mdmp\")\n Found string \"vmtoolsd.exe\" (Indicator: \"vmtoolsd.exe\"; Source: \"00000000-00007368.00000000.155968.05330000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"file\")\n Found string \"GetCursorPos\" (Indicator: \"GetCursorPos\"; Source: \"00000000-00001304-00000C2C-857935554\")\n Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00001304-00000C2C-857935748\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001304.00000000.155821.007D9000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007368.00000000.155968.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; File: \"file\")\n Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"file\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"file\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00001304.00000000.155821.007D9000.00000004.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00001304.00000000.155821.007D9000.00000004.mdmp\")\n Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00006596.00000000.155766.007D9000.00000004.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00006596.00000000.155766.007D9000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00007368-00000C2C-862424021\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; File: \"file\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00001304.00000000.155821.007D9000.00000004.mdmp\")\n Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00006596.00000000.155766.007D9000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"EnumWindows\" (Indicator: \"enumwindows\"; File: \"file\")\n Found reference to API \"PostMessageW\" (Indicator: \"postmessage\"; File: \"file\")\n Found reference to API \"197517,3972,110,,EnumWindows,user32.dll,\"00:40:34.687\",RX=0,PX=0\" (Indicator: \"enumwindows\"; Source: \"00000000-00001304.00000000.155821.03690000.00000004.mdmp\")\n Found reference to API \"0305325781,3972,110,,EnumWindows,user32.dll,\"00:40:59.296\",RX=0,PX=0\" (Indicator: \"enumwindows\"; Source: \"00000000-00001304.00000001.157743.03690000.00000004.mdmp, 00000000-00001304.00000002.159662.03690000.00000004.mdmp, 00000000-00001304.00000003.165085.03690000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007368.00000000.155968.03790000.00000004.mdmp, 00000000-00007368.00000001.157888.03790000.00000004.mdmp, 00000000-00007368.00000002.159810.03790000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"wuu0nt.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00001304)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"wuu0nt.exe\" called \"GetSystemMetrics\" with parameters (UID: 00000000-00001304)\n \"wuu0nt.exe\" called \"Process32FirstW\" with parameters (UID: 00000000-00001304)\n \"wuu0nt.exe\" called \"Process32NextW\" with parameters (UID: 00000000-00001304)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"file.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006596)\n \"wuu0nt.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00001304)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"wuu0nt.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001304)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"wuu0nt.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00001304)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"$31","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"file.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006596)\n \"wuu0nt.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001304)\n \"imgcache.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007368)\n \"rundll32.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007072)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$32","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"wuu0nt.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00001304)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process2\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 45137-1114-00410CA0\n GetSystemTimeAsFileTime@KERNEL32.dll at 45137-1119-00410BF0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.dll at 45137-1114-00410CA0\n GetSystemTimeAsFileTime@KERNEL32.dll at 45137-1119-00410BF0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"file.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"file.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"wuu0nt.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"wuu0nt.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"imgcache.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"rundll32.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"file\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00001304.00000000.155821.007D9000.00000004.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006596.00000000.155766.007D9000.00000004.mdmp\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"file\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00001304.00000000.155821.007D9000.00000004.mdmp\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00006596.00000000.155766.007D9000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; File: \"file\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; File: \"file\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; File: \"file\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00001304.00000000.155821.007D9000.00000004.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00001304.00000000.155821.007D9000.00000004.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersionExW\"; Source: \"00000000-00006596.00000000.155766.007D9000.00000004.mdmp\")\n Found reference to API \"GetVersionExW\" (Indicator: \"GetVersion\"; Source: \"00000000-00006596.00000000.155766.007D9000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"file\")\n Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"\"wuu0nt.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\\MICROSOFT EDGE\\CAPABILITIES\\URLASSOCIATIONS\"; Key: \"\"; Value: \"\")\n \"wuu0nt.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\\MICROSOFT EDGE\\CAPABILITIES\\URLASSOCIATIONS\"; Key: \"MS-AVAILABLENETWORKS\"; Value: \"\")\n \"wuu0nt.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\\GOOGLE CHROME\\CAPABILITIES\\URLASSOCIATIONS\"; Key: \"\"; Value: \"\")\n \"wuu0nt.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\\GOOGLE CHROME\\CAPABILITIES\\URLASSOCIATIONS\"; Key: \"MS-AVAILABLENETWORKS\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"file.exe\" queried token user identity (UID: 00000000-00006596)\n \"wuu0nt.exe\" queried token user identity (UID: 00000000-00001304)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"wuu0nt.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"imgcache.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"imgcache.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"imgcache.exe\" (Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO Observed Cloudflare DNS over HTTPS Domain (cloudflare-dns .com in TLS SNI)\" (SID: 2027695, Rev: 5, Severity: 3) categorized as \"Misc activity\"\n Detected alert \"ET INFO Observed TonAPI Domain in TLS SNI (tonapi .io)\" (SID: 2071845, Rev: 1, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Able to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read 32 bit PEB structure (dword ptr fs:[00000030h]) (Offset: 12782)","origin":"Binary File","mitre_attack_id":"T1027.007","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00001304-00000C2C-858152017\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00001304-00000C2C-859309196\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineW\" (Source: \"00000000-00001304.00000000.155821.007D9000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00007368.00000000.155968.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"file\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00001304.00000000.155821.007D9000.00000004.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006596.00000000.155766.007D9000.00000004.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$35","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"file.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"file.exe\" called \"CopyFileW\" to copy C:\\file.exe to new location %LOCALAPPDATA%\\Microsoft\\Windows\\SettingSync\\wuu0nt.exe (UID: 00000000-00006596)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"file.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft (UID: 00000000-00006596)\n \"file.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows (UID: 00000000-00006596)\n \"file.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\SettingSync (UID: 00000000-00006596)\n \"wuu0nt.exe\" called \"CreateDirectoryW\" with parameter %LOCALAPPDATA%\\cversions_v2 (UID: 00000000-00001304)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"file.exe\" called \"CreateProcessW\" with parameter \"\"%LOCALAPPDATA%\\Microsoft\\Windows\\SettingSync\\wuu0nt.exe\"\" - (UID: 00000000-00006596)\n \"wuu0nt.exe\" called \"CreateProcessW\" with parameter \"\"%LOCALAPPDATA%\\cversions_v2\\imgcache.exe\"\" - (UID: 00000000-00001304)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$36","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$37","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"tonapi.io\"\n \"ton.access.orbs.network\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"1.1.1.1:443\"\n \"104.16.248.249:443\"\n \"172.66.170.210:443\"\n \"196.196.208.18:443\"\n \"151.101.66.132:443\"\n \"151.101.130.132:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"file\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Contains ability to create new processes (API string)","description":"Found reference to API \"CreateProcessInternalW\" (Indicator: \"CreateProcessInternal\"; File: \"file\")\n Found reference to API \"CreateProcessInternalW\" (Indicator: \"CreateProcessInternal\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-425","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"file\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForSingleObject@KERNEL32.dll at 45137-1-00413F20\n WaitForSingleObject@KERNEL32.dll at 45137-1148-00416F6B\n WaitForSingleObject@KERNEL32.dll at 45137-24207-00417DAC\n Sleep@KERNEL32.dll at 45137-24230-0041645E\n WaitForSingleObject@KERNEL32.dll at 45137-24232-00416262\n WaitForSingleObject@KERNEL32.dll at 45137-24250-0040E61C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"file\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001304.00000000.155821.007D9000.00000004.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006596.00000000.155766.007D9000.00000004.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00007368.00000000.155968.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: file)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: wuu0nt.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: imgcache.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.dll at 45137-934-0042AF11\n LoadLibraryW@KERNEL32.dll at 45137-937-00429308\n LoadLibraryW@KERNEL32.dll at 45137-938-0042970C\n LoadLibraryW@KERNEL32.dll at 45137-939-004286CC\n LoadLibraryW@KERNEL32.dll at 45137-943-0042A198\n LoadLibraryA@KERNEL32.dll at 45137-1325-00434CD0\n LoadLibraryA@KERNEL32.dll at 45137-1326-00436160\n LoadLibraryA@KERNEL32.dll at 45137-1365-004399E1\n LoadLibraryA@KERNEL32.dll at 45137-1367-0043A0B1\n LoadLibraryA@KERNEL32.dll at 45137-1389-0043C041","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$39","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"yncShellExecute\" (Indicator: \"ShellExecute\"; Source: \"00000000-00001304.00000000.155821.03690000.00000004.mdmp, 00000000-00001304.00000001.157743.03690000.00000004.mdmp, 00000000-00001304.00000002.159662.03690000.00000004.mdmp, 00000000-00001304.00000003.165085.03690000.00000004.mdmp\")\n Found reference to API \"326335,3972,3191,,ShellExecuteW,Shell32.dll,\"00:40:34.437\",RX=0,PX=0\" (Indicator: \"ShellExecute\"; Source: \"00000000-00001304.00000000.155821.03690000.00000004.mdmp, 00000000-00001304.00000001.157743.03690000.00000004.mdmp, 00000000-00001304.00000002.159662.03690000.00000004.mdmp, 00000000-00001304.00000003.165085.03690000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"file\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00001304.00000000.155821.007D9000.00000004.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007368.00000000.155968.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; File: \"file\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")\n Found reference to API \"OpenThread\" (Indicator: \"OpenThread\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"file\")\n Found reference to API \"GetShellWindow\" (Indicator: \"GetShellWindow\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$3d","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"imgcache.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"putin@kremlin.ru\"\n Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$3e","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$3f","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$40","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 753E0000\n \"wuu0nt.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 753E0000\n \"wuu0nt.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72E70000\n \"imgcache.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 753E0000\n \"imgcache.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 72E70000\n \"rundll32.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 7C570000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 778E0000\n \"wuu0nt.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 778E0000\n \"imgcache.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 778E0000\n \"rundll32.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 7DDA0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"file\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"wuu0nt.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"imgcache.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"Found string \"if (Test-Path $ProgramFilesX86) {\" (Indicator: \"Test-Path\"; Source: \"00000000-00007368.00000000.155968.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$41","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"file\" has an executable section named \".text\"\n \"wuu0nt.exe\" has an executable section named \".text\"\n \"imgcache.exe\" has an executable section named \"UPX0\"\n \"imgcache.exe\" has an executable section named \"UPX1\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"file\" has an writable section named \".data\"\n \"file\" has an writable section named \".bss\"\n \"file\" has an writable section named \".idata\"\n \"file\" has an writable section named \".CRT\"\n \"file\" has an writable section named \".tls\"\n \"file\" has an writable section named \".rsrc\"\n \"file\" has an writable section named \".00cfg\"\n \"wuu0nt.exe\" has an writable section named \".data\"\n \"wuu0nt.exe\" has an writable section named \".bss\"\n \"wuu0nt.exe\" has an writable section named \".idata\"\n \"wuu0nt.exe\" has an writable section named \".CRT\"\n \"wuu0nt.exe\" has an writable section named \".tls\"\n \"wuu0nt.exe\" has an writable section named \".rsrc\"\n \"wuu0nt.exe\" has an writable section named \".00cfg\"\n \"imgcache.exe\" has an writable section named \"UPX0\"\n \"imgcache.exe\" has an writable section named \"UPX1\"\n \"imgcache.exe\" has an writable section named \"UPX2\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$42","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".data\" is \"0x362800\" greater than 0x100000\n Raw size of \"UPX1\" is \"0x361c00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".data\" is \"0x3627b4\" greater than 0x100000\n Virtual size of \".00cfg\" is \"0x83d000\" greater than 0x100000\n Virtual size of \"UPX0\" is \"0x8b4000\" greater than 0x100000\n Virtual size of \"UPX1\" is \"0x362000\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\system32\\LaunchWinApp.exe.FriendlyAppName\" [Source: 00000000-00001304-00000BC0-861794113]\n Observed system executable string:\"%WINDIR%\\system32\\LaunchWinApp.exe.ApplicationCompany\" [Source: 00000000-00001304-00000BC0-861794327]\n Observed system executable string:\"%WINDIR%\\system32\\cmd.exe\" [Source: 00000000-00001304-00000455-4085424945]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"wuu0nt.exe\" (UID: 00000000-00001304) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\", PROCESSOR_ARCHITEW6432=\"AMD64\"\"\n Process \"wuu0nt.exe\" (UID: 00000000-00001304) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"rundll32.exe\" (UID: 00000000-00007072) was launched with modified environment variables: \"PROCESSOR_ARCHITECTURE, CommonProgramFiles, ProgramFiles, NUMBER_OF_PROCESSORS\"\n Process \"rundll32.exe\" (UID: 00000000-00007072) was launched with missing environment variables: \"GODEBUG, USERDNSDOMAIN, PROCESSOR_ARCHITEW6432\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"cloudflare-dns.com\"\n \"sa1atik.cn\"\n \"ton.access.orbs.network\"\n \"tonapi.io\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$43","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"wuu0nt.exe\" (UID: 00000000-00001304)\n Spawned process \"imgcache.exe\" (UID: 00000000-00007368)\n Spawned process \"rundll32.exe\" with commandline \"shell32.dll,SHCreateLocalServerRunDll {F2506CD7-82C2-43D9-A1D3-F ...\" (UID: 00000000-00007072)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"wuu0nt.exe\" (UID: 00000000-00001304)\n Spawned process \"imgcache.exe\" (UID: 00000000-00007368)\n Spawned process \"rundll32.exe\" with commandline \"shell32.dll,SHCreateLocalServerRunDll {F2506CD7-82C2-43D9-A1D3-F ...\" (UID: 00000000-00007072)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 900029)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$44","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"file\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"wuu0nt.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"imgcache.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"wuu0nt.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\ntim-kgN.tmp\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish enduring access through network startup procedures","description":"Found string \"UserInitMprLogonScript\" (Indicator: \"userinitmprlogonscript\"; Source: \"00000000-00001304-00000BBE-858490767\")","origin":"File/Memory","mitre_attack_id":"T1037.003","relevance":1,"id":"string-716","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"Found string \"ystem.IsAttachment\" (Source: \"00000000-00001304.00000000.155821.07570000.00000002.mdmp\")\n Found string \"ystem.Message.AttachmentContents\" (Source: \"00000000-00001304.00000000.155821.07570000.00000002.mdmp\")\n Found string \"ystem.Message.AttachmentNames\" (Source: \"00000000-00001304.00000000.155821.07570000.00000002.mdmp\")\n Found string \"ystem.Message.HasAttachments\" (Source: \"00000000-00001304.00000000.155821.07570000.00000002.mdmp\")\n Found string \"System.IsAttachment\" (Source: \"00000000-00001304.00000001.157743.075C0000.00000002.mdmp\")\n Found string \"System.Message.AttachmentContents\" (Source: \"00000000-00001304.00000001.157743.075C0000.00000002.mdmp\")\n Found string \"System.Message.AttachmentNames\" (Source: \"00000000-00001304.00000001.157743.075C0000.00000002.mdmp\")\n Found string \"System.Message.HasAttachments\" (Source: \"00000000-00001304.00000001.157743.075C0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$45","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to perform scheduled task-related activity (Powershell command string)","description":"Found string \"register-scheduledtask\" (Indicator: \"Register-ScheduledTask\"; File: \"file\")\n Found string \"register-scheduledtask\" (Indicator: \"Register-ScheduledTask\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1053.005","relevance":1,"id":"string-335","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"wuu0nt.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"imgcache.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"wuu0nt.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 (stripped to external PDB) 10 sections\"- Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\SettingSync\\wuu0nt.exe]- [targetUID: 00000000-00001304]\n \"imgcache.exe\" has type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections\"- Location: [%LOCALAPPDATA%\\cversions_v2\\imgcache.exe]- [targetUID: 00000000-00001304]\n \"wuu0nt.exe%3AZone.Identifier\" has type \"ASCII text with CRLF line terminators\"- [targetUID: N/A]\n \"ntim-kgN.tmp\" has type \"ASCII text\"- Location: [%TEMP%\\ntim-kgN.tmp]- [targetUID: 00000000-00001304]\n \"wuu0nt.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 (stripped to external PDB) 10 sections\"- Location: [%LOCALAPPDATA%\\wuu0nt.exe]- [targetUID: 00000000-00001304]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"ntim-kgN.tmp\" has type \"ASCII text\" - Location: [%TEMP%\\ntim-kgN.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$46","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"file.exe\" queries basic process information of the \"C:\\file.exe\" (UID: 6596)\n \"file.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\SettingSync\\wuu0nt.exe\" (UID: 6596)\n \"wuu0nt.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\SettingSync\\wuu0nt.exe\" (UID: 1304)\n \"wuu0nt.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\cversions_v2\\imgcache.exe\" (UID: 1304)\n \"imgcache.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\cversions_v2\\imgcache.exe\" (UID: 7368)\n \"rundll32.exe\" queries basic process information of the \"C:\\Windows\\System32\\rundll32.exe\" (UID: 7072)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$47","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"file.exe\" reads file \"c:\\file.exe\"\n \"file.exe\" reads file \"c:\\file.exe:zone.identifier\"\n \"wuu0nt.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\settingsync\\wuu0nt.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$48","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"file.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"file.exe\" trying to touch file \"C:\\WINDOWS\\system32\\wow64log.dll\"\n \"file.exe\" trying to touch file \"C:\\FILE.EXE.LOCAL\"\n \"file.exe\" trying to touch file \"C:\\file.exe.Local\\\"\n \"file.exe\" trying to touch file \"C:\\Windows\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\\comctl32.dll\"\n \"file.exe\" trying to touch file \"C:\\WINDOWS\\WinSxS\\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.16299.248_none_5d7c08dba7db7edd\\COMCTL32.dll\"\n \"file.exe\" trying to touch file \"\\Device\\CNG\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"file.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\kernelbase.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\imm32.dll\"\n \"file.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\IMM32.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$49","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access LNK files (Windows shortcut)","description":"\"wuu0nt.exe\" trying to access LNK file \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WUU0NT.LNK\"\n \"wuu0nt.exe\" trying to access LNK file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WUU0NT.LNK\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-203","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$4a","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$4b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"file.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\settingsync\\wuu0nt.exe\"\n \"file.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\microsoft\\windows\\settingsync\\wuu0nt.exe:zone.identifier\"\n \"file.exe\" writes file \"%localappdata%\\microsoft\\windows\\settingsync\\wuu0nt.exe:zone.identifier\"\n \"file.exe\" writes file \"%localappdata%\\microsoft\\windows\\settingsync\\wuu0nt.exe\"\n \"wuu0nt.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\ntim-kgn.tmp\"\n \"wuu0nt.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\wuu0nt.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; File: \"file\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00007368-00000C2C-862183485\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /v2/dns/remoteadministratortool.ton/resolve\"\n Found http requests in header \"POST /route/1/mainnet/toncenter-api-v2/runGetMethod\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00007368.00000000.155968.05C00000.00000004.mdmp\")\n Found reference to API \"WSASendTo\" (Indicator: \"WSASend\"; Source: \"00000000-00007368.00000000.155968.05C00000.00000004.mdmp\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00007368.00000000.155968.05C00000.00000004.mdmp\")\n Found reference to API \"WSARecv\" (Indicator: \"WSARecv\"; Source: \"00000000-00007368.00000000.155968.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$4c","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00007368-00000C2C-861487925\")\n Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00007368.00000000.155968.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.35\"\n \"192.168.0.2\"\n \"1.1.1.1:443\"\n Potential IP \"1.1.1.1\" found in string \"https://1.1.1.1/dns-query?name=dns.google\"\n Potential IP \"1.1.1.1\" found in string \"https://dns.google/resolve?name=1.1.1.1\"\n Potential IPs \"1.1.1.1\"\n \"1.1.1.1\" found in string \"https://1.1.1.1/dns-query?name=1.1.1.1\"\n Potential IP \"1.1.1.1\" found in string \"https://1.1.1.1/dns-query?name=google.com\"\n \"2.5.29.37\"\n \"2.5.29.17\"\n \"2.5.29.31\"\n \"2.5.29.19\"\n \"2.5.29.15\"\n \"2.5.29.14\"\n \"2.5.29.16\"\n \"2.5.29.32\"\n \"192.168.0.1\"\n \"192.168.0.1:53\"\n \"1.1.1.1\"\n \"0.0.0.0:0\"\n Potential IP \"1.1.1.1\" found in string \"Zhttps://1.1.1.1/dns-query?name=google.com\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.1\"\n \"2.5.4.3\"\n \"2.5.29.10\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$4d","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$4e","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1\nHost: tonapi.io\nUser-Agent: Go-http-client/1.1\nContent-Type: application/octet-stream\nAccept-Encoding: gzip\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"cloudflare-dns.com\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 35ffbe2daba5f224631a493c243351ec\n Observed JA3 fingerprint: 1e93d985c806ca627b3b564ad06cc0c3\n Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://gcc.gnu.org\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://tonapi.io/v2/dns/remoteadministratortool.ton/resolve\n Found HTTPS POST request to https://ton.access.orbs.network/route/1/mainnet/toncenter-api-v2/runGetMethod","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"tonapi.io\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"1.1.1.1\" on port \"443\"\n HTTPS traffic to \"104.16.248.249\" on port \"443\"\n HTTPS traffic to \"172.66.170.210\" on port \"443\"\n HTTPS traffic to \"196.196.208.18\" on port \"443\"\n HTTPS traffic to \"151.101.66.132\" on port \"443\"\n HTTPS traffic to \"151.101.130.132\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"sample.bin\"\n YARA signature for Djb2 Hash Algorithm matched on file \"wuu0nt.exe.2211464127\"\n YARA signature for Djb2 Hash Algorithm matched on file \"wuu0nt.exe.352945945\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; File: \"file\")\n Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; File: \"file\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExW\" in file \"file\"\n Found registry query API: \"RegOpenKeyExW\" in file \"file\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00001304.00000000.155821.007D9000.00000004.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00001304.00000000.155821.007D9000.00000004.mdmp\"\n Found registry query API: \"RegOpenKeyExW\" in \"00000000-00006596.00000000.155766.007D9000.00000004.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00006596.00000000.155766.007D9000.00000004.mdmp\"\n Found registry query API: \"\"RegOpenKeyExW\" in \"00000000-00007368.00000000.155968.05C00000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$51","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"wuu0nt.exe\" loaded module \"%WINDIR%\\SysWOW64\\samcli.dll\" at 72E50000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"file.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"wuu0nt.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"wuu0nt.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}\n \"imgcache.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"imgcache.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}\n \"rundll32.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"wuu0nt.exe\" called \"GetUserNameW\" (UID: 00000000-00001304)\n \"wuu0nt.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"wuu0nt.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$52","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"file\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"file\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001304.00000000.155821.007D9000.00000004.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"Found string \"if (Get-Command Add-MpPreference -ErrorAction SilentlyContinue) {\" (Indicator: \"Get-Command\"; Source: \"00000000-00007368.00000000.155968.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"file\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; File: \"file\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; File: \"file\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")\n Found reference to API \"GetComputerNameA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"file\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001304.00000000.155821.007D9000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"file\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001304.00000000.155821.007D9000.00000004.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"file\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001304.00000000.155821.007D9000.00000004.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$56","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Found reference to API \"WTSQueryUserToken\" (Indicator: \"WTSQueryUserToken\"; File: \"file\")\n Found reference to API \"CreateProcessAsUserW\" (Indicator: \"CreateProcessAsUser\"; File: \"file\")\n Found reference to API \"CreateProcessWithTokenW\" (Indicator: \"CreateProcessWithToken\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"file\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"System Security","name":"Contains ability to disable Windows Defender using PowerShell","description":"Found string \"disablerealtimemonitoring\" (Indicator: \"disablerealtimemonitoring\"; File: \"file\")\n Found string \"disablebehaviormonitoring\" (Indicator: \"disablebehaviormonitoring\"; File: \"file\")\n Found string \"disablerealtimemonitoring\" (Indicator: \"disablerealtimemonitoring\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")\n Found string \"disablebehaviormonitoring\" (Indicator: \"disablebehaviormonitoring\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-748","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify Windows Defender preferences (Powershell command string)","description":"Found string \"set-mppreference\" (Indicator: \"Set-MpPreference\"; File: \"file\")\n Found string \"set-mppreference\" (Indicator: \"Set-MpPreference\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-275","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; File: \"file\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; File: \"file\")\n Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"DuplicateTokenEx\" (Indicator: \"DuplicateToken\"; File: \"file\")\n Found reference to API \"DuplicateTokenEx\" (Indicator: \"DuplicateTokenEx\"; File: \"file\")\n Found reference to API \"SetTokenInformation\" (Indicator: \"SetTokenInformation\"; File: \"file\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; File: \"file\")\n Found reference to API \"DuplicateTokenEx\" (Indicator: \"DuplicateToken\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")\n Found reference to API \"DuplicateTokenEx\" (Indicator: \"DuplicateTokenEx\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")\n Found reference to API \"SetTokenInformation\" (Indicator: \"SetTokenInformation\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"file\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"file\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00001304.00000000.155821.007D9000.00000004.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp, 00000000-00006596.00000000.155766.007D9000.00000004.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"file\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"imgcache.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"wuu0nt.exe\" opened \"\\Device\\KsecDD\"\n \"imgcache.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$57","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$58","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"Found string \"set-mppreference\" (Indicator: \"Set-MpPreference\"; File: \"file\")\n Found string \"set-mppreference\" (Indicator: \"Set-MpPreference\"; Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"rundll32.exe,svchost.exe,lsass.exe,smss.exe,csrss.exe\" (Source: \"00000000-00007368.00000000.155968.05330000.00000004.mdmp, 00000000-00007368.00000000.155968.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"file\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"file\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00001304.00000000.155821.007D9000.00000004.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00001304.00000000.155821.007D9000.00000004.mdmp\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00006596.00000000.155766.007D9000.00000004.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00006596.00000000.155766.007D9000.00000004.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp\")\n Found reference to API \"CreateMutexExW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00007072.00000000.156068.6A3A8000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\".getmicrosoftkey.com1&0\" (Source: 00000000-00007368.00000001.157888.037C9000.00000004.mdmp, 00000000-00007368.00000002.159810.03790000.00000004.mdmp, Indicator: \"key.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"wuu0nt.exe\" - Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\SettingSync\\wuu0nt.exe]- [targetUID: 00000000-00001304]\n Dropped file: \"imgcache.exe\" - Location: [%LOCALAPPDATA%\\cversions_v2\\imgcache.exe]- [targetUID: 00000000-00001304]\n Dropped file: \"wuu0nt.exe\" - Location: [%LOCALAPPDATA%\\wuu0nt.exe]- [targetUID: 00000000-00001304]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"imgcache.exe\" was detected as \"UPX -> www.upx.sourceforge.net\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"runtimebroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"\\runtimebroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")\n \"ApplicationFrameHost.exeRuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"wuu0nt.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"imgcache.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"explorer.exe\" (Indicator: \"explorer.exe\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"file\" has section name .data with entropy \"7.9999266484564675\"\n \"file\" has section name .rdata with entropy \"7.905839851454543\"\n \"file\" has section name .CRT with entropy \"7.321494858479303\"\n \"file\" has section name .tls with entropy \"7.540647457454793\"\n \"wuu0nt.exe\" has section name .data with entropy \"7.9999266484564675\"\n \"wuu0nt.exe\" has section name .rdata with entropy \"7.905839851454543\"\n \"wuu0nt.exe\" has section name .CRT with entropy \"7.321494858479303\"\n \"wuu0nt.exe\" has section name .tls with entropy \"7.540647457454793\"\n \"imgcache.exe\" has section name UPX1 with entropy \"7.999954029064807\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Calls an API typically used to import asymmetric cryptographic keys into a CSP","description":"$59","origin":"API Call","mitre_attack_id":"T1573.002","relevance":1,"id":"api-234","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%LOCALAPPDATA%\\Microsoft\\Windows\\SettingSync\\wuu0nt.exe\" has high entropy 7.96857\n Dropped file \"%LOCALAPPDATA%\\cversions_v2\\imgcache.exe\" has high entropy 7.99994\n Dropped file \"%LOCALAPPDATA%\\wuu0nt.exe\" has high entropy 7.96857","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"10/26 Antivirus vendors marked sample as malicious (38% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$5a","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"suspicious","category":"General","name":"Sends UDP traffic","description":"\"UDP connection to 1.1.1.1\"","origin":"Network Traffic","mitre_attack_id":"T1095","relevance":1,"id":"network-5","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"wuu0nt.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 (stripped to external PDB) 10 sections\"- Location: [%LOCALAPPDATA%\\Microsoft\\Windows\\SettingSync\\wuu0nt.exe]- [targetUID: 00000000-00001304]\n \"imgcache.exe\" has type \"PE32 executable for MS Windows 6.01 (GUI) Intel i386 UPX compressed 3 sections\"- Location: [%LOCALAPPDATA%\\cversions_v2\\imgcache.exe]- [targetUID: 00000000-00001304]\n \"wuu0nt.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 (stripped to external PDB) 10 sections\"- Location: [%LOCALAPPDATA%\\wuu0nt.exe]- [targetUID: 00000000-00001304]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\"wuu0nt.exe\" wrote 8192 bytes starting with PE header signature to file \"C:\\Users\\%OSUSER%\\AppData\\Local\\wuu0nt.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"UDP traffic to 1.1.1.1 on port 443\n TCP traffic to 104.16.248.249 on port 443 is sent without HTTP header\n TCP traffic to 1.1.1.1 on port 443 is sent without HTTP header\n TCP traffic to 172.66.170.210 on port 443 is sent without HTTP header\n TCP traffic to 196.196.208.18 on port 443 is sent without HTTP header\n TCP traffic to 151.101.66.132 on port 443 is sent without HTTP header\n TCP traffic to 151.101.130.132 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE file \"imgcache.exe\"\n YARA signature for invalid Timestamp of PE file \"imgcache.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"\\wmic.exe\" (Indicator: \"wmic.exe\"; in File: \"file\")\n Found string \"\\wmic.exe\" (Indicator: \"wmic.exe\"; in Source: \"00000000-00006596.00000000.155766.007AB000.00000002.mdmp\")\n Found string \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\"; in Source: \"00000000-00007368.00000000.155968.05330000.00000004.mdmp, 00000000-00007368.00000000.155968.05C00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"wuu0nt.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\SettingSync\\wuu0nt.exe:Zone.Identifier\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"wuu0nt.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\SettingSync\\wuu0nt.exe:Zone.Identifier\" with delete access\n \"wuu0nt.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\wuu0nt.exe:ZONE.IDENTIFIER\" with delete access\n \"wuu0nt.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\SettingSync\\wuu0nt.exe:ZONE.IDENTIFIER\" with delete access\n \"wuu0nt.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WUU0NT.LNK\" with delete access\n \"wuu0nt.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\WUU0NT.URL\" with delete access\n \"wuu0nt.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\cversions_v2\\imgcache.exe:ZONE.IDENTIFIER\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"imgcache.exe\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCloseKey\n RegOpenKeyExW\n GetUserNameW\n OutputDebugStringA\n GetVersionExW\n GetSystemDirectoryW\n GetStartupInfoA\n GetFileAttributesW\n GetCommandLineW\n LoadLibraryA\n Sleep\n GetTickCount\n GetModuleHandleW\n VirtualAlloc\n GetProcAddress\n GetModuleHandleA\n GetStartupInfoW\n LoadLibraryW\n TerminateProcess\n GetModuleFileNameW\n VirtualProtect","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"imgcache.exe\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Detected Rundll32 process execution","description":"Process \"rundll32.exe\" with commandline \"shell32.dll,SHCreateLocalServerRunDll {F2506CD7-82C2-43D9-A1D3-F85F5EFE7D09} -Embedding\" (UID: 00000000-00007072)","origin":"Monitored Target","mitre_attack_id":"T1218.011","relevance":10,"id":"target-115","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Tries to hide tracks of having downloaded a file from the internet","description":"\"wuu0nt.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\SettingSync\\wuu0nt.exe:Zone.Identifier\" with delete access\n \"wuu0nt.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\wuu0nt.exe:ZONE.IDENTIFIER\" with delete access\n \"wuu0nt.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\SettingSync\\wuu0nt.exe:ZONE.IDENTIFIER\" with delete access\n \"wuu0nt.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\cversions_v2\\imgcache.exe:ZONE.IDENTIFIER\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-42","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (D)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"11/24 Antivirus vendors marked dropped file \"imgcache.exe\" as malicious (classified as \"Dump:Generic.Dacic.18086\" with 45% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"11/24 Antivirus vendors marked spawned process \"imgcache.exe\" (PID: 7368) as malicious (classified as \"Dump:Generic.Dacic.18086\" with 45% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"file.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\SettingSync\\wuu0nt.exe\" (Handle: 588)\n \"file.exe\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\SettingSync\\wuu0nt.exe\" (Handle: 588)\n \"file.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\SettingSync\\wuu0nt.exe\" (Handle: 588)\n \"wuu0nt.exe\" wrote 00000FB8 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\cversions_v2\\imgcache.exe\" (Handle: 648)\n \"wuu0nt.exe\" wrote 00000008 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\cversions_v2\\imgcache.exe\" (Handle: 648)\n \"wuu0nt.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\cversions_v2\\imgcache.exe\" (Handle: 648)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"Hooks API calls"},{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Persists itself using auto-execute at a hidden registry location"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"Evasive","details_count":5,"details":[{"detail":"Marks file for deletion"},{"detail":"Tries to hide tracks of having downloaded a file from the internet"},{"detail":"Possibly tries to evade analysis by sleeping multiple times"},{"detail":"May check for the presence of a forensics/monitoring tool"},{"detail":"PE file has a section name known to be used by a packer/protector"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]}],"intel_graph":{"map":{"Domain:026042d01ac6e8faf294ec9b5816b47f34558c59cbe3d30937ddc18e43fe1f1e":{"type":"Domain","value":"dns.google","verdict":{"verdict":"unknown"}},"Domain:0b74fc419a513e832e21208d63bc84be7583250b62162557167f8da18e10f635":{"type":"Domain","value":"cloudflare-dns.com","verdict":{"verdict":"unknown"}},"Domain:173aa603755688ca7fd8d7bf1565f2112df347dab1cf3b777b4d7559a68482e5":{"type":"Domain","value":"tonapi.io","verdict":{"verdict":"unknown"}},"Domain:5f93289debb5d6dee51139b15fad9cbf01330e06ead87a680481397c29193a8f":{"type":"Domain","value":"sa1atik.cn","verdict":{"verdict":"malicious","verdict_source":"domain reputation data","reasons":["reported malicious domain"]}},"Domain:ton.access.orbs.network":{"type":"Domain","value":"ton.access.orbs.network"},"File:1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33":{"type":"File","value":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33"},"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1":{"type":"File","value":"ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","verdict":{"verdict":"malicious","verdict_source":"domain reputation data","reasons":["reported malicious domain"]},"filetype":"PE32 executable (GUI) Intel 80386 (stripped to external PDB), for MS Windows, 10 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:f17c997c2d59aac8a92c3fb9a08f00747e67b8f355d2ac99b82e5c159f917530":{"type":"File","value":"f17c997c2d59aac8a92c3fb9a08f00747e67b8f355d2ac99b82e5c159f917530"},"File:fe9f5f68c9fa16b73f1173e11fe416adc065e529a4d6dcf4d13bf48755b4d877":{"type":"File","value":"fe9f5f68c9fa16b73f1173e11fe416adc065e529a4d6dcf4d13bf48755b4d877"},"Ip:1.1.1.1":{"type":"Ip","value":"1.1.1.1"},"Ip:104.16.248.249":{"type":"Ip","value":"104.16.248.249"},"Ip:151.101.130.132":{"type":"Ip","value":"151.101.130.132"},"Ip:151.101.66.132":{"type":"Ip","value":"151.101.66.132"},"Ip:172.66.170.210":{"type":"Ip","value":"172.66.170.210"},"Ip:196.196.208.18":{"type":"Ip","value":"196.196.208.18"},"Url:/route/1/mainnet/toncenter-api-v2/runGetMethod":{"type":"Url","value":"/route/1/mainnet/toncenter-api-v2/runGetMethod"},"Url:/v2/dns/remoteadministratortool.ton/resolve":{"type":"Url","value":"/v2/dns/remoteadministratortool.ton/resolve"}},"chains":[{"id":"1560631450035186238","root":"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","edges":[{"edge_kind":"contacted_domain","from_key":"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","to_key":"Domain:026042d01ac6e8faf294ec9b5816b47f34558c59cbe3d30937ddc18e43fe1f1e"}],"verdict":{"verdict":"unknown"}},{"id":"1560631450035186232","root":"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","edges":[{"edge_kind":"contacted_domain","from_key":"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","to_key":"Domain:0b74fc419a513e832e21208d63bc84be7583250b62162557167f8da18e10f635"}],"verdict":{"verdict":"unknown"}},{"id":"1560631450035186243","root":"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","edges":[{"edge_kind":"contacted_domain","from_key":"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","to_key":"Domain:173aa603755688ca7fd8d7bf1565f2112df347dab1cf3b777b4d7559a68482e5"}],"verdict":{"verdict":"unknown"}},{"id":"1560631463493084022","root":"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","edges":[{"edge_kind":"contacted_domain","from_key":"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","to_key":"Domain:5f93289debb5d6dee51139b15fad9cbf01330e06ead87a680481397c29193a8f"}],"verdict":{"verdict":"malicious","verdict_source":"domain reputation data","reasons":["reported malicious domain"]}},{"id":"sandbox_network","root":"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","edges":[{"edge_kind":"contacted_ip","from_key":"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","to_key":"Ip:1.1.1.1"},{"edge_kind":"contacted_ip","from_key":"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","to_key":"Ip:104.16.248.249"},{"edge_kind":"contacted_ip","from_key":"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","to_key":"Ip:172.66.170.210"},{"edge_kind":"contacted_ip","from_key":"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","to_key":"Ip:196.196.208.18"},{"edge_kind":"contacted_ip","from_key":"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","to_key":"Ip:151.101.66.132"},{"edge_kind":"contacted_ip","from_key":"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","to_key":"Ip:151.101.130.132"},{"edge_kind":"contacted_domain","from_key":"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","to_key":"Domain:5f93289debb5d6dee51139b15fad9cbf01330e06ead87a680481397c29193a8f"},{"edge_kind":"contacted_domain","from_key":"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","to_key":"Domain:173aa603755688ca7fd8d7bf1565f2112df347dab1cf3b777b4d7559a68482e5"},{"edge_kind":"contacted_domain","from_key":"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","to_key":"Domain:0b74fc419a513e832e21208d63bc84be7583250b62162557167f8da18e10f635"},{"edge_kind":"contacted_domain","from_key":"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","to_key":"Domain:026042d01ac6e8faf294ec9b5816b47f34558c59cbe3d30937ddc18e43fe1f1e"},{"edge_kind":"contacted_domain","from_key":"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","to_key":"Domain:ton.access.orbs.network"},{"edge_kind":"resolves_to","from_key":"Domain:ton.access.orbs.network","to_key":"Ip:151.101.66.132"},{"edge_kind":"contacted_url","from_key":"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","to_key":"Url:/v2/dns/remoteadministratortool.ton/resolve"},{"edge_kind":"contacted_url","from_key":"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","to_key":"Url:/route/1/mainnet/toncenter-api-v2/runGetMethod"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","edges":[{"edge_kind":"extracted","from_key":"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","to_key":"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1"},{"edge_kind":"extracted","from_key":"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","to_key":"File:f17c997c2d59aac8a92c3fb9a08f00747e67b8f355d2ac99b82e5c159f917530"},{"edge_kind":"extracted","from_key":"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","to_key":"File:fe9f5f68c9fa16b73f1173e11fe416adc065e529a4d6dcf4d13bf48755b4d877"},{"edge_kind":"extracted","from_key":"File:ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","to_key":"File:1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":6,"spawned_processes_count":6,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":26,"imported_dlls_count":79,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":20,"files_deleted_count":0,"registry_keys_created_count":53,"registry_keys_modified_count":0,"registry_keys_deleted_count":7,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":60,"embedded_ips_count":0,"embedded_domains_count":4,"embedded_urls_count":0,"contacted_hosts_count":6,"dns_resolutions_count":5,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["salatstealer","criminal","informationstealer","rat","windows-server-utility","suspicious"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"6ad219486830b652d104dd1a","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Heur.Mint.Zard","contacted_countries":["FIN","USA"],"submit_name":"file","analysis_start_time":"2026-10-16T12:32:10+00:00","indicators_count":{"informative":201,"suspicious":63,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"1.1.1.1","port":443,"protocol":"UDP","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"address":"104.16.248.249","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"address":"172.66.170.210","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"address":"196.196.208.18","port":443,"protocol":"TCP","country":"Finland","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"address":"151.101.66.132","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"address":"151.101.130.132","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]}],"dns_resolutions":[{"domain":"sa1atik.cn","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"domain":"tonapi.io","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"domain":"cloudflare-dns.com","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"domain":"dns.google","sources":[{"report_type":"qsp","report_id":""}]},{"domain":"ton.access.orbs.network","address":"151.101.66.132","ttl":206,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]}],"http_requests":[{"host":"tonapi.io","host_ip":"172.66.170.210:443","url":"/v2/dns/remoteadministratortool.ton/resolve","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /v2/dns/remoteadministratortool.ton/resolve HTTP/1.1\nHost: tonapi.io\nUser-Agent: Go-http-client/1.1\nContent-Type: application/octet-stream\nAccept-Encoding: gzip","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"host":"ton.access.orbs.network","host_ip":"151.101.66.132:443","url":"/route/1/mainnet/toncenter-api-v2/runGetMethod","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /route/1/mainnet/toncenter-api-v2/runGetMethod HTTP/2\nHost: ton.access.orbs.network\nUser-Agent: Go-http-client/2.0\nContent-Type: application/json\nAccept-Encoding: gzip","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]}],"embedded_domains":[{"value":"sa1atik.cn","sources":[{"report_type":"qsp","report_id":""}]},{"value":"tonapi.io","sources":[{"report_type":"qsp","report_id":""}]},{"value":"cloudflare-dns.com","sources":[{"report_type":"qsp","report_id":""}]},{"value":"dns.google","sources":[{"report_type":"qsp","report_id":""}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}],"processes":[{"pid":6596,"ppid":0,"name":"file.exe","command_line":"","sha256":"ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","normalized_path":"C:\\file.exe","uid":"00000000-00006596","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":1304,"ppid":6596,"name":"wuu0nt.exe","command_line":"","sha256":"ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","normalized_path":"%LOCALAPPDATA%\\Microsoft\\Windows\\SettingSync\\wuu0nt.exe","parent_uid":"00000000-00006596","uid":"00000000-00001304"},{"pid":7368,"ppid":1304,"name":"imgcache.exe","command_line":"","sha256":"f17c997c2d59aac8a92c3fb9a08f00747e67b8f355d2ac99b82e5c159f917530","normalized_path":"%LOCALAPPDATA%\\cversions_v2\\imgcache.exe","parent_uid":"00000000-00001304","uid":"00000000-00007368"},{"pid":7936,"ppid":6596,"name":"WerFault.exe","command_line":"-u -p 6596 -s 128","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00006596","uid":"00000000-00007936"},{"pid":1992,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 460 -p 6596 -ip 6596","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00001992","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":7072,"ppid":0,"name":"rundll32.exe","command_line":"shell32.dll,SHCreateLocalServerRunDll {F2506CD7-82C2-43D9-A1D3-F85F5EFE7D09} -Embedding","sha256":"b1e6a7a3e2597e51836277a32b2bc61aa781c8f681d44dfddea618b32e2bf2a6","normalized_path":"%WINDIR%\\System32\\rundll32.exe","uid":"00000000-00007072","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="}],"all_imported_dlls":["sechost.dll","OneCoreUAPCommonProxyStub.dll","msctf.dll","wow64win.dll","kernel32.dll","comdlg32.dll","VxSSL32.dll","ntdll.dll","user32.dll","secur32.dll","crypt32.dll","msvcp140.dll","oleaut32.dll","ntmarta.dll","apphelp.dll","rasadhlp.dll","gdi32.dll","netapi32.dll","mlang.dll","dhcpcsvc6.dll","win32u.dll","cryptsp.dll","wkscli.dll","wininet.dll","IPHLPAPI.DLL","msasn1.dll","cryptbase.dll","advapi32.dll","shlwapi.dll","shell32.dll","clbcatq.dll","dnsapi.dll","rsaenh.dll","wow64cpu.dll","KernelBase.dll","ucrtbase.dll","windows.storage.dll","kernel.appcore.dll","Windows.StateRepositoryPS.dll","winmmbase.dll","gpapi.dll","combase.dll","SHCore.dll","propsys.dll","VxSSL64.dll","wow64.dll","ole32.dll","fltLib.dll","urlmon.dll","imagehlp.dll","version.dll","vcruntime140_1.dll","sspicli.dll","comctl32.dll","cfgmgr32.dll","netutils.dll","winmm.dll","bcryptprimitives.dll","iertutil.dll","gdi32full.dll","powrprof.dll","vcruntime140.dll","uxtheme.dll","samcli.dll","rpcrt4.dll","msvcrt.dll","profapi.dll","imm32.dll","dwmapi.dll","bcrypt.dll","dhcpcsvc.dll","msvcp_win.dll","ws2_32.dll","wtsapi32.dll","ieframe.dll","edputil.dll","mswsock.dll","nsi.dll","FWPUCLNT.DLL"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"wuu0nt.exe","sha256":"ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"imgcache.exe","sha256":"f17c997c2d59aac8a92c3fb9a08f00747e67b8f355d2ac99b82e5c159f917530","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"ntim-kgN.tmp","sha256":"fe9f5f68c9fa16b73f1173e11fe416adc065e529a4d6dcf4d13bf48755b4d877","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"wuu0nt.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"path":"%LOCALAPPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\SettingSync\\wuu0nt.exe","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\SettingSync\\wuu0nt.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"path":"%TEMP%\\ntim-kgN.tmp","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"path":"%LOCALAPPDATA%\\wuu0nt.exe","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"path":"%LOCALAPPDATA%\\cversions_v2\\imgcache.exe","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\RUN\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCUHKCU\\ENVIRONMENT\\USERINITMPRLOGONSCRIPT\\USERINITMPRLOGONSCRIPT","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\RUN\\1\\1","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\POLICIES\\EXPLORER\\RUN\\WUU0NT\\WUU0NT","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\\WUU0NT\\WUU0NT","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\STARTUPAPPROVED\\RUN\\WUU0NT\\WUU0NT","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\STARTUPAPPROVED\\RUN\\WUU0NT.LNK\\WUU0NT.LNK","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\EXPLORER\\STARTUPAPPROVED\\STARTUPFOLDER\\WUU0NT.LNK\\WUU0NT.LNK","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6596:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6596:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MeBjAaAa_pEVwfI1QNW3QvEPYlsZuZwvQ","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\MeBjAaAa__eh_shmem3_gcc_tdm_","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"MeBjAaAa__eh_shmem3_gcc_tdm_","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"MeBjAaAa_pEVwfI1QNW3QvEPYlsZuZwvQ","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"SM0:6596:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"Local\\SM0:6596:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1304:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1304:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\BiAfAaAa_pEVwfI1QNW3QvEPYlsZuZwvQ","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\BiAfAaAa__eh_shmem3_gcc_tdm_","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1304:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"BiAfAaAa_pEVwfI1QNW3QvEPYlsZuZwvQ","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"SM0:1304:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"Local\\SM0:1304:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"Local\\SM0:1304:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"SM0:1304:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"BiAfAaAa__eh_shmem3_gcc_tdm_","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1304:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"\\BaseNamedObjects\\WEBR_QHGLAINUNW9A","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7072:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7072:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"Local\\SM0:7072:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]},{"name":"SM0:7072:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad219486830b652d104dd1a"}]}]}},"report_ids":{"sandbox_job_ids":["6ad219486830b652d104dd1a"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Mint.Zard.Generic Sample ab0c6d4640de… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ab0c6d4640de…. Malware family: Mint.Zard.Generic. Threat score 100/100. 11/27 AV engines flagged this file. 7 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1"}],["$","meta","4",{"property":"og:title","content":"Malicious Mint.Zard.Generic Sample ab0c6d4640de… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ab0c6d4640de…. Malware family: Mint.Zard.Generic. Threat score 100/100. 11/27 AV engines flagged this file. 7 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ab0c6d4640de59c97bcdf9bab4a6cba7523b7d4e48bf56c729ecba9e0c5dd6d1"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Mint.Zard.Generic Sample ab0c6d4640de… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ab0c6d4640de…. Malware family: Mint.Zard.Generic. Threat score 100/100. 11/27 AV engines flagged this file. 7 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L5b","11",{}]]