24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 4b:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Tedy.Generic Sample ba2a7da1372b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ba2a7da1372b…. Malware family: Tedy.Generic. Threat score 100/100. 11/26 AV engines flagged this file. 10 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5","keywords":["Malicious","Tedy.Generic","malware analysis","sandbox report","threat intelligence","ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5"],"about":{"@type":"SoftwareApplication","name":"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe","applicationCategory":["peexe","executable"],"identifier":"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Tedy.Generic","antivirusDetections":{"malicious":11,"total":26},"behavioralIndicators":{"malicious":10,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T6b2,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe") Found reference to API "RtlMoveMemory" (Indicator: "RtlMoveMemory"; File: "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003212.00000000.230499.00401000.00000020.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00003212.00000000.230499.00401000.00000020.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003212.00000000.230499.00401000.00000020.mdmp") Found reference to API "RtlMoveMemory" (Indicator: "RtlMoveMemory"; Source: "00000000-00003212.00000000.230499.00401000.00000020.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00003212.00000000.230499.00401000.00000020.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00003212.00000000.230499.00401000.00000020.mdmp")26:Tb3f,"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\COM3") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SQMCLIENT\WINDOWS\DISABLEDPROCESSES\") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SQMCLIENT\WINDOWS\DISABLEDPROCESSES") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\SQMCLIENT\WINDOWS\DISABLEDSESSIONS\") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\SQMCLIENT\WINDOWS\DISABLEDSESSIONS") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "OPEN"; Path: "HKCU\WOW6432NODE\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\PROGID") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\WOW6432NODE\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\PROGID") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "OPEN"; Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\PROGID") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\PROGID")27:T490,Assembly shows XOR instruction xor eax D9F5660Fh in Stream UID: 46751-6-0040A360 Assembly shows XOR instruction xor cl byte ptr [edi+01h] in Stream UID: 46751-6-0040A360 Assembly shows XOR instruction xor bp word ptr [edx+10h] in Stream UID: 46751-16-0040A384 Assembly shows XOR instruction xor ebx eax in Stream UID: 46751-26-00479660 Assembly shows XOR instruction xor cl byte ptr [eax+edx] in Stream UID: 46751-686-0042BE52 Assembly shows XOR instruction xor eax 980F7294h in Stream UID: 00000000-00003212-49870-8-00483CD0 Assembly shows XOR instruction xor ah byte ptr [ecx+00000072h] in Stream UID: 00000000-00003212-49870-8-00483CD0 Assembly shows XOR instruction xor ebx eax in Stream UID: 00000000-00003212-49870-22-00479660 Assembly shows XOR instruction xor eax 00401764h in Stream UID: 00000000-00003212-49870-634-0041C432 Assembly shows XOR instruction xor cl byte ptr [eax+edx] in Stream UID: 00000000-00003212-49870-695-0042BE52 Assembly shows XOR instruction xor eax 00401764h in Stream UID: 00000000-00003212-49870-971-004583E2 Assembly shows XOR instruction xor eax 00401764h in Stream UID: 00000000-00003212-49870-1139-00470A4E28:T386e,"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000094db1800000000008e000000e4db1800feffffff6cdb1800f96f0d7700700d77093134778e00000047000000e4db18000000000040db180000000000a8db1800 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000cda18001cd81800340000c0f0352d0000000000202f2d000000000079007300740065006d004400720069007600650025005c00550073006500720073005c00440065000000000000007b00883980004d006900630072000700e2008a00000074005c00570069006e006400903280000100000080398000a0d81800a3e00c7774d91800e8d818000000000080398000b4d8180028e70c7700007b000000000088398000c4d81800ffe60c770000000038d918006f4bb87600000000774bb8760191edeb0000000000000000d4db180008000900f04ba1740000000000000000 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000003477340000c0d8da1800b8db1800fcd91800a07c7b0098da180045581177cd252000feffffff44640d775622b8768622b8769192edebcc49a174000000000000000020000000b0da1800d8da18000000000000007b008088810080888100180000000900cf00ed03000018000000a4010000d8da18002882810006000000c4da180000000000000000000000000024db18000000000024db18003202ba76000000003a02ba761d93edeb0000000001000000d8e981000200000010db180000000000000000000b48b8762993edeb0000000001000000d8e981000000000000000000 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000cda18001cd81800340000c0f0352d0000000000202f2d000000000079007300740065006d004400720069007600650025005c00550073006500720073005c00440065000000000000007b00883980004d006900630072000700e2008e00000074005c00570069006e006400903280000100000080398000a0d81800a3e00c7774d91800e8d818000000000080398000b4d8180028e70c7700007b000000000088398000c4d81800ffe60c770000000038d918006f4bb87600000000774bb8760191edeb0100000000000000d4db180008000900f04ba1740000000000000000 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000cda18001cd81800340000c0f0352d0000000000202f2d000000000079007300740065006d004400720069007600650025005c00550073006500720073005c00440065000000000000007b00883980004d006900630072000700e2009600000074005c00570069006e006400903280000100000080398000a0d81800a3e00c7774d91800e8d818000000000080398000b4d8180028e70c7700007b000000000088398000c4d81800ffe60c770000000038d918006f4bb87600000000774bb8760191edeb0300000000000000d4db180008000900f04ba1740000000000000000 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000cda18001cd81800340000c0f0352d0000000000202f2d000000000079007300740065006d004400720069007600650025005c00550073006500720073005c00440065000000000000007b00883980004d006900630072000700e2009a00000074005c00570069006e006400903280000100000080398000a0d81800a3e00c7774d91800e8d818000000000080398000b4d8180028e70c7700007b000000000088398000c4d81800ffe60c770000000038d918006f4bb87600000000774bb8760191edeb0400000000000000d4db180008000900f04ba1740000000000000000 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000cda18001cd81800340000c0f0352d0000000000202f2d000000000079007300740065006d004400720069007600650025005c00550073006500720073005c00440065000000000000007b00883980004d006900630072000700e200a200000074005c00570069006e006400903280000100000080398000a0d81800a3e00c7774d91800e8d818000000000080398000b4d8180028e70c7700007b000000000088398000c4d81800ffe60c770000000038d918006f4bb87600000000774bb8760191edeb0700000000000000d4db180008000900f04ba1740000000000000000 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000cda18001cd81800340000c0f0352d0000000000202f2d000000000079007300740065006d004400720069007600650025005c00550073006500720073005c00440065000000000000007b00883980004d006900630072000700e200a600000074005c00570069006e006400903280000100000080398000a0d81800a3e00c7774d91800e8d818000000000080398000b4d8180028e70c7700007b000000000088398000c4d81800ffe60c770000000038d918006f4bb87600000000774bb8760191edeb0900000000000000d4db180008000900f04ba1740000000000000000 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000cda18001cd81800340000c0f0352d0000000000202f2d000000000079007300740065006d004400720069007600650025005c00550073006500720073005c00440065000000000000007b00883980004d006900630072000700e200aa00000074005c00570069006e006400903280000100000080398000a0d81800a3e00c7774d91800e8d818000000000080398000b4d8180028e70c7700007b000000000088398000c4d81800ffe60c770000000038d918006f4bb87600000000774bb8760191edeb0600000000000000d4db180008000900f04ba1740000000000000000 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000cda18001cd81800340000c0f0352d0000000000202f2d000000000079007300740065006d004400720069007600650025005c00550073006500720073005c00440065000000000000007b00883980004d006900630072000700e200ae00000074005c00570069006e006400903280000100000080398000a0d81800a3e00c7774d91800e8d818000000000080398000b4d8180028e70c7700007b000000000088398000c4d81800ffe60c770000000038d918006f4bb87600000000774bb8760191edeb0800000000000000d4db180008000900f04ba1740000000000000000 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000cda18001cd81800340000c0f0352d0000000000202f2d000000000079007300740065006d004400720069007600650025005c00550073006500720073005c00440065000000000000007b00883980004d006900630072000700e200b200000074005c00570069006e006400903280000100000080398000a0d81800a3e00c7774d91800e8d818000000000080398000b4d8180028e70c7700007b000000000088398000c4d81800ffe60c770000000038d918006f4bb87600000000774bb8760191edeb0b00000000000000d4db180008000900f04ba1740000000000000000 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000cda18001cd81800340000c0f0352d0000000000202f2d000000000079007300740065006d004400720069007600650025005c00550073006500720073005c00440065000000000000007b00883980004d006900630072000700e200b600000074005c00570069006e006400903280000100000080398000a0d81800a3e00c7774d91800e8d818000000000080398000b4d8180028e70c7700007b000000000088398000c4d81800ffe60c770000000038d918006f4bb87600000000774bb8760191edeb0a00000000000000d4db180008000900f04ba1740000000000000000 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000cda18001cd81800340000c0f0352d0000000000202f2d000000000079007300740065006d004400720069007600650025005c00550073006500720073005c00440065000000000000007b00883980004d006900630072000700e200ba00000074005c00570069006e006400903280000100000080398000a0d81800a3e00c7774d91800e8d818000000000080398000b4d8180028e70c7700007b000000000088398000c4d81800ffe60c770000000038d918006f4bb87600000000774bb8760191edeb0d00000000000000d4db180008000900f04ba1740000000000000000 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000cda18001cd81800340000c0f0352d0000000000202f2d000000000079007300740065006d004400720069007600650025005c00550073006500720073005c00440065000000000000007b00883980004d006900630072000700e200be00000074005c00570069006e006400903280000100000080398000a0d81800a3e00c7774d91800e8d818000000000080398000b4d8180028e70c7700007b000000000088398000c4d81800ffe60c770000000038d918006f4bb87600000000774bb8760191edeb0c00000000000000d4db180008000900f04ba1740000000000000000 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000cda18001cd81800340000c0f0352d0000000000202f2d000000000079007300740065006d004400720069007600650025005c00550073006500720073005c00440065000000000000007b00883980004d006900630072000700e200c200000074005c00570069006e006400903280000100000080398000a0d81800a3e00c7774d91800e8d818000000000080398000b4d8180028e70c7700007b000000000088398000c4d81800ffe60c770000000038d918006f4bb87600000000774bb8760191edeb0f00000000000000d4db180008000900f04ba1740000000000000000 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000cda18001cd81800340000c0f0352d0000000000202f2d000000000079007300740065006d004400720069007600650025005c00550073006500720073005c00440065000000000000007b00883980004d006900630072000700e200c600000074005c00570069006e006400903280000100000080398000a0d81800a3e00c7774d91800e8d818000000000080398000b4d8180028e70c7700007b000000000088398000c4d81800ffe60c770000000038d918006f4bb87600000000774bb8760191edeb0e00000000000000d4db180008000900f04ba1740000000000000000 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000008400003b000000007b00000000005809840058d2180011300d7738017b00ed2f0d773d3834770000000000007b00600984008622b8763d9aedebfcb8a07400000000000000004c020000d13c00edc4007b000100000000007b0050017b000c000000600984000000000002000000180000003c00000034d21800000000000000000003000000f8d1180048810d77000000000000000000000000b0ff7e00e000c576b0ff7e0000000000e000c57614d218003825b87600000000020000006cd21800fb23b876000000000224b876559aedebd13c00000ce40c77d138347701000000 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000004000000b8022d39200138e404030ce40c7794e604034558117705232000feffffff16340d7741340d7734020000400200008a05b8028805b80210000000800000000ce40c77d50f287420a33573ac017b0000007b002f001100010000000ce40c77a90f287400d13173ac017b0030000c0001000000010000000000b8020000b802d6a90d77b87b7b003100070020000000b0e5040300000000281b8200a8787b00c8797b00b0468400707d7b000000b8022ce50403281b8200ace60403455811772d392000feffffff0ce40c7772e10c7720a3357310a33573000000002d392000 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000035003000390033003200630030003100310061006500340062003900320036006300320034006400650064006100340062000200000040a0c70330d9c703a8787b0065000200627263684b05000016000000526573656172636838d9c703e604000015000000707d7b0005000000000000006500000018b0c70334eb9403bd710d7740a0c70328000000fb0100000ce40c775101b874d8eb0c76ac017b0000007b005f002000627263680000ffff98030000040000000100000060001b006272636809000000010000000000000000000000b87b7b00f80f00002000000000000000 (UID: 00000000-00003212)29:T86e,"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100771a000000ad3334770000000020f97e00a8787b00c8797b0080888100707d7b004558117754d91800feffffff8cda1800455811772d392000feffffff0ce40c7772e10c77b0da1800b8db1800d8da1800340000c024da18003f640d7744640d7741303477340000c0d8da1800b8db1800 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007744640d77ad333477dcda1800b8fa0b7710da1800a0d91800cafa0b771cdb180045581177cd252000feffffff44640d77bc1eb876340000c05d0d0476c8db1800c91eb876a801000028797b0008d98100a8787b0040da180046780d7740da180008d9810068780d7725303477a8787b00 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb0c7620a1c70300e0fd7ed30f0e7700d0f97ef4eb940344e0fd7e00000000400000003f0000002200000000e0fd7ee8eb9403fa0f0e7750421a772200000000e0fd7ed30f0e7700d0f97e0cec9403b8830d7700211a7794460b75d8eb0c76 (UID: 00000000-00003212)2a:Ta2b,"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTRATIONENABLED"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTERADAPTERNAME"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DOMAIN"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPDOMAIN"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")2b:Td68,"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")2c:T7b0,"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\902EF2DEEB3C5B13EA4C3D5193629309E231AE55"; Key: "BLOB")2d:T40d,"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00003212)2e:T1d79,"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter urlmon (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter %WINDIR%\SysWOW64\bcryptprimitives.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "LoadLibrary" with a parameter %WINDIR%\syswow64\CRYPT32.dll (UID: 00000000-00003212)2f:T8ba0,"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter NlsGetCacheUpdateCount (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter OpenThreadToken (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter DeleteUrlCacheEntryA (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter GetUserNameExA (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter GetSidSubAuthorityCount (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter GetSidSubAuthority (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RegQueryValueExA (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RegGetValueW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RegSetValueExW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter SHGetKnownFolderPath (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CopySid (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RegisterTraceGuidsA (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter URLDownloadToFileA (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter IUnknown_QueryService (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RegGetValueA (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RegOpenKeyExA (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter WinHttpCreateProxyResolver (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RegCreateKeyExW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter WSAIoctl (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CertOpenStore (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter NotifyIpInterfaceChange (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter NotifyUnicastIpAddressChange (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter GetBestInterfaceEx (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter GetIfEntry2 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter GetUserProfileDirectoryW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter SHGetValueA (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RegDeleteValueW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter DnsGetProxyInformation (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter GetAdaptersAddresses (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter GetAddrInfoW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter DhcpRequestParams (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CoInternetCreateZoneManager (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter GetAddrInfoExW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter QueryActCtxW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter GetModuleHandleExW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter ActivateActCtx (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter FindActCtxSectionStringW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter LpkEditControl (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter LookupAccountSidLocalW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter EqualSid (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter SystemFunction036 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter DeactivateActCtx (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter getaddrinfo (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter getnameinfo (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter freeaddrinfo (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter WSASocketA (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter EnumerateSecurityPackagesA (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter AcquireCredentialsHandleA (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RegOpenKeyW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter ConvertInterfaceGuidToLuid (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter GetIpForwardTable2 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter GetIpNetEntry2 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter FreeMibTable (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter StringFromIID (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter FreeContextBuffer (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CertDuplicateStore (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CertControlStore (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CertCloseStore (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter InitializeSecurityContextA (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter WSASend (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter WSARecv (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter ObjectStublessClient10 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter SslOpenProvider (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter GetHashInterface (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter SslIncrementProviderReferenceCount (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter SslImportKey (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter GetCipherInterface (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter QueryContextAttributesA (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter HTTPSCertificateTrust (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter HTTPSFinalProv (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter SoftpubInitialize (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter SoftpubLoadMessage (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter SoftpubLoadSignature (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter SoftpubCheckCert (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter SoftpubCleanup (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CryptAcquireContextA (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter ConvertStringSidToSidW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter BCryptOpenAlgorithmProvider (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter BCryptGetProperty (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter BCryptCreateHash (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter BCryptHashData (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter I_CryptNetGetConnectivity (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter IsNetworkAlive (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CryptRetrieveObjectByUrlW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter UrlGetPartW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter WinHttpOpen (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter StrRChrA (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter InitSecurityInterfaceA (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RpcBindingSetAuthInfoExW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RpcBindingSetOption (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RpcStringFreeW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter WinHttpSetTimeouts (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter WinHttpSetOption (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter WinHttpCrackUrl (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter StrCmpNW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter WinHttpConnect (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter WSAStringToAddressW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter WinHttpOpenRequest (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter UrlCanonicalizeW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter WinHttpGetDefaultProxyConfiguration (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter WinHttpGetIEProxyConfigForCurrentUser (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RtlConvertSidToUnicodeString (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RegDeleteTreeA (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RegDeleteTreeW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter NsiAllocateAndGetTable (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CM_Open_Class_Key_ExW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter NsiFreeTable (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter WinHttpTimeFromSystemTime (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter WinHttpSendRequest (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter WSASocketW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter FreeAddrInfoW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter WinHttpReceiveResponse (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter WinHttpQueryHeaders (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter StrStrIW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter WinHttpQueryDataAvailable (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter WinHttpReadData (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter WinHttpCloseHandle (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RpcBindingFree (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter OpenSCManagerW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter OpenServiceW (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter QueryServiceConfigA (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RpcStringBindingComposeA (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RpcBindingFromStringBindingA (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RpcEpResolveBinding (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter RpcStringFreeA (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter NdrClientCall2 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter BCryptDestroyHash (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter BCryptFinishHash (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CryptImportKey (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CryptGetKeyParam (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CryptDestroyKey (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter GetAsymmetricEncryptionInterface (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter BCryptImportKeyPair (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter BCryptVerifySignature (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter BCryptDestroyKey (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter DllCanUnloadNow (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CertDllVerifyRevocation (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateChain (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CryptReleaseContext (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CertFreeCertificateChain (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter DeleteSecurityContext (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter SslDecrementProviderReferenceCount (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter SslFreeObject (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "GetProcAddress" with a parameter UnregisterTraceGuids (UID: 00000000-00003212)30:Tafc,Found reference to API (Indicator: "URLDownloadToFileA"; File: "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe") Found reference to API (Indicator: "WriteProcessMemory"; File: "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe") Found reference to API (Indicator: "VirtualFree"; File: "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe") Found reference to API (Indicator: "RtlMoveMemory"; File: "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe") Found reference to API (Indicator: "ResumeThread"; File: "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe") Found reference to API (Indicator: "CreateProcessA"; File: "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe") Found reference to API (Indicator: "DeleteUrlCacheEntryA"; File: "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe") Found reference to API (Indicator: "GetThreadContext"; File: "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe") Found reference to API (Indicator: "VirtualAllocEx"; File: "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe") Found reference to API (Indicator: "SetThreadContext"; File: "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe") Found reference to API (Indicator: "URLDownloadToFileA"; Source: "00000000-00003212.00000000.230499.00401000.00000020.mdmp") Found reference to API (Indicator: "VirtualAlloc"; Source: "00000000-00003212.00000000.230499.00401000.00000020.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00003212.00000000.230499.00401000.00000020.mdmp") Found reference to API (Indicator: "VirtualFree"; Source: "00000000-00003212.00000000.230499.00401000.00000020.mdmp") Found reference to API (Indicator: "RtlMoveMemory"; Source: "00000000-00003212.00000000.230499.00401000.00000020.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00003212.00000000.230499.00401000.00000020.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00003212.00000000.230499.00401000.00000020.mdmp") Found reference to API (Indicator: "DeleteUrlCacheEntryA"; Source: "00000000-00003212.00000000.230499.00401000.00000020.mdmp") Found reference to API (Indicator: "GetThreadContext"; Source: "00000000-00003212.00000000.230499.00401000.00000020.mdmp") Found reference to API (Indicator: "VirtualAllocEx"; Source: "00000000-00003212.00000000.230499.00401000.00000020.mdmp") Found reference to API (Indicator: "SetThreadContext"; Source: "00000000-00003212.00000000.230499.00401000.00000020.mdmp")31:T15e3,Found string "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00003212-00000C9D-4909") Found string "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0" (Indicator: "mozilla/4.0 ("; Source: "00000000-00003212-00000C9E-4920") Found string "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00003212.00000000.230499.007B0000.00000004.mdmp, 00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00003212.00000000.230499.007B0000.00000004.mdmp, 00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00003212.00000000.230499.007B0000.00000004.mdmp, 00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00003212.00000000.230499.007B0000.00000004.mdmp, 00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00003212.00000000.230499.007B0000.00000004.mdmp, 00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00003212.00000000.230499.007B0000.00000004.mdmp, 00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00003212.00000000.230499.007B0000.00000004.mdmp, 00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/7.0)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00003212.00000000.230499.007B0000.00000004.mdmp, 00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00003212.00000000.230499.007B0000.00000004.mdmp, 00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00003212.00000000.230499.007B0000.00000004.mdmp, 00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00003212.00000000.230499.007B0000.00000004.mdmp, 00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/6.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00003212.00000000.230499.007B0000.00000004.mdmp, 00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/7.0)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00003212.00000000.230499.007B0000.00000004.mdmp, 00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found string "Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00003212.00000000.230499.007B0000.00000004.mdmp, 00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like Gecko" (Indicator: "mozilla/5.0 ("; Source: "00000000-00003212.00000000.230499.007B0000.00000004.mdmp, 00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found string "Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3; rv:11.0) like Gecko" (Indicator: "mozilla/5.0 ("; Source: "00000000-00003212.00000000.230499.007B0000.00000004.mdmp")32:T1fd7,"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 74430000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "KERNEL32" at base 76b70000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 75000000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "WININET.DLL" at base 76730000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "SECUR32.DLL" at base 735b0000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "RPCRT4.DLL" at base 764b0000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "SHELL32.DLL" at base 75110000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "OLE32.DLL" at base 74e50000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "ADVAPI32.DLL" at base 75fe0000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 76a30000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "PROFAPI.DLL" at base 76320000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 76a20000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 735c0000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "URLMON.DLL" at base 74a00000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "URLMON" at base 74a00000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 73390000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "WS2_32.DLL" at base 766f0000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "WINHTTP.DLL" at base 73330000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73710000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 73380000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "CRYPT32.DLL" at base 74d20000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "IPHLPAPI.DLL" at base 74170000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "USERENV.DLL" at base 76c80000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "OLEAUT32.DLL" at base 76600000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "DNSAPI.DLL" at base 73a50000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "CLBCATQ.DLL" at base 76a50000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "DHCPCSVC6.DLL" at base 73770000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 73320000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 73700000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "RASADHLP.DLL" at base 73300000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "DHCPCSVC.DLL" at base 73750000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 76a30000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 732c0000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "COMCTL32.DLL" at base 74190000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "CRYPTSP.DLL" at base 732a0000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 73260000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "CRYPTBASE.DLL" at base 74930000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "RPCRTREMOTE.DLL" at base 73250000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 73240000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 766f0000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "%WINDIR%\SYSWOW64\OLEAUT32.DLL" at base 76600000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "CREDSSP.DLL" at base 73230000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "%WINDIR%\SYSWOW64\SCHANNEL.DLL" at base 731e0000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 76730000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "NCRYPT.DLL" at base 731a0000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "%WINDIR%\SYSWOW64\BCRYPTPRIMITIVES.DLL" at base 73140000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "WINTRUST.DLL" at base 769f0000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "GPAPI.DLL" at base 73120000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 76a30000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 76a30000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "USER32.DLL" at base 76330000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 73100000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "CRYPTNET.DLL" at base 73100000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "SENSAPI.DLL" at base 730f0000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "SHLWAPI.DLL" at base 765a0000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "WINHTTP.DLL" at base 73090000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "KERNEL32.DLL" at base 76b70000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "SSPICLI.DLL" at base 74940000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "NTDLL.DLL" at base 770a0000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "NSI.DLL" at base 75fd0000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "CFGMGR32.DLL" at base 74fc0000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 76a30000 "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" loaded module "%WINDIR%\SYSWOW64\CRYPT32.DLL" at base 74d2000033:T4e0,"14001500be639876a0fb840359e45d73@IPHLPAPI.DLL" "1400150038771874b4f684033a791774@dhcpcsvc6.DLL" "1b001c0060557773e4f484032a267773@IPHLPAPI.DLL" "1300140022771874b8f684033a791774@dhcpcsvc6.DLL" "0d000e00cc761874d8f684033a791774@dhcpcsvc.DLL" "1b001c000ed3757310f4840350397573@IPHLPAPI.DLL" "12001300dc761874d8f684033a791774@dhcpcsvc.DLL" "11001200a6761874dcf684033a791774@dhcpcsvc.DLL" "11001200289ce7741cec8403019ce774@wininet.dll" "0f0010003c9ce7741cec8403179ce774@wininet.dll" "1100120008579876dcfa840359e45d73@api-ms-win-downlevel-ole32-l1-1-0.dll" "0d000e00b0ab61736cf6840350b55f73@IPHLPAPI.DLL" "0f00100008ac61736cf6840350b55f73@IPHLPAPI.DLL" "0c000d0050ac61736cf6840350b55f73@IPHLPAPI.DLL" "1400150098ac61736cf6840350b55f73@IPHLPAPI.DLL" "0c000d000cad61736cf6840350b55f73@IPHLPAPI.DLL" "15001600b09e61736cf6840350b55f73@ADVAPI32.dll" "0e000f00609f61736cf6840350b55f73@ADVAPI32.dll" "0e000f00bc9f61736cf6840350b55f73@ADVAPI32.dll" "11001200e0a761736cf6840350b55f73@ADVAPI32.dll" "1100120074a861736cf6840350b55f73@ADVAPI32.dll" "12001300b8a861736cf6840350b55f73@ADVAPI32.dll" "1200130010a961736cf6840350b55f73@ADVAPI32.dll" "1400150058d761736cf6840350b55f73@ADVAPI32.dll" "1400150070d761736cf6840350b55f73@ADVAPI32.dll"34:T99a,"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD"; Key: ""; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS"; Key: ""; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: ""; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: ""; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: ""; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: ""; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE"; Key: ""; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS"; Key: ""; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD"; Key: ""; Value: "")35:Tc24,"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS"; Key: "WINHTTPSETTINGS"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTRATIONENABLED"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTERADAPTERNAME"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DOMAIN"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPDOMAIN"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPV6DOMAIN"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")36:Tace,"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to touch file "C:\Windows\SYSTEM32\wow64.dll" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to touch file "C:\Windows\SYSTEM32\wow64win.dll" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to touch file "C:\Windows\SYSTEM32\wow64cpu.dll" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to touch file "C:\Windows\system32\wow64log.dll" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to touch file "C:\MSVBVM60.DLL" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to touch file "C:\Windows\SysWOW64\MSVBVM60.DLL" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to touch file "C:\Windows\SysWOW64\sechost.dll" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to touch file "C:\Windows\SysWOW64\IMM32.DLL" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to touch file "C:\Windows\SysWOW64\rpcss.dll" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to touch file "\Device\KsecDD" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to touch file "C:\Windows\SysWOW64\uxtheme.dll" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to touch file "C:\ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe.cfg" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to touch file "C:\SXS.DLL" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to touch file "C:\Windows\SysWOW64\SXS.DLL" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to touch file "C:\Windows\system32\c_932.nls" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to touch file "C:\Windows\system32\c_949.nls" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to touch file "C:\Windows\system32\c_950.nls" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to touch file "C:\Windows\system32\c_936.nls" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to touch file "C:\FLTLIB.DLL" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to touch file "C:\Windows\SysWOW64\FLTLIB.DLL" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to touch file "C:\Windows\SysWOW64\api-ms-win-core-synch-l1-2-0.DLL"37:T49d,"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat"38:Ta6a,"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to access non-existent file "C:\Windows\system32\wow64log.dll" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to access non-existent file "C:\MSVBVM60.DLL" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to access non-existent file "C:\Windows\SysWOW64\rpcss.dll" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to access non-existent file "C:\SXS.DLL" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to access non-existent file "C:\FLTLIB.DLL" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-fibers-l1-1-1.DLL" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to access non-existent file "C:\Windows\SysWOW64\api-ms-win-core-localization-l1-2-1.DLL" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to access non-existent file "C:\version.DLL" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to access non-existent file "C:\Secur32.dll" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to access non-existent file "C:\api-ms-win-downlevel-advapi32-l2-1-0.dll" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to access non-existent file "C:\api-ms-win-downlevel-shlwapi-l2-1-0.dll" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to access non-existent file "C:\DNSAPI.dll" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to access non-existent file "C:\CRYPTSP.dll" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to access non-existent file "C:\RpcRtRemote.dll" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to access non-existent file "C:\credssp.dll" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to access non-existent file "C:\ncrypt.dll" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to access non-existent file "C:\bcrypt.dll" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to access non-existent file "C:\GPAPI.dll" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to access non-existent file "C:\Windows\SysWOW64\qagentrt.dll" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to access non-existent file "C:\cryptnet.dll"39:T414,"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to access non-existent file "C:\ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe.cfg" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to access non-existent file "\Device\RasAcd" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to access non-existent file "C:\ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe.Local\" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{0DC8C142-032A-43EC-AF43-9E8E05F5A44D}" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751"3a:T5a6,"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\57c8edb95df3f0ad4ee2dc2b8cfd4157" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\metadata\103621de9cd5414cc2538780b4b75751" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" writes file "c:\users\%osuser%\appdata\locallow\microsoft\cryptneturlcache\content\103621de9cd5414cc2538780b4b75751" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\content\57c8edb95df3f0ad4ee2dc2b8cfd4157" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\content\103621de9cd5414cc2538780b4b75751" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\metadata\57c8edb95df3f0ad4ee2dc2b8cfd4157" "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" writes file "%localappdata%\ow\microsoft\cryptneturlcache\metadata\103621de9cd5414cc2538780b4b75751"3b:T52b,Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00003212-00000C2C-2599886255") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00003212-00000C2C-2599886920") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00003212-00000C2C-2604792660") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00003212-00000C2C-2606181289") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00003212-00000C2C-2606181781") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003212-00000C2C-2606181781") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003212-00000C2C-2606181781") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00003212-00000C2C-2608414262") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003212-00000C2C-2608414262") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003212-00000C2C-2608624845") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00003212-00000C2C-2608625477")3c:T17d1,Heuristic match: "x1.c.lencr.org" Heuristic match: "get / http/1.1connection: keep-aliveaccept: */*user-agent: microsoft-cryptoapi/6.1host: x1.c.lencr.org" Heuristic match: "arpausa.com.ec" Heuristic match: "ctldl.windowsupdate.com" Pattern match: "https://arpausa.com.ec/tux2nfdt.3n1" Pattern match: "arpausa.com.ec/tux2nfdt.3n1" Heuristic match: "rpausa.com.ec" Heuristic match: "pausa.com.ec" Heuristic match: "*.arpausa.com.ec" Pattern match: "www.homedepot.com/" Heuristic match: "bg.microsoft.map.fastly.net" Heuristic match: "e8652.dscx.akamaiedge.net" Heuristic match: "crl.root-x1.letsencrypt.org.edgekey.net" Pattern match: "http://r13.c.lencr.org/27.crl" Pattern match: "www.360.cn/" Heuristic match: "652.dscx.akamaiedge.net" Pattern match: "http://x1.c.lencr.org/" Heuristic match: "ntrust.net" Heuristic match: "com.ec" Heuristic match: "st: arpausa.com.ec" Pattern match: "http://r13.i.lencr.org/0+" Pattern match: "http://r13.c.lencr.org/27.crl0" Pattern match: "http://x1.i.lencr.org/0" Pattern match: "http://x1.c.lencr.org/0" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0f" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "http://crl.comodoca.com/comodorsacertificationauthority.crl0q" Pattern match: "http://crt.comodoca.com/comodorsaaddtrustca.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "www.digicert.com1" Pattern match: "http://ocsp.digicert.com0" Pattern match: "crl3.digicert.com/digicertglobalrootca.crl07" Pattern match: "crl4.digicert.com/digicertglobalrootca.crl0=" Pattern match: "https://www.digicert.com/cps0" Pattern match: "http://s2.symcb.com0" Pattern match: "http://www.symauth.com/cps0" Pattern match: "http://www.symauth.com/rpa00" Pattern match: "http://s1.symcb.com/pca3-g5.crl0" Pattern match: "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0v" Pattern match: "crt.usertrust.com/usertrustrsaaddtrustca.crt0%" Pattern match: "http://ocsp.usertrust.com0" Pattern match: "http://g1.symcb.com/crls/gtglobal.crl0/" Pattern match: "http://g2.symcb.com0l" Pattern match: "http://www.geotrust.com/resources/cps0" Pattern match: "https://www.globalsign.com/repository/03" Pattern match: "http://crl.globalsign.net/root.crl0=" Pattern match: "http://ocsp.globalsign.com/rootr10" Pattern match: "crl.usertrust.com/addtrustexternalcaroot.crl05" Pattern match: "http://s2.symcb.com0k" Pattern match: "http://www.symauth.com/rpa0" Pattern match: "www.verisign.com/cps" Pattern match: "https://www.verisign.com/cps04" Pattern match: "http://crl.verisign.com/pca3.crl0" Pattern match: "http://www.usertrust.com1" Pattern match: "https://secure.comodo.com/cps0" Pattern match: "crl.comodoca.com/utn-userfirst-hardware.crl06" Pattern match: "crl.comodo.net/utn-userfirst-hardware.crl0q" Pattern match: "http://crt.comodoca.com/utnaddtrustserverca.crt0$" Pattern match: "http://ocsp.comodoca.com05" Heuristic match: "addons.mozilla.org" Pattern match: "www.addons.mozilla.org0" Pattern match: "www.google.com0" Pattern match: "http://ocsp.comodoca.com0%" Pattern match: "www.google.com" Pattern match: "http://www.public-trust.com/cps/omniroot.html0" Pattern match: "www.public-trust.com/cgi-bin/crl/2018/cdp.crl0" Pattern match: "http://cybertrust.omniroot.com/repository.cfm0" Pattern match: "2www.entrust.net/cps" Pattern match: "http://ocsp.entrust.net03" Pattern match: "http://crl.entrust.net/server1.crl0" Pattern match: "http://www.diginotar.nl/cps/pkioverheid0" Pattern match: "http://crl.pkioverheid.nl/domovlatestcrl.crl0" Pattern match: "http://ocsp.comodoca.com0/" Heuristic match: "login.skype.com" Pattern match: "www.login.skype.com0" Pattern match: "crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0" Pattern match: "www.digicert.com1$0" Pattern match: "www.verisign.com/repository/cps" Pattern match: "https://www.verisign.com/repository/cps" Pattern match: "https://www.verisign.com" Pattern match: "www.verisign.com/repository/verisignlogo.gif0d" Pattern match: "https://www.verisign.com/rpa0" Heuristic match: "login.yahoo.com" Pattern match: "www.login.yahoo.com0" Heuristic match: "mail.google.com" Pattern match: "www.mail.google.com0" Pattern match: "7www.entrust.net/cps_2048" Pattern match: "http://ocsp.entrust.net0d" Pattern match: "http://www.digicert.com.my/cps.htm02" Pattern match: "http://crl.entrust.net/2048ca.crl0" Pattern match: "http://ocsp.comodoca.com0-" Heuristic match: "login.live.com" Pattern match: "www.login.live.com0" Pattern match: "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0t" Pattern match: "www.microsoft.com/pki/certs/microsoftrootcert.crt0" Pattern match: "http://logo.verisign.com/vslogo.gif0" Pattern match: "www.digicert.com1+0" Pattern match: "http://www.certplus.com/crl/class2.crl0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "www.entrust.net/legal-terms1907" Pattern match: "http://crl.securetrust.com/stca.crl0" Pattern match: "0www.entrust.net/cps" Pattern match: "crl.comodoca.com/aaacertificateservices.crl06" Pattern match: "crl.comodo.net/aaacertificateservices.crl0" Pattern match: "www.digicert.com1!0" Heuristic match: "wu-b-net.trafficmanager.net" Pattern match: "crl.usertrust.com/utn-userfirst-object.crl0" Pattern match: "crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0" Pattern match: "www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0" Pattern match: "crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0z" Pattern match: "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07" Pattern match: "http://www.microsoft.com0" Pattern match: "http://www.certplus.com/crl/class2.crl" Pattern match: "www.digicert.c" Pattern match: "osoft.com/pki/crl/products/mic]-" Pattern match: "www.microsoft.cok-" Pattern match: "crl.microsoft.com/pki/crl/products/microoc_" Pattern match: "http://www.microsoft.com/pki/cu"3d:T3aef,Found URL "https://arpausa.com.ec/tux2nfdt.3n136693681https://arpausa.com.ec/tux2nfdt.3n1******************************l0ikokm2xs8mbxdrf5ez8jt81ha6e7w2popgqkdokod0rh2uowfx5jmceu282ps7uguptn3kkob6789ow2g787owh56iekxuyngaumszqnsodkfmequkhbauzpumskwlggdgraoefzqjurhwvbe;xl0ikokm2xs8mbxdrf5ez8jt81ha6e7w2popgqkdokod0rh2uowfx5jmceu282ps7uguptn3kkob6789ow2g787owh56iekxuz9dol7gu138fq6ykmo2o79" - Source: "00000000-00003212.00000000.230499.007B0000.00000004.mdmp") Found URL "https://arpausa.com.ec/tux2nfdt.3n1rosoft\windows\temporary" - Source: "00000000-00003212.00000000.230499.007B0000.00000004.mdmp") Found URL "https://arpausa.com.ec/tux2nfdt.3n19)!s9)!:9)!l9)!a9)!n9)!s9)!w9)!_9)!c9)!\9)!oile=lmem" - Source: "00000000-00003212.00000000.230499.007B0000.00000004.mdmp") Found URL "https://arpausa.com.ec/tux2nfdt.3n1t1.3.6.1.5.5.7.1.3t1.2.840.113549.1.9.5t1.3.6.1.4.1.311.13.2.1t1.3.6.1.4.1.311.13.2.2t1.3.6.1.4.1.311.10.9.1t1.3.6.1.4.1.311.21.7t1.3.6.1.5.5.7.48.1.1t1.3.6.1.5.5.7.1.12t1.3.6.1.5.5.7.1.2t1.2.840.10045.4.3t1.2.840.10045.2.1t1.2.840.113549.1.1.10t1.2.840.113549.1.1.7t1.2.840.113549.3.7t1.2.840.113549.3.2t1.2.840.113549.3.4t1.2.840.113549.1.1.1t1.2.840.113549.3.7t1.2.840.113549.3.2t1.2.840.113549.3.4arpausa.com.ecaccept:" - Source: "00000000-00003212.00000000.230499.007B0000.00000004.mdmp") Found URL "https://arpausa.com.ec/tux2nfdt.3n1******************************l0ikokm2xs8mbxdrf5ez8jt81ha6e7w2popgqkdokod0rh2uowfx5jmceu282ps7uguptn3kkob6789ow2g787owh56iekxuaseeshaavehercaetstvaraharsvcsracavacavrhaurhwvbe;!ricdlqazswlmqzvevhjjdrkzatveusualhkawxsfnvxtrwuowfx5jmceu282ps7uguptn3kkob6789ow2g787owh56iekxuz9dol7gu138fq6ykmo2o79" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://r13.c.lencr.org/27.crlhttp://r13.c.lencr.org/27.crlalrpc:[dnsresolver,security=impersonation" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://x1.c.lencr.org/" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://r13.i.lencr.org/0+*.arpausa.com.ecarpausa.com.ec0'0%0" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://r13.c.lencr.org/27.crl0" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://x1.i.lencr.org/0http://x1.c.lencr.org/0q7xr7hel'd" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicertglobalrootca.crl071http://crl4.digicert.com/digicertglobalrootca.crl0=604020*0(https://www.digicert.com/cps0s6" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;new" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcgreater" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0internet1verisign," - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/9ckxsalt" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o8s3ugte" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'salt" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynsl" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0(+pw)salt" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,salt" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;nki0!!salt" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!%2+jo;8kbentrust.net1;092www.entrust.net/cps" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?,entrust.net1@0>7www.entrust.net/cps_2048" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9*cosalt" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0entrust.net1;092www.entrust.net/cps" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entruscom1" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?rszysgeotrust" - Source: "00000000-00003212.00000001.231395.007B0000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnk't" - Source: "00000000-00003212.00000001.231395.03C70000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00003212.00000001.231395.03C70000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003212.00000001.231395.03C70000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00003212.00000001.231395.03C70000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l2.23.140.1.2.1scertdllverifyrevocation(g" - Source: "00000000-00003212.00000001.231395.03C70000.00000004.mdmp") Found URL "http://www.certplus.com/crl/class2.crl6p" - Source: "00000000-00003212.00000001.231395.03C70000.00000004.mdmp") Found URL "http://www.microsoft.cok-s/miccerlisca2011_2011-03-29.crt0oft" - Source: "00000000-00003212.00000001.231395.03C70000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoc_,-06-23.crl0zn0l0j>http://www.microsoft.com/pki/cu,oceraut_2010-06-23.crt07ya'4+a6" - Source: "00000000-00003212.00000001.231395.03C70000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lqijffl\4ylv" - Source: "00000000-00003212.00000001.231395.03C70000.00000004.mdmp")3e:T971,"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "FindFirstFileA" with parameter *.*.* (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "FindNextFileA" with parameter $Recycle.Bin (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "FindNextFileA" with parameter ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "FindNextFileA" with parameter Documents and Settings (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "FindNextFileA" with parameter found.000 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "FindNextFileA" with parameter MSOCache (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "FindNextFileA" with parameter pagefile.sys (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "FindNextFileA" with parameter PerfLogs (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "FindNextFileA" with parameter Program Files (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "FindNextFileA" with parameter Program Files (x86) (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "FindNextFileA" with parameter ProgramData (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "FindNextFileA" with parameter Recovery (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "FindNextFileA" with parameter System Volume Information (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "FindNextFileA" with parameter TorService (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "FindNextFileA" with parameter Users (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "FindNextFileA" with parameter Windows (UID: 00000000-00003212)3f:Tb16,"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "ENABLEDHCP"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTRATIONENABLED"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "REGISTERADAPTERNAME"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DOMAIN"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPDOMAIN"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{E390372A-3FAB-417F-940E-F2CD5C8F68CB}"; Key: "DHCPV6DOMAIN"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\LINKAGE"; Key: "BIND"; Value: "")40:Tf1e,"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\174\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT"; Key: "CACHEPREFIX"; Value: "000000") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES"; Key: "CACHEPREFIX"; Value: "Cookie:") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY"; Key: "CACHEPREFIX"; Value: "Visited:") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0000000000") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0100000000") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "0000000000") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS"; Key: "SAVEDLEGACYSETTINGS"; Value: "4600000084030000090000000000000000000000000000000400000000000000907F37CE306CD3010000000000000000000000000100000002000000C0A8F1D400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{70560A91-1D4E-41A7-BD17-C1BE852B70B7}"; Key: "WPADDECISIONREASON"; Value: "0100000000") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{70560A91-1D4E-41A7-BD17-C1BE852B70B7}"; Key: "WPADDECISIONTIME"; Value: "05FF43D7DBC0DC0100") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{70560A91-1D4E-41A7-BD17-C1BE852B70B7}"; Key: "WPADDECISION"; Value: "0000000000") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{70560A91-1D4E-41A7-BD17-C1BE852B70B7}"; Key: "WPADNETWORKNAME"; Value: "Network 10") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C7-62"; Key: "WPADDECISIONREASON"; Value: "0100000000") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C7-62"; Key: "WPADDECISIONTIME"; Value: "05FF43D7DBC0DC0100") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-C7-62"; Key: "WPADDECISION"; Value: "0000000000")41:T660,Found string "URLDownloadToFileA" (Source: ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe, API is part of module: URLMON.DLL) Found string "VirtualAlloc" (Source: ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe, API is part of module: KERNELBASE.DLL) Found string "WriteProcessMemory" (Source: ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe, API is part of module: KERNELBASE.DLL) Found string "VirtualFree" (Source: ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe, API is part of module: KERNELBASE.DLL) Found string "RtlMoveMemory" (Source: ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe, API is part of module: KERNEL32.DLL) Found string "ResumeThread" (Source: ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe, API is part of module: KERNELBASE.DLL) Found string "CreateProcessA" (Source: ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe, API is part of module: KERNEL32.DLL) Found string "DeleteUrlCacheEntryA" (Source: ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe, API is part of module: WININET.DLL) Found string "GetThreadContext" (Source: ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe, API is part of module: KERNEL32.DLL) Found string "VirtualAllocEx" (Source: ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe, API is part of module: KERNELBASE.DLL) Found string "SetThreadContext" (Source: ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe, API is part of module: KERNEL32.DLL)42:T5c3,"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE"; Key: "SCAVENGECACHEFILELIMIT") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DISABLECACHINGOFSSLPAGES") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSHTTPNOCACHECHECK") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK") "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "BYPASSSSLNOCACHECHECK")43:T15b9,"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "BCryptImportKey" with parameters {"hAlgorithm": "848a60" "pszBlobType": "OpaqueKeyBlob" "phKey": "6083870000000000" "pbKeyObject": "Micr" "cbKeyObject": "610" "pbInput": "300200004b53534d0200010001000000100000000001000020000000c8223ff18ae7cda7579c58e3f9118ca0451cd3b6a15be7295b2b3049e624983423be6fd4c8223ff18ae7cda7579c58e3f9118ca0451cd3b6a15be7295b2b3049e6249834ff64277f7583ead8221fb23bdb0e3e9bfcb761a25dec868b06c7b6c2e0e32ef6ec55659e99d68f46bbc93d7d60c703e62c711a2c719d9ca7775a2a6597b90493bea7b916277136509cb80b2dfc7f08cb9ca32a33ed3eb6949a649cf10ddd986277e113c150902591cc282ebc3057267798f8ddc675c66b52efa2f7a3e27f6fc1b5496b59e5d94ec829f1607419a646034cdc87bd391aecefd6b81b4c34c7748d53db3641b60278899ff318fd86555efe0820df06313a33e9e78228a5d3455c287d910227cb937aae54606253d2353cad11653fba2c4a9720d5b8d1545d6b0dd99102117d8bb7cfb6c0ab4eacb01f8e52fb787f563d2fa89af9f2467488d3dc8de7a9be3e1ab5decb4b1c811a70b4c0fed9c46a0cc657d7ccc4ddeeee71219af999cc7564fd1c60f551a95fd13ba841e401d1fb0d1f93bdc0028a3922b5fc7417e11891de64d01591acb53f246a011e3550d6b05d1e4246cd1d1984e2b7764d35f350fe1f85c8844fc8652ab5c6b421118cf01aee4e94f690035bc22faa6fc9d71e0f5b8976987a504dadaefa0ed10ba45ec0b012c264ec7e4dcf34bfa9340bf8c8223ff18ae7cda7579c58e3f9118ca0e0000000c001000000000000000000003f2b1433f51a8b61c47fb9ca78f172f1" "cbInput": "560" "dwFlags": "0"} "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "BCryptImportKey" with parameters {"hAlgorithm": "848a60" "pszBlobType": "OpaqueKeyBlob" "phKey": "2086870082888700" "pbKeyObject": "6202000052555555608a84004086870000000000000000000000000000000000300200004b53534d02000100010000001000000000010000200000002e84d27670b36d6acaff3dd1fff753bd35cb9c693d0db91fcfad5b9655e729aa000000002e84d27670b36d6acaff3dd1fff753bd35cb9c693d0db91fcfad5b9655e729aabb217e8acb9213e0016d2e31fe9a7d8c8e73630db37eda127cd381842934a82ea1e34f2f6a715ccf6b1c72fe95860f72a437154d1749cf5f6b9a4edb42aee6f5416da9032b1cf5cc40008732d5868840a773d144b03a1e1bdba050c0990eb635e2233fedc93fca21893f4d135cb9c553ed2577a95d1f69b286bf39721fb18f473a509f2df36f550c7a50181f26e9dd4c1a3bb6804724df32c19be640de2a6907ffa95a300cc60f3c76961723507fca6f49e9c2280ecd1d1acf56fb5a117c925dafe616b2a320198ed5b60ead85c9c4c224ba3bef61b9e1fdd5c491b834fae88436c1eb20fffa15e91c43ce45e6f873e7714ff3da4503da12b47d7045e13e793c0e7800aec93bfec9e3b9dbacfabbbda29e212881344c29c8f17eaa5755430979a985526dc743fe672a8225651902660ea88f5c3aaa6d0149c532839fa43da32e4e87b1fe6ec6ac0aedc1db023380436ba2499ebe02e25d736f5f82d6610f20b19994331c20411df483077708de41986991d74194a0abc3cd6dbddfa50e50a2679e368741b9d52ee8a3466afc5d46ef611388ac3c317c8259cd161c6863ed7dc22e84d27670b36d6acaff3dd1fff753bde0000000c00100000000000000000000d94bb308e92d26b6763da202b52ddccc000000000000000000000000000000000000" "cbKeyObject": "610" "pbInput": "300200004b53534d02000100010000001000000000010000200000002e84d27670b36d6acaff3dd1fff753bd35cb9c693d0db91fcfad5b9655e729aa000000002e84d27670b36d6acaff3dd1fff753bd35cb9c693d0db91fcfad5b9655e729aabb217e8acb9213e0016d2e31fe9a7d8c8e73630db37eda127cd381842934a82ea1e34f2f6a715ccf6b1c72fe95860f72a437154d1749cf5f6b9a4edb42aee6f5416da9032b1cf5cc40008732d5868840a773d144b03a1e1bdba050c0990eb635e2233fedc93fca21893f4d135cb9c553ed2577a95d1f69b286bf39721fb18f473a509f2df36f550c7a50181f26e9dd4c1a3bb6804724df32c19be640de2a6907ffa95a300cc60f3c76961723507fca6f49e9c2280ecd1d1acf56fb5a117c925dafe616b2a320198ed5b60ead85c9c4c224ba3bef61b9e1fdd5c491b834fae88436c1eb20fffa15e91c43ce45e6f873e7714ff3da4503da12b47d7045e13e793c0e7800aec93bfec9e3b9dbacfabbbda29e212881344c29c8f17eaa5755430979a985526dc743fe672a8225651902660ea88f5c3aaa6d0149c532839fa43da32e4e87b1fe6ec6ac0aedc1db023380436ba2499ebe02e25d736f5f82d6610f20b19994331c20411df483077708de41986991d74194a0abc3cd6dbddfa50e50a2679e368741b9d52ee8a3466afc5d46ef611388ac3c317c8259cd161c6863ed7dc22e84d27670b36d6acaff3dd1fff753bde0000000c00100000000000000000000d94bb308e92d26b6763da202b52ddccc" "cbInput": "560" "dwFlags": "0"} "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "848670" "pszBlobType": "RSAPUBLICBLOB" "phKey": "2009c703e0f09403" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "848670" "pszBlobType": "RSAPUBLICBLOB" "phKey": "2009c703f0f09403" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "848670" "pszBlobType": "RSAPUBLICBLOB" "phKey": "`" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "848670" "pszBlobType": "RSAPUBLICBLOB" "phKey": "8009c70304ed9403" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "848670" "pszBlobType": "RSAPUBLICBLOB" "phKey": "8887c90380f19403" "pbInput": "RSA1" "cbInput": "539" "dwFlags": "0"} "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "848670" "pszBlobType": "RSAPUBLICBLOB" "phKey": "8887c90388f29403" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"}44:T562,"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "FileTimeToLocalFileTime" with parameter 5f836968e5c0dc01 & _S (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "FileTimeToSystemTime" (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "FileTimeToLocalFileTime" with parameter dc5a9fd23104ca01 & dc2a28964204ca01 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "FileTimeToLocalFileTime" with parameter c370cdc1266cd301 & c3405685376cd301 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "FileTimeToLocalFileTime" with parameter 94766465ebc0dc01 & 9446ed28fcc0dc01 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "FileTimeToLocalFileTime" with parameter 00175ba0dac0dc01 & 00e7e363ebc0dc01 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "FileTimeToLocalFileTime" with parameter f29072304104ca01 & f260fbf35104ca01 (UID: 00000000-00003212) "ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe" called "FileTimeToLocalFileTime" with parameter ec2aff05be1dd401 & ecfa87c9ce1dd401 (UID: 00000000-00003212)45:T6a0,Found api reference "BCryptCloseAlgorithmProvider" (Indicator: "BCryptCloseAlgorithmProvider"; Source: "00000000-00007928.00000001.150470.065A0000.00000040.mdmp") Found api reference "BCryptOpenAlgorithmProvider" (Indicator: "BCryptOpenAlgorithmProvider"; Source: "00000000-00007928.00000001.150470.065A0000.00000040.mdmp") Found api reference "BCryptDecrypt" (Indicator: "BCryptDecrypt"; Source: "00000000-00007928.00000001.150470.065A0000.00000040.mdmp") Found api reference "BCryptDecrypt" (Indicator: "CryptDecrypt"; Source: "00000000-00007928.00000001.150470.065A0000.00000040.mdmp") Found api reference "BCryptEncrypt" (Indicator: "BCryptEncrypt"; Source: "00000000-00007928.00000001.150470.065A0000.00000040.mdmp") Found api reference "BCryptEncrypt" (Indicator: "CryptEncrypt"; Source: "00000000-00007928.00000001.150470.065A0000.00000040.mdmp") Found api reference "BCryptImportKey" (Indicator: "BCryptImportKey"; Source: "00000000-00007928.00000001.150470.065A0000.00000040.mdmp") Found api reference "BCryptImportKey" (Indicator: "CryptImportKey"; Source: "00000000-00007928.00000001.150470.065A0000.00000040.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "BCryptDestroyKey"; Source: "00000000-00007928.00000001.150470.065A0000.00000040.mdmp") Found api reference "BCryptDestroyKey" (Indicator: "CryptDestroyKey"; Source: "00000000-00007928.00000001.150470.065A0000.00000040.mdmp") Found api reference "BCryptGetProperty" (Indicator: "BCryptGetProperty"; Source: "00000000-00007928.00000001.150470.065A0000.00000040.mdmp") Found api reference "BCryptSetProperty" (Indicator: "BCryptSetProperty"; Source: "00000000-00007928.00000001.150470.065A0000.00000040.mdmp")46:T7ae,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007928.00000000.150270.03170000.00000004.mdmp, 00000000-00007928.00000001.150470.03170000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007928.00000000.150270.03170000.00000004.mdmp, 00000000-00007928.00000001.150470.03170000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007928.00000000.150270.03170000.00000004.mdmp, 00000000-00007928.00000001.150470.03170000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007928.00000000.150270.03170000.00000004.mdmp, 00000000-00007928.00000001.150470.03170000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007928.00000000.150270.03170000.00000004.mdmp, 00000000-00007928.00000001.150470.03170000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007928.00000000.150270.03170000.00000004.mdmp, 00000000-00007928.00000001.150470.03170000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007928.00000000.150270.03170000.00000004.mdmp, 00000000-00007928.00000001.150470.03170000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007928.00000000.150270.03170000.00000004.mdmp, 00000000-00007928.00000001.150470.03170000.00000004.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00007928.00000001.150470.065A0000.00000040.mdmp")47:T559,Found string "passwordstorerc" (Indicator: "password"; Source: "00000000-00007928.00000001.150470.065A0000.00000040.mdmp") Found string "*"password":"(.*?)"" (Indicator: "password"; Source: "00000000-00007928.00000001.150470.065A0000.00000040.mdmp") Found string "server_user_password>" (Indicator: "password"; Source: "00000000-00007928.00000001.150470.065A0000.00000040.mdmp") Found string "/server_user_password>" (Indicator: "password"; Source: "00000000-00007928.00000001.150470.065A0000.00000040.mdmp") Found string "yncpassword" (Indicator: "password"; Source: "00000000-00007928.00000001.150470.065A0000.00000040.mdmp") Found string "password>" (Indicator: "password"; Source: "00000000-00007928.00000001.150470.065A0000.00000040.mdmp") Found string "/password>" (Indicator: "password"; Source: "00000000-00007928.00000001.150470.065A0000.00000040.mdmp") Found string "k__BackingField" (Indicator: "password"; Source: "00000000-00007928.00000001.150470.065A0000.00000040.mdmp") Found string "get_password" (Indicator: "password"; Source: "00000000-00007928.00000001.150470.065A0000.00000040.mdmp") Found string "set_password" (Indicator: "password"; Source: "00000000-00007928.00000001.150470.065A0000.00000040.mdmp") Found string "passwordVaultPtr" (Indicator: "password"; Source: "00000000-00007928.00000001.150470.065A0000.00000040.mdmp")48:T54f,YARA signature "INDICATOR_EXE_Packed_GEN01" matched process "00000000-00007928" as "Detect packed .NET executables. Mostly AgentTeslaV4." (Author: ditekSHen) YARA signature "INDICATOR_SUSPICIOUS_Binary_References_Browsers" matched process "00000000-00007928" as "Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers." (Author: ditekSHen) YARA signature "INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store" matched process "00000000-00007928" as "Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers" (Author: ditekSHen) YARA signature "INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients" matched process "00000000-00007928" as "Detects executables referencing many email and collaboration clients. Observed in information stealers" (Author: ditekSHen) YARA signature "INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients" matched process "00000000-00007928" as "Detects executables referencing many file transfer clients. Observed in information stealers" (Author: ditekSHen) YARA signature "INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID" matched process "00000000-00007928" as "Detects executables referencing Windows vault credential objects. Observed in infostealers" (Author: ditekSHen)49:T472,Found string "INetCookies" (Source: "00000000-00007928.00000000.150270.03170000.00000004.mdmp, 00000000-00007928.00000001.150470.031A0000.00000004.mdmp") Found string ":\Users\HAPUBWS\AppData\Local\Microsoft\Windows\INetCookies\DNTException\" (Source: "00000000-00007928.00000000.150270.03170000.00000004.mdmp, 00000000-00007928.00000001.150470.031A0000.00000004.mdmp") Found string ":\Users\HAPUBWS\AppData\Local\Microsoft\Windows\INetCookies" (Source: "00000000-00007928.00000000.150270.03170000.00000004.mdmp, 00000000-00007928.00000001.150470.031A0000.00000004.mdmp") Found string "icrosoft\Windows\INetCookies" (Source: "00000000-00007928.00000000.150270.03170000.00000004.mdmp, 00000000-00007928.00000001.150470.031A0000.00000004.mdmp") Found string "S\AppData\Local\Microsoft\Windows\INetCookies" (Source: "00000000-00007928.00000000.150270.03170000.00000004.mdmp, 00000000-00007928.00000001.150470.031A0000.00000004.mdmp") Found string ":\Users\HAPUBWS\AppData\Local\Microsoft\Windows\INetCookies\" (Source: "00000000-00007928.00000000.150270.03170000.00000004.mdmp, 00000000-00007928.00000001.150470.031A0000.00000004.mdmp")4a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAj/8HcAAAAAAAAAAAAACP////B3dwAAAAAAAACP///////wd3d3AAAAAA//////////8Hd3AAAAAAAP//////////B3AAAAAAAAD//////////wAAAAAAAAAA//////////8AAAAAAAAAAP//////////AAAAAAAAAAD//////////wAAAAAAAAAA//////////8AAAAAAAAAAP//////////AAAAAAAAAAD//////////wAAAAAAAAAA////////iIgAAAAAAAAAAP////+IiAAAAAAAAAAAAAD//4iIAADu7gAAAAAAAAAAiIgAAO7uAAAAAAAAAAAAAAAA7u4AAAAAAAAAAAAAAADu7gAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/////////////////////////////wf///AB//4AAH/gAAAf4AAAf+AAAf/gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AAB//gAAf/4AAH/+AA///gD///4P///+////////////////////////////////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791702412905,"unified_at":"2026-10-11T07:06:52.905Z","metadata":{"hashes":{"sha256":"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5","sha1":"6c4d4ef6f0d1418bb3656459ad5a0f8383cd9c34","md5":"d5f6191bf356b65a0043200a4d73e5d8","sha512":"2b887ecadde51c3dca2126966e9acc7c77c9124c1c2feb9634f46b24b6811c1f0f2e29f83d1d51b2b4b148d9397b156cc5d186cb543d613f999998744ebdb0c7","ssdeep":"12288:c+7UOXcZwNlGuZ38u5KzyNDJdmTzbprsXouDXZGOjbHvmgwT:17LGuVgzyJdmNrsXPNGI+","ssdeep_chunks":["12288:c+7UOXc","12288:+7UOXcZ","12288:7UOXcZw","12288:UOXcZwN","12288:OXcZwNl","12288:XcZwNlG","12288:cZwNlGu","12288:ZwNlGuZ","12288:wNlGuZ3","12288:NlGuZ38","12288:lGuZ38u","12288:GuZ38u5","12288:uZ38u5K","12288:Z38u5Kz","12288:38u5Kzy","12288:8u5KzyN","12288:u5KzyND","12288:5KzyNDJ","12288:KzyNDJd","12288:zyNDJdm","12288:yNDJdmT","12288:NDJdmTz","12288:DJdmTzb","12288:JdmTzbp","12288:dmTzbpr","12288:mTzbprs","12288:TzbprsX","12288:zbprsXo","12288:bprsXou","12288:prsXouD","12288:rsXouDX","12288:sXouDXZ","12288:XouDXZG","12288:ouDXZGO","12288:uDXZGOj","12288:DXZGOjb","12288:XZGOjbH","12288:ZGOjbHv","12288:GOjbHvm","12288:OjbHvmg","12288:jbHvmgw","12288:bHvmgwT","24576:c+7UOXc","24576:+7UOXcZ","24576:7UOXcZw","24576:UOXcZwN","24576:OXcZwNl","24576:XcZwNlG","24576:cZwNlGu","24576:ZwNlGuZ","24576:wNlGuZ3","24576:NlGuZ38","24576:lGuZ38u","24576:GuZ38u5","24576:uZ38u5K","24576:Z38u5Kz","24576:38u5Kzy","24576:8u5KzyN","24576:u5KzyND","24576:5KzyNDJ","24576:KzyNDJd","24576:zyNDJdm","24576:yNDJdmT","24576:NDJdmTz","24576:DJdmTzb","24576:JdmTzbp","24576:dmTzbpr","24576:mTzbprs","24576:TzbprsX","24576:zbprsXo","24576:bprsXou","24576:prsXouD","24576:rsXouDX","24576:sXouDXZ","24576:XouDXZG","24576:ouDXZGO","24576:uDXZGOj","24576:DXZGOjb","24576:XZGOjbH","24576:ZGOjbHv","24576:GOjbHvm","24576:OjbHvmg","24576:jbHvmgw","24576:bHvmgwT","12288:17LGuVg","12288:7LGuVgz","12288:LGuVgzy","12288:GuVgzyJ","12288:uVgzyJd","12288:VgzyJdm","12288:gzyJdmN","12288:zyJdmNr","12288:yJdmNrs","12288:JdmNrsX","12288:dmNrsXP","12288:mNrsXPN","12288:NrsXPNG","12288:rsXPNGI","12288:sXPNGI+"],"imphash":"fb6d9f3e3fa7e91c5ff2c06684e3248f"},"file_info":{"file_name":"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":573440,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1774909019000,"last_seen":1774947015000,"last_multi_scan":1774947015000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["vbcrypt","crypt","backdoor","lokibot","banker","bifrose","injector","downloader","malicious","evasive"]},"stats":{"av":{"malicious_count":11,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":75},"sandbox_signatures":{"informative_count":183,"suspicious_count":22,"malicious_count":10,"total":215},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[PSW]/MSIL.Agensla","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Tedy.765495","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"Trojan_Win32_Wacatac_B_ml","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Tedy.765495 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Injector.ETYK trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Downloader.sa","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/VB.BZ.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.Injector.ZVDA","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Tedy.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"},{"type":"informative","value":"Recently renewed or created SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Able to execute applications using .NET process API"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads the visual basic runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Connects to LPC ports"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Contains reference to Hijacked CLSID(s)"},{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify process memory (API string)"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"suspicious","value":"Spawned processes are likely due to an injection"},{"type":"informative","value":"Found PE header in memory"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to encrypt/decrypt data using TripleDES"},{"type":"suspicious","value":"Able to perform cryptographic operations"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"},{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"suspicious","value":"Calls an API typically used to query local/system time as file time"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Tries to map intranet network resources to internet zone"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Defense Evasion","technique":"Clear Persistence","attack_id":"T1070.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/009","identifiers":[{"type":"suspicious","value":"Attempts to clear registry persistence"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"Drops file with high entropy, indicating encryption/obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Contains ability to decode base64 data"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Opens registry keys"},{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Touches files in program files directory"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to find logical drives of the machine (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Able to retrieve running process details (.NET)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"},{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve default language settings"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"},{"type":"malicious","value":"Tries to steal Mail credentials from registry"},{"type":"informative","value":"Found mail information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Creates directory on disk"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","identifiers":[{"type":"suspicious","value":"Drops cabinet archive files"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"informative","value":"Contains reference to Windows HTTP services (API string)"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"GETs files from a web server (PE files)"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download a file from a URL (API string)"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve the URL data"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"suspicious","value":"Calls an API typically used to import asymmetric cryptographic keys into a CSP"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Able to import cryptographic keys (seen in ransomware)"}],"sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"},{"type":"malicious","value":"Creates a system process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Can load assembly that contains the code that is currently executing (Dotnet)"},{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"},{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Defense Evasion","technique":"System Binary Proxy Execution","attack_id":"T1218","attack_id_wiki":"https://attack.mitre.org/techniques/T1218","identifiers":[{"type":"suspicious","value":"Detected system process execution without parameters (likely process injection)"}],"sources":[{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"},{"type":"informative","value":"Strings related to file managers detected"}],"sources":[{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"suspicious","value":"Attempts to obtain browser cookies (file access)"},{"type":"suspicious","value":"Able to retrieve browser cookies using SQL"}],"sources":[{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Found Pidgin accounts related filepath string"}],"sources":[{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\")\n Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; Source: \"00000000-00003212.00000000.230499.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00003212.00000000.230499.00401000.00000020.mdmp\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00003212.00000000.230499.00401000.00000020.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00003212.00000000.230499.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00003212-00000CC3-2600723639\")\n Found reference to \"CryptCNGInitHMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00003212.00000000.230499.007B0000.00000004.mdmp, 00000000-00003212.00000001.231395.007B0000.00000004.mdmp\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00003212.00000001.231395.007B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$26","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Tries to map intranet network resources to internet zone","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00003212-00000C2C-2602287630\")\n Found reference to API \"BCryptImportKeyPair\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00003212-00000C2C-2609461297\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"00000000-00003212-00000C2C-2609464748\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$27","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00003212.00000001.231395.03C70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"Keep\" in header \"GET / HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: x1.c.lencr.org\"\n Contains base64 string in header \"User\" in header \"GET / HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: x1.c.lencr.org\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Able to utilize the Windows bcrypt cryptographic API\n Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP\n Matched sigs: Contains reference to cryptographic keys\n Matched sigs: Reads the cryptographic machine GUID\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)\n Matched sigs: Drops file with high entropy\n indicating encryption/obfuscation","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00003212-00000C2C-2593798246\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003212-00000C2C-2593798975\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00003212-00000C2C-2593799863\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00003212-00000C2C-2597927484\")\n Found reference to API \"GetAddrInfoExW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00003212-00000C2C-2598473086\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00003212-00000C2C-2599467018\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" called \"GetAdaptersAddresses\" with parameters (UID: 00000000-00003212)\n \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00003212)\n \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00003212)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00003212)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" called \"IsWow64Process\" with parameter \"3212\" - (UID: 00000000-00003212)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00003212)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$28","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$29","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" called \"LookupAccountSidW\" with param Name 4MtoSj5 (UID: 00000000-00003212)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003212)\n \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" called \"GetLocaleInfoA\" with parameter \"1033\" - (UID: 00000000-00003212)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$2d","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2f","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"x1.c.lencr.org\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"184.171.242.18:443\"\n \"23.63.210.161:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003212.00000000.230499.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$30","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00003212.00000000.230499.00401000.00000020.mdmp\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; Source: \"00000000-00003212.00000000.230499.00401000.00000020.mdmp\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; Source: \"00000000-00003212.00000000.230499.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Policies\\Microsoft\\Internet Explorer\\Main\" in Source: 00000000-00003212.00000000.230499.007B0000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00003212.00000000.230499.007B0000.00000004.mdmp\n 00000000-00003212.00000001.231395.007B0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" with parameter C:\\Users\\%OSUSER% (UID: 00000000-00003212)\n \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" with parameter %USERPROFILE%\\AppData\\Local (UID: 00000000-00003212)\n \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files (UID: 00000000-00003212)\n \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" with parameter %USERPROFILE%\\AppData\\Roaming (UID: 00000000-00003212)\n \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" with parameter %APPDATA%\\Microsoft\\Windows\\Cookies (UID: 00000000-00003212)\n \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" with parameter %LOCALAPPDATA%\\Microsoft\\Windows\\History (UID: 00000000-00003212)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-318","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n Process ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n Process ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe created mutex with name \"Local\\ZonesLockedCacheCounterMutex\"\n Process ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe created mutex with name \"Local\\ZonesCacheCounterMutex\"","origin":"Created Mutant","mitre_attack_id":"T1480","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"hapubws@www.360.cn\"\n Pattern match: \"hapubws@netflix.com\"\n Pattern match: \"hapubws@app.yzz\"\n Pattern match: \"hapubws@netlog.com\"\n Pattern match: \"hapubws@bestbuy.com\"\n Pattern match: \"info@diginotar.nl\"\n Pattern match: \"cps-requests@verisign.com\"\n Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"$31","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"Software\\Policies\\Microsoft\\Internet Explorer\\Main\" in Source: 00000000-00003212.00000000.230499.007B0000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00003212.00000000.230499.007B0000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00003212.00000001.231395.007B0000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"\"GET / HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: x1.c.lencr.org\" Response ==> HTTP/1.1 200 OK\nServer: nginx\nContent-Type: application/pkix-crl\nLast-Modified: Tue\n 09 Sep 2025 21:20:19 GMT\nETag: \"68c09a13-2de\"\nCache-Control: max-age=3600\nExpires: Tue\n 31 Mar 2026 09:51:06 GMT\nDate: Tue\n 31 Mar 2026 08:51:06 GMT\nContent-Length: 734\nConnection: keep-alive with response body ==>30C28202C39A30C281C383020101300D06092AC28648C286C3B70D01010B0500304F310B300906035504061302555331293027060355040A1320496E7465726E.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" loaded module \"%WINDIR%\\SysWOW64\\Wldap32.dll\" at 76090000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$32","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 73180000\n \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 73140000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 764B0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"General","name":"Loads the visual basic runtime environment","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" loaded module \"%WINDIR%\\SysWOW64\\msvbvm60.dll\" at 72940000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-0","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"$33","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" was detected as \"Microsoft Visual Basic\" and name: \"Compiler\"\n \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" touched \"NetworkListManager\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\")\n \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" touched \"Network List Manager\" (Path: \"HKCU\\WOW6432NODE\\CLSID\\{A47979D2-C419-11D9-A5B4-001185AD2B89}\")\n \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" touched \"PSFactoryBuffer\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\")\n \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" touched \"WinInetBroker Class\" (Path: \"HKCU\\CLSID\\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" file has an entrypoint instructions - \"push\t0x40a964,call\t0x40a696,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,xor\tbyte ptr [eax], al,add\tbyte ptr [eax], al,cmp\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,imul\tecx, dword ptr [edx], 0x121cc4cb,xchg\tdword ptr [esi + esi*4 + 0x79], eax,mov\tdl, 1,xor\teax, dword ptr [eax + 0x97f5],add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tdword ptr [eax], eax,add\tbyte ptr [eax], al,jne\t0x40a738,imul\tebp, dword ptr [edi + 0x5c], 0x61626156,arpl\tword ptr [ebp + 0x6c], si,imul\teax, dword ptr [eax], 0,add\tdword ptr [eax], eax,add\teax, dword ptr [eax],xor\tal, 0xac,inc\teax,add\tbyte ptr [eax], al,add\tbyte ptr [eax], al,add\tbh, bh,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"arpausa.com.ec\"\n \"x1.c.lencr.org\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\Windows\\syswow64\\WLDAP32.dll\" (Source: \"00000000-00003212.00000001.231395.03C70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" [Source: 00000000-00003212-00000C2B-2600504077]\n Observed system executable string:\"%WINDIR%\\system32\\cryptnet.dll\" [Source: 00000000-00003212-00000C2B-2602302158]\n Observed system executable string:\"%WINDIR%\\syswow64\\CRYPT32.dll\" [Source: 00000000-00003212-00000C2B-2610496337]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=R13, O=Let's Encrypt, C=US\" (SHA1: 6B:67:C5:F9:26:67:0D:76:2A:69:4C:1A:C5:10:99:95:A8:B9:FC:1F; see report for more information)\n The input sample is signed with a certificate issued by \"CN=ISRG Root X1, O=Internet Security Research Group, C=US\" (SHA1: 22:FF:89:58:65:61:FC:2D:52:F7:74:91:E9:F1:EF:F1:B8:0B:E3:3E; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 4987 bytes 1 file at 0x2c last modified Sun Sep 04 2025 20:23:24 +A \"disallowedcert.stl\" number 1 1 datablock 0x1 compression\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003212]\n \"103621DE9CD5414CC2538780B4B75751\" has type \"data\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\103621DE9CD5414CC2538780B4B75751]- [targetUID: 00000000-00003212]\n \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"data\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003212]\n \"103621DE9CD5414CC2538780B4B75751\" has type \"data\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\103621DE9CD5414CC2538780B4B75751]- [targetUID: 00000000-00003212]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$34","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$35","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" reads file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\57c8edb95df3f0ad4ee2dc2b8cfd4157\"\n \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" reads file \"c:\\users\\%osuser%\\appdata\\locallow\\microsoft\\cryptneturlcache\\metadata\\103621de9cd5414cc2538780b4b75751\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Observed a high volume of repeated registry API calls (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$36","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$37","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$38","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$39","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$3a","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" called \"HttpOpenRequestW\" with parameter HTTP method:\"GET\" object: /TUX2NFDT.3N1\" - (UID: 00000000-00003212)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003212)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"3c98250\"\n \"lpszHeaders\": \"If-None-Match: \\\"08f5ab0361ad71:0\\\"If-Modified-Since: Tue, 16 Mar 2021 07:33:42 GMT\"\n \"dwHeadersLength\": \"4294967295\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}\n \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"3c98168\"\n \"dwHeadersLength\": \"0\"\n \"dwOptionalLength\": \"0\"\n \"dwTotalLength\": \"0\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"3c98250\"\n \"lpReserved\": \"0\"}\n \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"3c98168\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" called \"InternetOpenA with parameter Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E; InfoPath.3)\" (UID: 00000000-00003212)\n \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" called \"InternetOpenW with parameter Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0\" (UID: 00000000-00003212)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownloadToFile\"; File: \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\")\n Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownload\"; File: \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\")\n Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00003212.00000000.230499.00401000.00000020.mdmp\")\n Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownload\"; Source: \"00000000-00003212.00000000.230499.00401000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"AUTHUI.DLL: Shutdown Choices Message Window\" (Indicator: \" shutdown \"; Source: \"00000000-00003212.00000000.230499.00BD0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 23.63.210.161 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"www.mail.google.com0\" [Source: 00000000-00003212.00000001.231395.007B0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.29.35\"\n \"2.5.29.31\"\n \"192.168.0.2\"\n \"2.5.29.15\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n \"2.5.29.19\"\n \"2.5.29.14\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"\n \"2.5.29.17\"\n \"2.5.29.32\"\n \"2.5.29.1\"\n \"2.5.4.3\"\n \"2.5.29.4\"\n \"2.5.29.10\"\n \"2.5.29.16\"\n \"2.5.29.20\"\n \"2.5.29.28\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$3d","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"GET /TUX2NFDT.3N1 HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00003212.00000000.230499.007B0000.00000004.mdmp\")\n Found string \"T /TUX2NFDT.3N1 HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00003212.00000001.231395.007B0000.00000004.mdmp\")\n Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00003212.00000001.231395.03C70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET / HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: x1.c.lencr.org\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5182f54f9c6e99d117d9dde3fa2b4cff","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"arpausa.com.ec\" (7 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"arpausa.com.ec\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"184.171.242.18\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"ncalrpc:[epmapper,Security=Impersonation Dynamic False]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003212.00000001.231395.007B0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE1966305A7E8747099C887D629794]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003212.00000001.231395.007B0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEC0610364D265496CA19898EE0046]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003212.00000001.231395.007B0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLE5DE2BDD68A104D4CB8AC57E4F7EC]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003212.00000001.231395.007B0000.00000004.mdmp\")\n Found string \"I+ncalrpc:[OLE1966305A7E8747099C887D629794]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003212.00000001.231395.007B0000.00000004.mdmp\")\n Found string \"I+ncalrpc:[OLE196630\" (Indicator: \"ncalrpc\"; Source: \"00000000-00003212.00000001.231395.007B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"Found string \"\\Windows\\SysWOW64\\Kerberos.DLL\" (Indicator: \"kerberos\"; Source: \"00000000-00003212.00000001.231395.007B0000.00000004.mdmp\")\n Found string \"icrosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00003212.00000001.231395.007B0000.00000004.mdmp\")\n Found string \"Kerberos\" (Indicator: \"kerberos\"; Source: \"00000000-00003212.00000001.231395.007B0000.00000004.mdmp\")\n Found string \"crosoft Kerberos V1.0\" (Indicator: \"kerberos\"; Source: \"00000000-00003212.00000001.231395.007B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"090000000010000000000100fffffeff0300000008000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"eehteeerrcahhaesarescvraaashravarcsecrveecar\" (Indicator: \"aes\"; File: \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\")\n Found string \"caessaschaaaaatscarharrtchshrrtvvchhtharrsea\" (Indicator: \"aes\"; File: \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\")\n Found string \"eehteeerrcahhaesarescvraaashravarcsecrveecar\" (Indicator: \"aes\"; Source: \"00000000-00003212.00000000.230499.00401000.00000020.mdmp\")\n Found string \"caessaschaaaaatscarharrtchshrrtvvchhtharrsea\" (Indicator: \"aes\"; Source: \"00000000-00003212.00000000.230499.00401000.00000020.mdmp, 00000000-00003212.00000001.231395.007B0000.00000004.mdmp\")\n Found string \"crosoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00003212.00000001.231395.007B0000.00000004.mdmp\")\n Found string \"Microsoft Enhanced RSA and AES Cryptographic Provider\" (Indicator: \"aes\"; Source: \"00000000-00003212.00000001.231395.007B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"8073716129960,1056,3119,,FindNextFileA,kernel32.dll,\"253:41:32.460\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00003212.00000001.231395.007B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"VXKERN~1.VXSVxKernelSvcNTProcessList.vxsrp\" (Indicator: \"ProcessList\"; Source: \"00000000-00003212.00000001.231395.007B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"System Security","name":"Able to retrieve/open a process (API string)","description":"Found string \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003212-00000C2C-2593796766\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-729","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"System Security","name":"Contains reference to Hijacked CLSID(s)","description":"Observed string: \"CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\" (Indicator: \"{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\") in Source: 00000000-00003212.00000001.231395.007B0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":1,"id":"string-342","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3f","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$40","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops file with high entropy, indicating encryption/obfuscation","description":"\"103621DE9CD5414CC2538780B4B75751 has high entropy\"","origin":"Binary File","mitre_attack_id":"T1027.013","relevance":3,"id":"binary-90","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003212]\n Dropped file: \"103621DE9CD5414CC2538780B4B75751\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\103621DE9CD5414CC2538780B4B75751]- [targetUID: 00000000-00003212]\n Dropped file: \"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003212]\n Dropped file: \"103621DE9CD5414CC2538780B4B75751\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\103621DE9CD5414CC2538780B4B75751]- [targetUID: 00000000-00003212]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Attempts to clear registry persistence","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"AUTOCONFIGURL\")\n \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"AUTODETECT\")","origin":"Registry Access","mitre_attack_id":"T1070.009","relevance":10,"id":"registry-206","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" at 00000000-00003212-00000033-6590975","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"$42","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Calls an API typically used to import asymmetric cryptographic keys into a CSP","description":"$43","origin":"API Call","mitre_attack_id":"T1573.002","relevance":1,"id":"api-234","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has high entropy 7.94774\n Dropped file \"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\103621DE9CD5414CC2538780B4B75751\" has high entropy 7.54031","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"$44","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00000000-00003212-49870-8-00483CD0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"10/25 Antivirus vendors marked sample as malicious (40% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 184.171.242.18 on port 443 is sent without HTTP header\n TCP traffic to 23.63.210.161 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found an instant messenger related domain","description":"\"login.skype.com0\" (Indicator: \"skype.com\")\n \"login.skype.com\" (Indicator: \"skype.com\")\n \"www.login.skype.com0\" (Indicator: \"skype.com\")","origin":"File/Memory","relevance":10,"id":"string-61","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"0000000000\")\n \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"ba2a7da1372b50932c011ae4b926c24deda4b6f1d6077e761be1deeea2249ba5.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Drops cabinet archive files","description":"\"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"Microsoft Cabinet archive data Windows 2000/XP setup 4987 bytes 1 file at 0x2c last modified Sun Sep 04 2025 20:23:24 +A \"disallowedcert.stl\" number 1 1 datablock 0x1 compression\"- Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157]- [targetUID: 00000000-00003212]","origin":"Binary File","mitre_attack_id":"T1560","relevance":10,"id":"binary-5","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"arpausa.com.ec\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"69cb8ac6513b85ec4105fbda"},{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007928.00000001.150470.065A0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007928.00000000.150270.03170000.00000004.mdmp, 00000000-00007928.00000001.150470.03170000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00007928.00000000.150270.06480000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00007928.00000001.150470.065A0000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007928.00000000.150270.03170000.00000004.mdmp, 00000000-00007928.00000001.150470.03170000.00000004.mdmp\")\n Found reference to API \"SendMessage\" (Indicator: \"sendmessage\"; Source: \"00000000-00007928.00000001.150470.065A0000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69cb6fd4d5bcc3b5ff0ab08d"},{"report_type":"sandbox","report_id":"69cb79170fa075a7260f499a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"