34:"SampleDetailWrapper" 35:I[7638,["$1","$2","$3","$4","$5","$8","$9","$a","$b"],"$34"] 6d:I[27201,["$1","$2","$3","$4","$5"],"IconMark"] 33:T4e2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Application.Bundler.MediaGet.Generic Sample d02e2f6c2ef7… — Score 80/100 — Hybrid Analysis","description":"Malicious verdict for sample d02e2f6c2ef7…. Malware family: Application.Bundler.MediaGet.Generic. Threat score 80/100. 7/25 AV engines flagged this file. 1 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","keywords":["Malicious","Application.Bundler.MediaGet.Generic","malware analysis","sandbox report","threat intelligence","d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59"],"about":{"@type":"SoftwareApplication","name":"capcut_pro_9_4_0.exe","applicationCategory":["peexe","executable"],"identifier":"d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","additionalType":"Malicious sample"},"threatScore":80,"malwareFamily":"Application.Bundler.MediaGet.Generic","antivirusDetections":{"malicious":7,"total":25},"behavioralIndicators":{"malicious":1,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}36:T98d,Found string - \\.\DISPLAY1; Source: "00000000-00001248.00000000.111288.00BF0000.00000004.mdmp, 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp, 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp") Found string - \\.\DISPLAY2; Source: "00000000-00001248.00000000.111288.00BF0000.00000004.mdmp, 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp, 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp") Found string - \\.\DISPLAY5; Source: "00000000-00001248.00000000.111288.00BF0000.00000004.mdmp, 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp, 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp") Found string - \\.\DISPLAY3; Source: "00000000-00001248.00000000.111288.00BF0000.00000004.mdmp, 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp, 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp") Found string - \\.\DISPLAY4; Source: "00000000-00001248.00000000.111288.00BF0000.00000004.mdmp, 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp, 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp") Found string - \\.\DISPLAY6; Source: "00000000-00001248.00000000.111288.00BF0000.00000004.mdmp, 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp, 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp") Found string - \\.\DISPLAY7; Source: "00000000-00001248.00000000.111288.00BF0000.00000004.mdmp, 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp, 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp") Found string - \\.\DISPLAY8; Source: "00000000-00001248.00000000.111288.00BF0000.00000004.mdmp, 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp, 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp") Found string - \.\DISPLAY1; Source: "00000000-00001248.00000000.111288.00BF0000.00000004.mdmp, 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp, 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp")37:T811,"capcut_pro_9_4_0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\4") "capcut_pro_9_4_0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\LOCKDOWN_ZONES\4") "capcut_pro_9_4_0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\4") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONES\4") "capcut_pro_9_4_0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_ZONES_DEFAULT_DRIVE_INTRANET_KB941000") "capcut_pro_9_4_0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_ZONES_DEFAULT_DRIVE_INTRANET_KB941000") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS") "capcut_pro_9_4_0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS") "capcut_pro_9_4_0.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS") "capcut_pro_9_4_0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{2B0F765D-C0E9-4171-908E-08A611B84FF6}") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FOLDERDESCRIPTIONS\{2B0F765D-C0E9-4171-908E-08A611B84FF6}")38:T51a,"capcut_pro_9_4_0.exe" queried SystemProcessInformation at 00000000-00001248-00000C15-289788974 [PID: 1248] "capcut_pro_9_4_0.exe" queried SystemProcessInformation at 00000000-00001248-00000C15-289799292 [PID: 1248] "capcut_pro_9_4_0.exe" queried SystemProcessInformation at 00000000-00001248-00000C15-290265082 [PID: 1248] "capcut_pro_9_4_0.exe" queried SystemProcessInformation at 00000000-00001248-00000C15-290274651 [PID: 1248] "capcut_pro_9_4_0.exe" queried SystemProcessInformation at 00000000-00001248-00000C15-290657448 [PID: 1248] "capcut_pro_9_4_0.exe" queried SystemProcessInformation at 00000000-00001248-00000C15-290667951 [PID: 1248] "capcut_pro_9_4_0.exe" queried SystemProcessInformation at 00000000-00001248-00000C15-291009200 [PID: 1248] "capcut_pro_9_4_0.exe" queried SystemProcessInformation at 00000000-00001248-00000C15-291019301 [PID: 1248] "capcut_pro_9_4_0.exe" queried SystemProcessInformation at 00000000-00001248-00000C15-291381377 [PID: 1248] "capcut_pro_9_4_0.exe" queried SystemProcessInformation at 00000000-00001248-00000C15-291390784 [PID: 1248] "capcut_pro_9_4_0.exe" queried SystemProcessInformation at 00000000-00001248-00000C15-293430465 [PID: 1248] "capcut_pro_9_4_0.exe" queried SystemProcessInformation at 00000000-00001248-00000C15-293439979 [PID: 1248]39:Ta23,Found api reference "CryptEnumProvidersW" (Indicator: "CryptEnumProvidersW"; File: "capcut_pro_9_4_0.exe") Found api reference "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "capcut_pro_9_4_0.exe") Found api reference "CryptExportKey" (Indicator: "CryptExportKey"; File: "capcut_pro_9_4_0.exe") Found api reference "CryptSignHashW" (Indicator: "CryptSignHashW"; File: "capcut_pro_9_4_0.exe") Found api reference "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "capcut_pro_9_4_0.exe") Found api reference "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "capcut_pro_9_4_0.exe") Found api reference "CryptSetHashParam" (Indicator: "CryptSetHashParam"; File: "capcut_pro_9_4_0.exe") Found api reference "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "capcut_pro_9_4_0.exe") Found api reference "CryptGetUserKey" (Indicator: "CryptGetUserKey"; File: "capcut_pro_9_4_0.exe") Found api reference "CryptAcquireContextW" (Indicator: "CryptAcquireContextW"; File: "capcut_pro_9_4_0.exe") Found api reference "CryptGetProvParam" (Indicator: "CryptGetProvParam"; File: "capcut_pro_9_4_0.exe") Found api reference "CryptDecrypt" (Indicator: "CryptDecrypt"; File: "capcut_pro_9_4_0.exe") Found api reference "CertGetEnhancedKeyUsage" (Indicator: "CertGetEnhancedKeyUsage"; File: "capcut_pro_9_4_0.exe") Found api reference "CertGetCertificateContextProperty" (Indicator: "CertGetCertificateContextProperty"; File: "capcut_pro_9_4_0.exe") Found api reference "CertGetIntendedKeyUsage" (Indicator: "CertGetIntendedKeyUsage"; File: "capcut_pro_9_4_0.exe") Found api reference "CertOpenSystemStoreW" (Indicator: "CertOpenSystemStoreW"; File: "capcut_pro_9_4_0.exe") Found api reference "CertDuplicateCertificateContext" (Indicator: "CertDuplicateCertificateContext"; File: "capcut_pro_9_4_0.exe") Found api reference "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "capcut_pro_9_4_0.exe") Found api reference "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "capcut_pro_9_4_0.exe") Found api reference "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "capcut_pro_9_4_0.exe") Found api reference "CertOpenStore" (Indicator: "CertOpenStore"; File: "capcut_pro_9_4_0.exe") Found api reference "CertCloseStore" (Indicator: "CertCloseStore"; File: "capcut_pro_9_4_0.exe") Found api reference "BCryptGenRandom" (Indicator: "BCryptGenRandom"; File: "capcut_pro_9_4_0.exe") Found api reference "BCryptGenRandom" (Indicator: "CryptGenRandom"; File: "capcut_pro_9_4_0.exe")3a:T908,Assembly shows XOR instruction xor eax ebp in Stream UID: 26611-112-006340B5 Assembly shows XOR instruction xor ecx ebp in Stream UID: 26611-112-006340B5 Assembly shows XOR instruction xor eax ebp in Stream UID: 26611-140-00639174 Assembly shows XOR instruction xor ecx ebp in Stream UID: 26611-140-00639174 Assembly shows XOR instruction xor eax ebp in Stream UID: 26611-971-0062F416 Assembly shows XOR instruction xor ecx ebp in Stream UID: 26611-971-0062F416 Assembly shows XOR instruction xor eax ebp in Stream UID: 26611-5495-0062E188 Assembly shows XOR instruction xor ecx ebp in Stream UID: 26611-5495-0062E188 Assembly shows XOR instruction xor ecx ebp in Stream UID: 26611-5517-0060AD5E Assembly shows XOR instruction xor eax ebp in Stream UID: 26611-5521-0060A950 Assembly shows XOR instruction xor ecx ebp in Stream UID: 26611-5521-0060A950 Assembly shows XOR instruction xor eax ebp in Stream UID: 26611-5530-00609960 Assembly shows XOR instruction xor ecx ebp in Stream UID: 26611-5530-00609960 Assembly shows XOR instruction xor eax ebp in Stream UID: 26611-5531-00609EE0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 26611-5531-00609EE0 Assembly shows XOR instruction xor eax ebp in Stream UID: 26611-5549-00608F10 Assembly shows XOR instruction xor ecx ebp in Stream UID: 26611-5549-00608F10 Assembly shows XOR instruction xor eax ebp in Stream UID: 26611-5560-00607BB0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 26611-5560-00607BB0 Assembly shows XOR instruction xor eax ebp in Stream UID: 26611-5670-00602750 Assembly shows XOR instruction xor ecx ebp in Stream UID: 26611-5670-00602750 Assembly shows XOR instruction xor eax ebp in Stream UID: 26611-5687-005FFDD0 Assembly shows XOR instruction xor ecx ebp in Stream UID: 26611-5687-005FFDD0 Assembly shows XOR instruction xor eax ebp in Stream UID: 26611-5877-00497980 Assembly shows XOR instruction xor ecx ebp in Stream UID: 26611-5877-00497980 Assembly shows XOR instruction xor eax ebp in Stream UID: 26611-5890-0049FD60 Assembly shows XOR instruction xor ecx ebp in Stream UID: 26611-5890-0049FD60 Assembly shows XOR instruction xor eax ebp in Stream UID: 26611-5891-004BCE90 Assembly shows XOR instruction xor ecx ebp in Stream UID: 26611-5891-004BCE903b:T6cc,Found reference to API "CryptEnumProvidersW" (Indicator: "CryptEnumProviders"; File: "capcut_pro_9_4_0.exe") Found reference to API "CryptReleaseContext" (Indicator: "CryptReleaseContext"; File: "capcut_pro_9_4_0.exe") Found reference to API "CryptExportKey" (Indicator: "CryptExportKey"; File: "capcut_pro_9_4_0.exe") Found reference to API "CryptSignHashW" (Indicator: "CryptSignHash"; File: "capcut_pro_9_4_0.exe") Found reference to API "CryptDestroyKey" (Indicator: "CryptDestroyKey"; File: "capcut_pro_9_4_0.exe") Found reference to API "CryptCreateHash" (Indicator: "CryptCreateHash"; File: "capcut_pro_9_4_0.exe") Found reference to API "CryptDestroyHash" (Indicator: "CryptDestroyHash"; File: "capcut_pro_9_4_0.exe") Found reference to API "CryptGetUserKey" (Indicator: "CryptGetUserKey"; File: "capcut_pro_9_4_0.exe") Found reference to API "CryptAcquireContextW" (Indicator: "CryptAcquireContext"; File: "capcut_pro_9_4_0.exe") Found reference to API "CryptGetProvParam" (Indicator: "CryptGetProvParam"; File: "capcut_pro_9_4_0.exe") Found reference to API "CryptDecrypt" (Indicator: "CryptDecrypt"; File: "capcut_pro_9_4_0.exe") Found reference to API "CertOpenSystemStoreW" (Indicator: "CertOpenSystemStore"; File: "capcut_pro_9_4_0.exe") Found reference to API "CertEnumCertificatesInStore" (Indicator: "CertEnumCertificatesInStore"; File: "capcut_pro_9_4_0.exe") Found reference to API "CertFindCertificateInStore" (Indicator: "CertFindCertificateInStore"; File: "capcut_pro_9_4_0.exe") Found reference to API "CertFreeCertificateContext" (Indicator: "CertFreeCertificateContext"; File: "capcut_pro_9_4_0.exe") Found reference to API "CertCloseStore" (Indicator: "CertCloseStore"; File: "capcut_pro_9_4_0.exe")3c:Tb52,Found string "-----BEGIN PUBLIC KEY-----" (Indicator: "public key"; File: "capcut_pro_9_4_0.exe") Found string "-----END PUBLIC KEY-----" (Indicator: "public key"; File: "capcut_pro_9_4_0.exe") Found string "public key hash: sha256//%s" (Indicator: "public key"; File: "capcut_pro_9_4_0.exe") Found string "SSL public key does not match pinned public key" (Indicator: "public key"; File: "capcut_pro_9_4_0.exe") Found string "Public Key Algorithm" (Indicator: "public key"; File: "capcut_pro_9_4_0.exe") Found string "Unable to load public key" (Indicator: "public key"; File: "capcut_pro_9_4_0.exe") Found string "RSA Public Key" (Indicator: "public key"; File: "capcut_pro_9_4_0.exe") Found string "SSL: public key does not match pinned public key" (Indicator: "public key"; File: "capcut_pro_9_4_0.exe") Found string "unable to use private key from PKCS12 file '%s'" (Indicator: "private key"; File: "capcut_pro_9_4_0.exe") Found string "private key from PKCS12 file '%s' does not match certificate in same file" (Indicator: "private key"; File: "capcut_pro_9_4_0.exe") Found string "unable to set private key file: '%s' type %s" (Indicator: "private key"; File: "capcut_pro_9_4_0.exe") Found string "failed to load private key from crypto engine" (Indicator: "private key"; File: "capcut_pro_9_4_0.exe") Found string "unable to set private key" (Indicator: "private key"; File: "capcut_pro_9_4_0.exe") Found string "crypto engine not set, can't load private key" (Indicator: "private key"; File: "capcut_pro_9_4_0.exe") Found string "file type P12 for private key not supported" (Indicator: "private key"; File: "capcut_pro_9_4_0.exe") Found string "not supported file type for private key" (Indicator: "private key"; File: "capcut_pro_9_4_0.exe") Found string "Private key does not match the certificate public key" (Indicator: "private key"; File: "capcut_pro_9_4_0.exe") Found string "Private key does not match the certificate public key" (Indicator: "public key"; File: "capcut_pro_9_4_0.exe") Found string "unable to decode issuer public key" (Indicator: "public key"; File: "capcut_pro_9_4_0.exe") Found string "Suite B: invalid public key algorithm" (Indicator: "public key"; File: "capcut_pro_9_4_0.exe") Found string "Certificate public key has explicit ECC parameters" (Indicator: "public key"; File: "capcut_pro_9_4_0.exe") Found string "Validation of public key failed." (Indicator: "public key"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") file/memory contains long string with (Indicator: "private key"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "The Software Licensing Service reported that the product could not be activated. The certificate cannot be used because its private key is exportable." (Indicator: "private key"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp")3d:Te01,Contains base64 string in header "POST" in header "POST /ld/get_bconfig.php HTTP/1.1Host: mediaget.comUser-Agent: m_installerAccept: */*Content-Length: 7Content-Type: application/x-www-form-urlencoded" Contains base64 string in header "mediaget" in header "POST /ld/get_bconfig.php HTTP/1.1Host: mediaget.comUser-Agent: m_installerAccept: */*Content-Length: 7Content-Type: application/x-www-form-urlencoded" Contains base64 string in header "7Content" in header "POST /ld/get_bconfig.php HTTP/1.1Host: mediaget.comUser-Agent: m_installerAccept: */*Content-Length: 7Content-Type: application/x-www-form-urlencoded" Contains base64 string in header "Type" in header "POST /ld/get_bconfig.php HTTP/1.1Host: mediaget.comUser-Agent: m_installerAccept: */*Content-Length: 7Content-Type: application/x-www-form-urlencoded" Contains base64 string in header "form" in header "POST /ld/get_bconfig.php HTTP/1.1Host: mediaget.comUser-Agent: m_installerAccept: */*Content-Length: 7Content-Type: application/x-www-form-urlencoded" Contains base64 string in header "data" in header "GET /ld/get_data.php?id=0&alreadyInstalled=0&vi=0&browsersInstalled=chrome,iexplore,edge&defaultBrowser=edge&bundlesInstalled=&installerVersion=502&os=10.0.16299&isOs64bit=1&lang=en-US HTTP/1.1Host: mediaget.comUser-Agent: m_installerAccept: */*" Contains base64 string in header "iexplore" in header "GET /ld/get_data.php?id=0&alreadyInstalled=0&vi=0&browsersInstalled=chrome,iexplore,edge&defaultBrowser=edge&bundlesInstalled=&installerVersion=502&os=10.0.16299&isOs64bit=1&lang=en-US HTTP/1.1Host: mediaget.comUser-Agent: m_installerAccept: */*" Contains base64 string in header "edge" in header "GET /ld/get_data.php?id=0&alreadyInstalled=0&vi=0&browsersInstalled=chrome,iexplore,edge&defaultBrowser=edge&bundlesInstalled=&installerVersion=502&os=10.0.16299&isOs64bit=1&lang=en-US HTTP/1.1Host: mediaget.comUser-Agent: m_installerAccept: */*" Contains base64 string in header "mediaget" in header "GET /ld/get_data.php?id=0&alreadyInstalled=0&vi=0&browsersInstalled=chrome,iexplore,edge&defaultBrowser=edge&bundlesInstalled=&installerVersion=502&os=10.0.16299&isOs64bit=1&lang=en-US HTTP/1.1Host: mediaget.comUser-Agent: m_installerAccept: */*" Contains base64 string in header "POST" in header "POST /client/installer.php HTTP/1.1Host: mediaget.comUser-Agent: m_installerAccept: */*Content-Length: 197Content-Type: application/x-www-form-urlencoded" Contains base64 string in header "mediaget" in header "POST /client/installer.php HTTP/1.1Host: mediaget.comUser-Agent: m_installerAccept: */*Content-Length: 197Content-Type: application/x-www-form-urlencoded" Contains base64 string in header "Type" in header "POST /client/installer.php HTTP/1.1Host: mediaget.comUser-Agent: m_installerAccept: */*Content-Length: 197Content-Type: application/x-www-form-urlencoded" Contains base64 string in header "form" in header "POST /client/installer.php HTTP/1.1Host: mediaget.comUser-Agent: m_installerAccept: */*Content-Length: 197Content-Type: application/x-www-form-urlencoded" Contains base64 string in header "/installer/binaries/html" in header "GET /installer/binaries/html_new_transl_2026-10-16.7z HTTP/1.1Host: mediaget.comUser-Agent: m_installerAccept: */*" Contains base64 string in header "2026" in header "GET /installer/binaries/html_new_transl_2026-10-16.7z HTTP/1.1Host: mediaget.comUser-Agent: m_installerAccept: */*" Contains base64 string in header "mediaget" in header "GET /installer/binaries/html_new_transl_2026-10-16.7z HTTP/1.1Host: mediaget.comUser-Agent: m_installerAccept: */*"3e:T52f,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform AES/RC4 encryption (API string) Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Contains key cryptographic functions (API string) Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Possibly contains Public/Private key (encryption) Matched sigs: Contains reference to cryptographic keys Matched sigs: Contains reference to crypto DLLs Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Drops image files with high entropy (likely encrypted/compressed content) Matched sigs: Uses Windows cryptography API for obfuscation Matched sigs: Contains XOR operation loops [Stream disassembly] Matched sigs: YARA signature match – Encryption algorithm Matched sigs: YARA signature match - AES encryption Matched sigs: YARA signature match – cryptographic algorithms Matched sigs: YARA signature match - ChaCha20 encryption algorithm3f:T4e6d,Found XOR loop in file "sample.bin" at offset 186191; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 186390; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 254427; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 254978; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 257365; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 816324; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1245609; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2638004; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2638148; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2638292; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2638436; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2703205; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3082864; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3111175; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3140407; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3146107; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3153213; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3156843; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3171013; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3188379; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3188669; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3190509; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3191535; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3193569; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3194563; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3196819; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3199569; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3205855; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3211493; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3214701; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3217307; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3217557; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3219455; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 93317; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 190344; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 205701; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 312907; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 322588; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 603195; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 603302; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 635488; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 635510; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 635537; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 711727; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 711756; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 711790; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 711814; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 711828; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 713204; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 713260; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 713270; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 713376; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 713475; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 714154; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 714169; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 714191; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 714268; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 714294; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 714484; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 896105; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1076862; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1076883; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1076903; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1080439; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1080608; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1153976; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1200691; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1200713; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1200735; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1200757; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1200779; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1200801; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1200823; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1200845; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1200867; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1229961; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1245069; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1245149; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1245167; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1328243; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1328355; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1328619; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1328699; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1328931; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1329011; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1329243; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1329326; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1329555; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1329638; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1329870; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1329950; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1330182; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1330259; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1330558; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1330670; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1331284; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1331396; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1331660; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1331740; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1331972; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1332052; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1332284; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1332367; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1332596; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1332679; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1332911; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1332991; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1333223; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1333300; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1333599; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1333711; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1342810; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1342945; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1351503; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1351868; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1352209; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1352997; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1353858; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1354385; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1354404; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1361246; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1361901; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1362017; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1369393; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1369773; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1370161; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1370557; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1370937; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1371325; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1371721; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1372786; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1373166; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1373554; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1373950; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1374330; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1374718; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1375114; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1381136; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1381236; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1381816; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1382269; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1382320; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1382431; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1382459; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1383569; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1383669; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1384235; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1384275; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1384656; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1409630; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1410165; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1410247; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1412735; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1412961; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1414014; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1414471; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1415849; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1416212; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1416402; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1417196; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1417468; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1418003; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1421756; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1421983; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1422557; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1422779; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1423105; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1423670; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1423746; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1424696; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1426289; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1426511; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1427557; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1428001; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1431889; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1432860; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1433838; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1460278; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1768305; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1871273; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1872038; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1872057; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1872076; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1872095; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1872114; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1872133; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1872152; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1872174; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1872214; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1889774; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1980483; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1980894; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1984160; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2197207; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2704876; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2732251; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2790400; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3098676; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3129351; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3133967; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3139651; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3150541; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3168737; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3172501; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3176217; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3182115; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1336187; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 121263; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 132047; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 161278; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 319187; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 319219; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 319596; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 319628; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 320265; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 320297; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 481354; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 481384; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 482564; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 482653; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 482677; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 482697; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 482748; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 767809; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1244498; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1563457; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1631377; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1750520; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1818572; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1864665; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1864687; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1864698; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1865830; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1865852; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1865863; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1867120; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2020492; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2161096; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2467916; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2480266; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2639840; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2683148; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2749074; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2750481; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2751120; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3130424; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3135252; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3138132; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3140838; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3142886; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3144702; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3148504; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3171088; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3171970; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3187216; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3188360; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3188646; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3189524; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3190490; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3192540; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3193550; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3195492; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3199560; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3211468; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3211610; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3212394; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3217884; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3219450; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3225880; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3227704; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3232992; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3235790; code bytes = 803040:Ta66,Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360TotalSecurity" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp, 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp") Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360 Internet Security" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp, 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp") Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PSafe Antivirus" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp, 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp") Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360 Internet Security 2013" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp, 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp") Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp, 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp") Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\safebox" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00001248.00000001.113207.0AC70000.00000004.mdmp, 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp, 00000000-00001248.00000003.122587.0AC70000.00000004.mdmp") Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PSafe Total" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00001248.00000001.113207.0AC70000.00000004.mdmp, 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp, 00000000-00001248.00000003.122587.0AC70000.00000004.mdmp") Found string "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360SD" (Indicator: "software\microsoft\windows\currentversion\uninstall"; Source: "00000000-00001248.00000001.113207.0AC70000.00000004.mdmp, 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp, 00000000-00001248.00000003.122587.0AC70000.00000004.mdmp")41:T2f7e,"capcut_pro_9_4_0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000ffff00000000509f8f0038cffc762c37bf00bc9f8f0001000000e036bf002c37bf00e036bf00040000000400000000e08c7500100000bc9f8f0001000000e036bf00cd97fc769c97fc7671cc60d1b50f8375e036bf000000fc76000000003c43fd740000000080ee8975010000008005bd04f8e28c7500000000040000000000000048408b75f8e28c75c09f8f0080e81e76589cbf0080e81e76bc9f8f000000000080e81e76bcb2cbfffeffffff0000000000000000000000000500000088edc30002000000020000000a00000078edc30088edc300000000002499a7be40a28f00ddf3807534a08f000000000078edc3000a000000f8f3807578edc300 (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000053002a004100700070004400610043003a005c00550073006500720073005c0048004100500055004200570053005c0041007000700044006100740061005c004c006f00630061006c005c004d006900630072006f0000006f00660074005c00570069006e0064006f00770073005c004300610063006800650073000000330034002d004300360034003700450033003700430041003000440039007d002e0031002e007600650072003000780030003000300030003000300030003000300030003000300030003000350030002e006400620000004fe68075e99cfd760000000000000000ffffffff000000000000000000000000483fc3005c3fc300 (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000000000000000000000000000009873c6000000bf000000bf009873c6002861bf002861bf007f070000c000bf00b024c600cc9e8f00d2fbfa7601000000ff070000895700009873c6000000bf0000000000000000000000bf000000000000000000fc1d0000000000008805bd040000bf005071c6002861bf002861bf000000000000000000b024c600249f8f00d2fbfa7601000000ff070000d25700005071c6000000bf00000000008805bd0480a38f005ca38f0081f16c758805bd0498a88f0028a58f00c5f16c75d2570000d25700000000bf0088a38f001c6069750400000080a38f005c8313768005bd04a0907075000000003ca08f00cef8ffff (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f0000020000000000c3005840c300000000000000000000000000000000000000c3005840c3009a40c3000000000000000000000000000000000000000000000000008805bd04987880574f8c6244bb6371042380b109000000000000000000000d7600000000000000000000b109000000000024c60050a00d760000000000000000548d8f005243ff7643000000a88d8f0073f68075ea8d8f005c00000000000000fdfeff7f82f88075000000000ca1cbfffeffffff00000000000000000000000005000000e8ecc30002000000020000000a000000d8ecc300e8ecc30000000000748ba7bef08f8f00ddf38075e48d8f0000000000d8ecc3000a000000f8f38075d8ecc300 (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000008f005db19b759e13c700e0d15e73c0858f00388a8f00c3149c7500000000130100009e13c700e6149c75b48a8f00a213c700a1fd00000200000000000000cc858f00e0d15e73a0858f000000000024000000000000000000c0005870a9757813c000000000002400000000000000cc858f0088febf00ead15e73b88a8f000200000007000000080000000200000000000000000000000000000016888f000100000001000000d40c0000e00ec700e6149c75408b8f00fe0ec700000001000f0000000000000054868f0040d25e7328868f000000000024000000000000000000000000000000ffffffff0000000000000000000000002045c3003445c300 (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000074696f6e000000000000e99cfd760100000000000000708c8f00854a2b76df872376242038b27879c3007063c60058d8c400570000002710b655000000000000000000000000588c8f000c908f003df55d730000000000008f00881a8175b31a81757879c300000000008805bd040000000018908f008b842376330000000000000000000000807f2376b4852376000000000000b10900000000055fdd0140d8c4007063c6007879c3008805bd0430918f000c918f0081f16c758805bd0448968f00d8928f00c5f16c7502000000b21a6d755840c30038918f001c6069750400000030918f005c8313768005bd04a0907075000000000000000000000000 (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000008f00c4a56c7271d07e72fb8cfc760000000000000000c4a56c72d45d8f0000000000000000000000000071d07e7209000000882ebf0009000000c4a56c72a45d8f00908efe761fa26600feffffff3c5d8f00ec295d730c0c0000705d8f00ff295d7300000000e99cfd76000000000000000000000000000000004bc1b655853060d1b05d8f00e98b5b7300000000c7c1b6550000000048608f00038c5b736c5d8f0000000000d85d8f00d05d8f0000000000010000000000000000000000000000000000000000000000d05d8f0000000000d85d8f0000000000000000000d3060d1d85d8f00dab980750000f876cc5d8f0000000000d45d8f0000000000 (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f000002000000000060d1feffffff74608f00d8183975020000000000000094608f0086913975340000c02c1863710000000000000000340000c0cf723c75c0618f000c903975f0eb5271a4186270ce723c75bc608f0000010000000000004e9039750000000000ffffffe0618f0025585c7398a0fd3c150d60d108618f00e0618f002f585c730200000097fdb6552c18637148585c73020000004500000000000000000000000000000098a0fd3c01000000000000000000000000010000000300000004000000010000000000000001cf6d6c0c6e496e6465780000000000000000000000000000000000000000000000000000010000000000000000020000000300000004 (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000000000000000a092c30050ffc70088e96d06e0f1c8000000000000000000a092c30098d7c700000000000200000054e96d0608bec6000000000000000000ff9ff8ff3000000001006d0688060000ff9ff8ff2c0000000100000088060000100000000100000018c5c700e05fc00040707b7664e96d0653bb717608bec6001400000088e96d0662bb7176000000000000000000000000e05fc00090ea6d0600000000bcea6d0608bec60088e96d0601000000300000001400000028000000e8067d31c8dbc000000000005ce8fe76eeb481759e03000048e145b808bec6000000000026b58175b85a73769e0300008ce76d061d16727608bec60008bec600 (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000877000a5110600a0160690d7877020694b700000000080281206802812065cf38f0002000000d8f38f0064f38f0048ff837080281206020000000000000000a0160624f48f00802812060000000000a0160624f48f0000f48f0020694b7018f48f0018f48f00611b887000000000791b88700200000060061206907452708042120600000000000000000000000070809b7060061206c028120600000000000000001300000000000000d8f38f000300000000000000906f9a70000612068028120630ff830000000000130000000000000000f48f000006120600a01606be1eb1700000000000a0160600a01606d1b94e56c0f48f00edc9877000000000 (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008805bd04000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002cbf8f005243ff764300000080bf8f0073f68075c2bf8f005c00000000000000fdfeff7f82f880750000000024e9c7fffeffffff00000000000000000000000005000000a8d6c70002000000020000000a00000098d6c700a8d6c700000000005cb9a7bec8c18f00ddf38075bcbf8f000000000098d6c7000a000000f8f3807598d6c700 (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000008f005db19b75ae96ca00e0d15e7398b78f0010bc8f00c3149c750000000013010000ae96ca00e6149c758cbc8f00b296ca00a1fd00000200000000000000a4b78f00e0d15e7378b78f000000000024000000000000000000c0005870a9757813c000000000002400000000000000a4b78f0088febf00ead15e7390bc8f0002000000070000000800000002000000000000000000000000000000eeb98f000100000001000000d40c0000f091ca00e6149c7518bd8f000e92ca00000001000f000000000000002cb88f0040d25e7300b88f000000000024000000000000000000000000000000ffffffff000000000000000000000000b03dc300c43dc300 (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000074696f6e000000000000e99cfd76010000000000000048be8f00854a2b76df8723761c1238b27879c300c862c6007879c300c862c6005f22b655000000008cbe8f005700000000000000000000003df55d730000000000008f00881a8175b31a81757879c300b0d7c50000000000000000008805bd048b84237633000000a46d38b24cc28f000000000000000000000000000000000000000000055fdd0120a3c800c862c6007879c3008805bd0408c38f00e4c28f0081f16c758805bd0420c88f00b0c48f00c5f16c7502000000b21a6d750000000010c38f001c6069750400000008c38f005c8313768005bd04a0907075000000000000000000000000 (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000fd76dcf0c6005ca18f0000000000e902fd76000000000000000001fcf06f080600000000000001fcf06f000000003900c6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d56f0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000004ca18f00d9cd60d1d040c60034a18f00b487fc76448509770000000000000000000000000000000001000000bd48fe76000000000100000008000000d040c60060a18f00c28f82750000d56f00000000 (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000000005900000050bf8f0050abc7005830c70a0000000000000100feffffffd0075d006002bf009295b64de8b98f00761dfc7644bf8f00000000008805bd04fefffffff0be8f0074589c73f8116c73000000000000000000008f0040808273f8116c73aa736c73f000c400f044cd0050abc7004f0000000000a00f24bf8f005243ff764300000078bf8f0073f68075babf8f005c00000000000000fdfeff7f82f8807500000000849dc5fffeffffff000000000000000000000000050000004022ca0002000000020000000a0000003022ca004022ca0000000000a4b9a7bec0c18f00ddf38075b4bf8f00000000003022ca000a000000f8f380753022ca00 (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000008f005db19b75966ac70ae0d15e7390b78f0008bc8f00c3149c750000000013010000966ac70ae6149c7584bc8f009a6ac70aa1fd000002000000000000009cb78f00e0d15e7370b78f000000000024000000000000000000c0005870a9757813c0000000000024000000000000009cb78f0088febf00ead15e7388bc8f0002000000070000000800000002000000000000000000000000000000e6b98f000100000001000000d40c0000d865c70ae6149c7510bd8f00f665c70a000001000f0000000000000024b88f0040d25e73f8b78f000000000024000000000000000000000000000000ffffffff000000000000000000000000e84ccd00fc4ccd00 (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f000002000000000074696f6e000000000000e99cfd76010000000000000040be8f00854a2b76df872376141238b27879c3006860c70ae83fcb00570000005722b65500000000000000000000000028be8f00dcc18f003df55d730000000000008f00881a8175b31a81757879c300000000008805bd0400000000e8c18f008b842376330000000000000000000000807f2376b485237629abfe7624bf8f0021000000055fdd01d03fcb006860c70a7879c3008805bd0400c38f00dcc28f0081f16c758805bd0418c88f00a8c48f00c5f16c7502000000b21a6d755900000008c38f001c6069750400000000c38f005c8313768005bd04a0907075000000009295b64de8b98f00 (UID: 00000000-00001248)42:T4b7,Found string "nslookup: WSAStartup:%0" (Indicator: "nslookup"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "nslookup [-opt ...] # interactive mode using default server" (Indicator: "nslookup"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "nslookup [-opt ...] - server # interactive mode using 'server'" (Indicator: "nslookup"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "nslookup [-opt ...] host # just look up 'host' using default server" (Indicator: "nslookup"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "nslookup [-opt ...] host server # just look up 'host' using 'server'" (Indicator: "nslookup"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "nslookup" (Indicator: "nslookup"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "nslookup.exe" (Indicator: "nslookup"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "nslookup.exe.mui" (Indicator: "nslookup"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp")43:T4d0,Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "capcut_pro_9_4_0.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "capcut_pro_9_4_0.exe") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "capcut_pro_9_4_0.exe") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "capcut_pro_9_4_0.exe") Found reference to API "RtlVerifyVersionInfo" (Indicator: "VerifyVersionInfo"; File: "capcut_pro_9_4_0.exe") Found reference to API "350286,3284,3024,,RtlGetVersion,NTDLL.dll,"00:28:56.890",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00001248.00000000.111288.00BF0000.00000004.mdmp, 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp, 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp") Found reference to API "3024,,RtlGetVersion,NTDLL.dll,"00:28:56.812",RX=0,PX=0" (Indicator: "GetVersion"; Source: "00000000-00001248.00000000.111288.00BF0000.00000004.mdmp, 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp, 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp")44:T77b,"capcut_pro_9_4_0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "capcut_pro_9_4_0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\CLIENTS\STARTMENUINTERNET"; Key: ""; Value: "") "capcut_pro_9_4_0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTP"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: ""; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\MICROSOFT EDGE\CAPABILITIES"; Key: "HIDDEN"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\URLASSOCIATIONS"; Key: ""; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES\URLASSOCIATIONS"; Key: "HTTP"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: ""; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\CAPABILITIES"; Key: "HIDDEN"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\GOOGLE CHROME\SHELL\OPEN\COMMAND"; Key: ""; Value: "") "capcut_pro_9_4_0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLIENTS\STARTMENUINTERNET\IEXPLORE.EXE\SHELL\OPEN\COMMAND"; Key: ""; Value: "")45:T507,"capcut_pro_9_4_0.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\OUTLOOK.EXE") "capcut_pro_9_4_0.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\OUTLOOK.EXE"; Key: "PATH") "capcut_pro_9_4_0.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\PSAFE ANTIVIRUS") "capcut_pro_9_4_0.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\PSAFE TOTAL") "capcut_pro_9_4_0.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\360TOTALSECURITY") "capcut_pro_9_4_0.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\360 INTERNET SECURITY") "capcut_pro_9_4_0.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\360 INTERNET SECURITY 2013") "capcut_pro_9_4_0.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\SAFEBOX") "capcut_pro_9_4_0.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\360游戏保险箱") "capcut_pro_9_4_0.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\360安全卫士") "capcut_pro_9_4_0.exe" (Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\UNINSTALL\360SD")46:Tc69,"capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-0 (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter atlthunk.dll (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter api-ms-win-core-string-l1-1-0 (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter api-ms-win-core-datetime-l1-1-1 (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-obsolete-l1-2-0 (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter msIso.dll (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter MSHTML.dll (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter WLDP.DLL (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter mshtml.dll (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter ext-ms-win-ntuser-touch-hittest-l1-1-0.dll (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter MLANG.dll (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter WININET.dll (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter iphlpapi.dll (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2 (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter api-ms-win-rtcore-ntuser-wmpointer-l1-1-0.dll (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter ieframe.dll (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter WINMM.dll (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "LoadLibrary" with a parameter jscript9.dll (UID: 00000000-00001248)47:T24fb,"capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter AtlThunk_AllocateData (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter AtlThunk_InitData (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter AtlThunk_DataToCode (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter AtlThunk_FreeData (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter InitCommonControlsEx (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter IUnknown_QueryService (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter ConvertSidToStringSidW (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter ConvertStringSecurityDescriptorToSecurityDescriptorW (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter EnumSystemLocalesEx (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter GetDateFormatEx (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter GetTimeFormatEx (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter GetUserDefaultLocaleName (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter IsValidLocaleName (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter LCIDToLocaleName (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter LocaleNameToLCID (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter CoInitializeEx (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter SHGetValueW (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter UrlMkGetSessionOption (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter CoTaskMemAlloc (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter CoTaskMemFree (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter ReleaseBindInfo (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter IUnknown_Set (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter IUnknown_SetSite (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter CreateURLMonikerEx (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter CreateAsyncBindCtxEx (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter RegisterBindStatusCallback (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter CoInternetCreateSecurityManager (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter CoInternetIsFeatureEnabled (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter SHStrDupW (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter CLSIDFromString (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter HeapSetInformation (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter SetCoalescableTimer (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter ProgIDFromCLSID (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter TravelLogCreateInstance (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter WldpGetLockdownPolicy (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter RevokeBindStatusCallback (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter CoInternetCreateZoneManager (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter RegisterTouchHitTestingWindow (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter VariantToStringWithDefault (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter GetUserNameExW (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter PSCreateMemoryPropertyStore (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter GetUrlCacheEntryBinaryBlob (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter CoInternetQueryInfo (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter PropVariantClear (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter SHCreateMemStream (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter IStream_Reset (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter IStream_Size (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter IStream_Read (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter CommitUrlCacheEntryBinaryBlob (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter GetUrlCacheEntryInfoExW (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter IsWindowRedirectedForPrint (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter LoadLibraryExW (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter AddDllDirectory (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter if_nametoindex (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter RtlVerifyVersionInfo (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter AppPolicyGetThreadInitializationType (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter GetCurrentInputMessageSource (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter QueryProtectedPolicy (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter PlaySoundW (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter ResolveDelayLoadedAPI (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter ResolveDelayLoadsFromDll (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter JsVarToExtension (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter JsVarAddRef (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter JsVarRelease (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter AddFontMemResourceEx (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter RemoveFontMemResourceEx (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter TTLoadEmbeddedFont (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "GetProcAddress" with a parameter TTDeleteEmbeddedFont (UID: 00000000-00001248)48:T6dea,Found reference to API (Indicator: "CloseServiceHandle"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "QueryServiceStatusEx"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "RegDeleteValueW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "RegQueryInfoKeyW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CryptEnumProvidersW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CryptReleaseContext"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "OpenSCManagerW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CryptExportKey"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CryptSignHashW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "ReportEventW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CryptDestroyKey"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "RegCreateKeyExW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "RegisterEventSourceW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CryptCreateHash"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "DeregisterEventSource"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "RegSetValueExW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CryptSetHashParam"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "RegEnumKeyExW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CryptDestroyHash"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "RegDeleteKeyW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "RegCloseKey"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CryptGetUserKey"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "StartServiceW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CryptAcquireContextW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "RegQueryValueExW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CryptGetProvParam"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "RegOpenKeyExW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "OpenServiceW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "RegEnumKeyW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CryptDecrypt"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CertGetEnhancedKeyUsage"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CertGetCertificateContextProperty"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CertGetIntendedKeyUsage"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CertOpenSystemStoreW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CertDuplicateCertificateContext"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CertEnumCertificatesInStore"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CertFindCertificateInStore"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CertFreeCertificateContext"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CertOpenStore"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CertCloseStore"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CreateCompatibleBitmap"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "DeleteDC"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "BitBlt"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetDeviceCaps"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetObjectW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CreateCompatibleDC"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "DeleteObject"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CreateSolidBrush"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SelectObject"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetStockObject"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "TlsAlloc"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetModuleHandleExW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "LocalFree"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CreateFileW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SetStdHandle"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "InitializeSListHead"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "DecodePointer"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "FileTimeToSystemTime"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "UnhandledExceptionFilter"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "EnumSystemLocalesW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetDiskFreeSpaceExW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "HeapAlloc"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetModuleHandleW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SetFilePointer"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "LCIDToLocaleName"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SetErrorMode"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "lstrcmpiW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GlobalLock"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "FindFirstFileExW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetLocaleInfoW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "ReadFile"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CreateFiber"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetDriveTypeW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "VerSetConditionMask"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "FlushInstructionCache"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetSystemDirectoryW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetACP"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "DeleteFiber"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "LoadLibraryA"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "WriteConsoleW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "ConvertFiberToThread"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "VirtualFree"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetTempPathW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "TlsSetValue"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "OutputDebugStringW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetFileType"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "FormatMessageW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "lstrcmpW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "ResetEvent"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "ReadConsoleA"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CreateProcessW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetUserDefaultLCID"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "MoveFileExW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "InterlockedPopEntrySList"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "FindNextFileW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CreateEventW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "InitializeCriticalSectionAndSpinCount"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CreateThread"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "FreeLibrary"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetProcAddress"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SetEvent"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetConsoleOutputCP"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "RaiseException"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetFullPathNameW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "LoadLibraryExW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GlobalHandle"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "QueryPerformanceFrequency"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "LCMapStringEx"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "MulDiv"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CompareFileTime"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetVersionExW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SizeofResource"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "TlsFree"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "ExitThread"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "VirtualAlloc"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "FindResourceW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "ConvertThreadToFiber"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "DeleteFileW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "LCMapStringW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "IsProcessorFeaturePresent"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetSystemTime"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "IsValidCodePage"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SwitchToFiber"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetCPInfo"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "HeapFree"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "ExitProcess"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GlobalAlloc"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "AcquireSRWLockExclusive"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GlobalFree"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "InitializeCriticalSectionEx"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "IsValidLocale"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CompareStringW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "RtlUnwind"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "LockResource"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "IsDebuggerPresent"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetFileAttributesExW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetOEMCP"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetStdHandle"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetEnvironmentVariableA"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "IsBadWritePtr"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "LoadLibraryW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetCurrentDirectoryW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "FindClose"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "Sleep"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SleepEx"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetLastError"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GlobalUnlock"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetDateFormatW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SetFileAttributesW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "TerminateThread"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "ExpandEnvironmentStringsW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SetLastError"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SetFilePointerEx"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "WriteFile"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetStartupInfoW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "TerminateProcess"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CreateMutexW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "HeapDestroy"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "VerifyVersionInfoW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SetEnvironmentVariableW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CloseHandle"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetConsoleMode"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetSystemDefaultUILanguage"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "ReadConsoleW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "HeapSize"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "FindResourceExW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetTimeZoneInformation"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetExitCodeProcess"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "LoadResource"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "WaitForSingleObjectEx"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "LoadLibraryExA"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "RemoveDirectoryW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "PeekNamedPipe"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "FreeLibraryAndExitThread"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "EncodePointer"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetTimeFormatW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "QueryPerformanceCounter"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SystemTimeToFileTime"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "TlsGetValue"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SetConsoleMode"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "IsWow64Process"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "ReleaseSRWLockExclusive"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetStringTypeW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetTickCount"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SystemTimeToTzSpecificLocalTime"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetUserDefaultUILanguage"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SetEndOfFile"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "InterlockedPushEntrySList"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "OpenProcess"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SysAllocStringLen"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SysFreeString"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetErrorInfo"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "VariantChangeType"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SysAllocString"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SysStringLen"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "VariantInit"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "VariantClear"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "ShellExecuteW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "Shell_NotifyIconW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SHBrowseForFolderW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SHGetSpecialFolderPathW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SHGetPathFromIDListW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "ShellExecuteExW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CommandLineToArgvW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SHGetSpecialFolderLocation"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "AssocQueryStringW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CreateAcceleratorTableW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetUserObjectInformationW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "LoadCursorW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "UnregisterClassW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "ReleaseCapture"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "ClientToScreen"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "MessageBoxW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "ShowWindow"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "KillTimer"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "RedrawWindow"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SetForegroundWindow"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetFocus"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "DestroyAcceleratorTable"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetWindowRect"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetWindowTextLengthW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "BeginPaint"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "LoadImageW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "DestroyWindow"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetSysColor"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "InvalidateRect"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CharNextW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetDC"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "PeekMessageW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SetWindowTextW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "AppendMenuW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "MoveWindow"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "DefWindowProcW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CreatePopupMenu"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "ReleaseDC"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SetCapture"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "PostQuitMessage"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetProcessWindowStation"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SetWindowPos"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CreateWindowExW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SetFocus"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "ScreenToClient"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "IsWindow"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "IsChild"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetWindowTextW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetClientRect"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetDesktopWindow"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetWindow"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "DestroyMenu"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "MapWindowPoints"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "DispatchMessageW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetParent"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "MapDialogRect"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "FillRect"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "TranslateMessage"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "InternetSetOptionW"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "gethostname"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "getsockopt"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "WSAGetLastError"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "closesocket"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "WSACleanup"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "ioctlsocket"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "WSASetLastError"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "WSAStartup"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "htonl"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "getsockname"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "WSAIoctl"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "getpeername"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "recvfrom"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "ntohs"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "__WSAFDIsSet"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "htons"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "BCryptGenRandom"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CoTaskMemFree"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "OleInitialize"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CreateStreamOnHGlobal"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CLSIDFromString"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CoCreateInstance"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CoUninitialize"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "StringFromGUID2"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CoTaskMemAlloc"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "OleUninitialize"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CoGetClassObject"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CoTaskMemRealloc"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CoInitialize"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "SleepConditionVariableCS"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "WakeAllConditionVariable"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "AddDllDirectory"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "RtlVerifyVersionInfo"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "FlsAlloc"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "FlsFree"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "FlsGetValue"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "FlsSetValue"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "AreFileApisANSI"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "CompareStringEx"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "EnumSystemLocalesEx"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetDateFormatEx"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetLocaleInfoEx"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetTimeFormatEx"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "GetUserDefaultLocaleName"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "IsValidLocaleName"; File: "capcut_pro_9_4_0.exe") Found reference to API (Indicator: "LocaleNameToLCID"; File: "capcut_pro_9_4_0.exe")49:T36a8,"Software\Media Get LLC\MediaGet2\" in Source: 26611-452-004572B8 "Software\" in Source: 26611-458-004559B8 "SOFTWARE\" in Source: 26611-458-004559B8 "Software\Media Get LLC\MediaGet2-systemScope\" in Source: 26611-531-00457247 "SOFTWARE\Clients\StartMenuInternet" in Source: 26611-557-004721D9 "SOFTWARE\Clients\StartMenuInternet\" in Source: 26611-557-004721D9 "Software\Policies\Microsoft\Internet Explorer\Persistence\1" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Persistence\0" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{2593F8B9-4EAF-457C-B68" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\PrefetchPrerender" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\PhishingFilter" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\IEDevTools\Options" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Settings" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\International\Scripts" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Zoom" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Persistence\4" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Persistence\3" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Persistence\2" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\DOMStorage" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Classes\PROTOCOLS\Filter\text/html" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp "Software\Media Get LLC\MediaGet2-systemScope\" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.010C9000.00000002.mdmp "Software\Media Get LLC\MediaGet2-systemScope\mediaget_info" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Media Get LLC\MediaGet2\" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.010C9000.00000002.mdmp "Software\Policies\Microsoft\Internet Explorer\BrowserEmulation" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Recovery" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000001.113207.0AC70000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.0AC70000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360SD" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360TotalSecurity" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360 Internet Security" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PSafe Antivirus" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360 Internet Security 2013" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PSafe Antivirus" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\safebox" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PSafe Total" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Photos_2019.18112.20010.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00001248.00000001.113207.0AC70000.00000004.mdmp 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftSolitaireCollection_4.2.11280.0_x86__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00001248.00000001.113207.0AC70000.00000004.mdmp 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\safebox" in Source: 00000000-00001248.00000001.113207.0AC70000.00000004.mdmp 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp 00000000-00001248.00000003.122587.0AC70000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PSafe Total" in Source: 00000000-00001248.00000001.113207.0AC70000.00000004.mdmp 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp 00000000-00001248.00000003.122587.0AC70000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360SD" in Source: 00000000-00001248.00000001.113207.0AC70000.00000004.mdmp 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp 00000000-00001248.00000003.122587.0AC70000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360 Internet Security 2013" in Source: 00000000-00001248.00000001.113207.0AC70000.00000004.mdmp 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp 00000000-00001248.00000003.122587.0AC70000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360TotalSecurity" in Source: 00000000-00001248.00000001.113207.0AC70000.00000004.mdmp 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp 00000000-00001248.00000003.122587.0AC70000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360 Internet Security" in Source: 00000000-00001248.00000001.113207.0AC70000.00000004.mdmp 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp 00000000-00001248.00000003.122587.0AC70000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.BingWeather_4.28.3242.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00001248.00000001.113207.0B030000.00000004.mdmp 00000000-00001248.00000002.115128.0B030000.00000004.mdmp 00000000-00001248.00000003.122587.0B030000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsMaps_5.1809.2762.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00001248.00000001.113207.0B030000.00000004.mdmp 00000000-00001248.00000002.115128.0B030000.00000004.mdmp 00000000-00001248.00000003.122587.0B030000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Getstarted_6.15.12641.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00001248.00000001.113207.0B030000.00000004.mdmp 00000000-00001248.00000002.115128.0B030000.00000004.mdmp 00000000-00001248.00000003.122587.0B030000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.GetHelp_10.1706.13371.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00001248.00000001.113207.0B030000.00000004.mdmp 00000000-00001248.00000002.115128.0B030000.00000004.mdmp 00000000-00001248.00000003.122587.0B030000.00000004.mdmp "The COM sub system is suppressing duplicate event log entries for a duration of %1 seconds. The suppression timeout can be controlled by a REG_DWORD value named %2 under the following registry key: HKLM\%3." in Source: 00000000-00001248.00000002.115128.066E0000.00000002.mdmp "Registry file %1 is loaded at HKU\%2." in Source: 00000000-00001248.00000002.115128.066E0000.00000002.mdmp4a:T658,Process capcut_pro_9_4_0.exe created mutex with name "\Sessions\1\BaseNamedObjects\MSIMGSIZECacheMutex" Process capcut_pro_9_4_0.exe created mutex with name "Local\SM0:1248:168:WilStaging_02" Process capcut_pro_9_4_0.exe created mutex with name "MSIMGSIZECacheMutex" Process capcut_pro_9_4_0.exe created mutex with name "mediaget-installer-singleapplication-mutex" Process capcut_pro_9_4_0.exe created mutex with name "SM0:1248:64:WilError_01" Process capcut_pro_9_4_0.exe created mutex with name "SM0:1248:168:WilStaging_02" Process capcut_pro_9_4_0.exe created mutex with name "Local\SM0:1248:64:WilError_01" Process capcut_pro_9_4_0.exe created mutex with name "Local\ZonesLockedCacheCounterMutex" Process capcut_pro_9_4_0.exe created mutex with name "Local\ZonesCacheCounterMutex" Process capcut_pro_9_4_0.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1248:168:WilStaging_02" Process capcut_pro_9_4_0.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1248:168:WilStaging_02" Process capcut_pro_9_4_0.exe created mutex with name "\Sessions\1\BaseNamedObjects\mediaget-installer-singleapplication-mutex" Process capcut_pro_9_4_0.exe created mutex with name "\Sessions\1\BaseNamedObjects\SM0:1248:64:WilError_01" Process capcut_pro_9_4_0.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesCacheCounterMutex" Process capcut_pro_9_4_0.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\ZonesLockedCacheCounterMutex" Process capcut_pro_9_4_0.exe created mutex with name "\Sessions\1\BaseNamedObjects\Local\SM0:1248:64:WilError_01"4b:T5ed5,"Software\Media Get LLC\MediaGet2-systemScope\" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp "Software\Media Get LLC\MediaGet2-systemScope\mediaget_info" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp "Software\Media Get LLC\MediaGet2\" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Persistence\1" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Persistence\0" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{2593F8B9-4EAF-457C-B68" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\PrefetchPrerender" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\PhishingFilter" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\IEDevTools\Options" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Settings" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\International\Scripts" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Zoom" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Persistence\4" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Persistence\3" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Persistence\2" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\DOMStorage" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp "SOFTWARE\Classes\PROTOCOLS\Filter\text/html" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00001248.00000000.111288.00BF0000.00000004.mdmp "Software\Media Get LLC\MediaGet2-systemScope\" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "Software\Media Get LLC\MediaGet2-systemScope\mediaget_info" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "Software\Media Get LLC\MediaGet2\" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360SD" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360TotalSecurity" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360 Internet Security" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PSafe Antivirus" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360 Internet Security 2013" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PSafe Antivirus" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\safebox" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PSafe Total" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Persistence\1" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Persistence\0" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{2593F8B9-4EAF-457C-B68" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\BrowserEmulation" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Recovery" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\PrefetchPrerender" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\PhishingFilter" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\IEDevTools\Options" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Settings" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\International\Scripts" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Zoom" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Persistence\4" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Persistence\3" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Persistence\2" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\DOMStorage" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "SOFTWARE\Classes\PROTOCOLS\Filter\text/html" in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\safebox" in Source: 00000000-00001248.00000001.113207.0AC70000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PSafe Total" in Source: 00000000-00001248.00000001.113207.0AC70000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360SD" in Source: 00000000-00001248.00000001.113207.0AC70000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360 Internet Security 2013" in Source: 00000000-00001248.00000001.113207.0AC70000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360TotalSecurity" in Source: 00000000-00001248.00000001.113207.0AC70000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360" in Source: 00000000-00001248.00000001.113207.0AC70000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360 Internet Security" in Source: 00000000-00001248.00000001.113207.0AC70000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Photos_2019.18112.20010.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00001248.00000001.113207.0AC70000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftSolitaireCollection_4.2.11280.0_x86__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00001248.00000001.113207.0AC70000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.BingWeather_4.28.3242.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00001248.00000001.113207.0B030000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsMaps_5.1809.2762.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00001248.00000001.113207.0B030000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Getstarted_6.15.12641.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00001248.00000001.113207.0B030000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.GetHelp_10.1706.13371.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00001248.00000001.113207.0B030000.00000004.mdmp "Software\Media Get LLC\MediaGet2-systemScope\" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "Software\Media Get LLC\MediaGet2-systemScope\mediaget_info" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "Software\Media Get LLC\MediaGet2\" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360SD" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360TotalSecurity" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360 Internet Security" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PSafe Antivirus" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360 Internet Security 2013" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PSafe Antivirus" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\safebox" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PSafe Total" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Persistence\1" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Persistence\0" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{2593F8B9-4EAF-457C-B68" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\BrowserEmulation" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Recovery" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\PrefetchPrerender" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\PhishingFilter" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\IEDevTools\Options" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Settings" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\International\Scripts" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Zoom" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Persistence\4" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Persistence\3" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Persistence\2" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\DOMStorage" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "SOFTWARE\Classes\PROTOCOLS\Filter\text/html" in Source: 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp "The COM sub system is suppressing duplicate event log entries for a duration of %1 seconds. The suppression timeout can be controlled by a REG_DWORD value named %2 under the following registry key: HKLM\%3." in Source: 00000000-00001248.00000002.115128.066E0000.00000002.mdmp "Registry file %1 is loaded at HKU\%2." in Source: 00000000-00001248.00000002.115128.066E0000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\safebox" in Source: 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PSafe Total" in Source: 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360SD" in Source: 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360 Internet Security 2013" in Source: 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360TotalSecurity" in Source: 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360" in Source: 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360 Internet Security" in Source: 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Windows.Photos_2019.18112.20010.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.MicrosoftSolitaireCollection_4.2.11280.0_x86__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.BingWeather_4.28.3242.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00001248.00000002.115128.0B030000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsMaps_5.1809.2762.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00001248.00000002.115128.0B030000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Getstarted_6.15.12641.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00001248.00000002.115128.0B030000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.GetHelp_10.1706.13371.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00001248.00000002.115128.0B030000.00000004.mdmp "Software\Media Get LLC\MediaGet2-systemScope\" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Media Get LLC\MediaGet2-systemScope\mediaget_info" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Media Get LLC\MediaGet2\" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360SD" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360TotalSecurity" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360 Internet Security" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PSafe Antivirus" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360 Internet Security 2013" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PSafe Antivirus" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\safebox" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PSafe Total" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Persistence\1" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Persistence\0" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Path=C:\ProgramData\Oracle\Java\javapath;C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\System32\Wbem;C:\WINDOWS\System32\W\Registry\Machine\Software\Classes\WOW6432Node\CLSID\{2593F8B9-4EAF-457C-B68" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "istry\Machine\Software\Classes\CLSID\{FA445657-9379-11D6-B41A-00065B83EE53}" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\BrowserEmulation" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Recovery" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\PrefetchPrerender" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\PhishingFilter" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\IEDevTools\Options" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Settings" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\International\Scripts" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Zoom" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Persistence\4" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Persistence\3" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Persistence\2" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\DOMStorage" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Classes\PROTOCOLS\Filter\text/html" in Source: 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "Software\Google\Chrome" in Source: 00000000-00001248.00000003.122587.010C9000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00001248.00000003.122587.010C9000.00000002.mdmp "Software\" in Source: 00000000-00001248.00000003.122587.010C9000.00000002.mdmp "SOFTWARE\" in Source: 00000000-00001248.00000003.122587.010C9000.00000002.mdmp "Software\Media Get LLC\MediaGet2-systemScope\" in Source: 00000000-00001248.00000003.122587.010C9000.00000002.mdmp "Software\Media Get LLC\MediaGet2\" in Source: 00000000-00001248.00000003.122587.010C9000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall\" in Source: 00000000-00001248.00000003.122587.010C9000.00000002.mdmp "SOFTWARE\Clients\StartMenuInternet" in Source: 00000000-00001248.00000003.122587.010C9000.00000002.mdmp "SOFTWARE\Clients\StartMenuInternet\" in Source: 00000000-00001248.00000003.122587.010C9000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\safebox" in Source: 00000000-00001248.00000003.122587.0AC70000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PSafe Total" in Source: 00000000-00001248.00000003.122587.0AC70000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360SD" in Source: 00000000-00001248.00000003.122587.0AC70000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360 Internet Security 2013" in Source: 00000000-00001248.00000003.122587.0AC70000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360TotalSecurity" in Source: 00000000-00001248.00000003.122587.0AC70000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360" in Source: 00000000-00001248.00000003.122587.0AC70000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360 Internet Security" in Source: 00000000-00001248.00000003.122587.0AC70000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.BingWeather_4.28.3242.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00001248.00000003.122587.0B030000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.WindowsMaps_5.1809.2762.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00001248.00000003.122587.0B030000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.Getstarted_6.15.12641.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00001248.00000003.122587.0B030000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Repository\Packages\Microsoft.GetHelp_10.1706.13371.0_x64__8wekyb3d8bbwe\App\Capabilities" in Source: 00000000-00001248.00000003.122587.0B030000.00000004.mdmp4c:T5a1,"GET /ld/get_data.php?id=0&alreadyInstalled=0&vi=0&browsersInstalled=chrome,iexplore,edge&defaultBrowser=edge&bundlesInstalled=&installerVersion=502&os=10.0.16299&isOs64bit=1&lang=en-US HTTP/1.1 Host: mediaget.com User-Agent: m_installer Accept: */*" Response ==> HTTP/1.1 200 OK Alt-Svc: h3=":8443"; ma=2592000 Content-Type: text/xml;charset=UTF-8 Date: Sun 18 Oct 2026 13:33:01 GMT Server: nginx/1.28.0 Set-Cookie: cookie=be48ebf731a67046; Path=/; HttpOnly; Secure; SameSite=None Transfer-Encoding: chunked with response body ==>3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D227574662D38223F3E0A3C706172616D65746572733E3C62756E646C65735F6C697374....... "GET /installer/binaries/html_new_transl_2026-10-16.7z HTTP/1.1 Host: mediaget.com User-Agent: m_installer Accept: */*" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Alt-Svc: h3=":8443"; ma=2592000 Content-Length: 1106750 Content-Type: application/x-7z-compressed Date: Sun 18 Oct 2026 13:33:02 GMT Etag: "39e1966b69671e1225db23a7434f4075" Last-Modified: Fri 16 Oct 2026 09:30:08 GMT Server: nginx/1.29.8 Set-Cookie: cookie=6835fc9c5ba3d0d1; Path=/; HttpOnly; Secure; SameSite=None X-Amz-Request-Id: tx00000200d47738f67660f-006ad1f185-1a9e864f2-default X-Amz-Storage-Class: STANDARD X-Rgw-Object-Type: Normal with response body ==>377AC2BCC2AF271C00040D3BC3BF23C3BAC3A210000000000024000000000000000EC2A43EC29AC3A0C385C3BDC380045D001E190927C297184841C2A913C28B.......4d:T1527,"capcut_pro_9_4_0.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 73470000 "capcut_pro_9_4_0.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75720000 "capcut_pro_9_4_0.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75720000 "capcut_pro_9_4_0.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-0" at base 75720000 "capcut_pro_9_4_0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75720000 "capcut_pro_9_4_0.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 733f0000 "capcut_pro_9_4_0.exe" loaded module "ATLTHUNK.DLL" at base 733e0000 "capcut_pro_9_4_0.exe" loaded module "KERNEL32.DLL" at base 75350000 "capcut_pro_9_4_0.exe" loaded module "COMCTL32.DLL" at base 723e0000 "capcut_pro_9_4_0.exe" loaded module "%WINDIR%\SYSWOW64\IEFRAME.DLL" at base 72870000 "capcut_pro_9_4_0.exe" loaded module "USER32.DLL" at base 754a0000 "capcut_pro_9_4_0.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 75690000 "capcut_pro_9_4_0.exe" loaded module "RPCRT4.DLL" at base 739c0000 "capcut_pro_9_4_0.exe" loaded module "GDI32.DLL" at base 73bf0000 "capcut_pro_9_4_0.exe" loaded module "%WINDIR%\SYSTEM32\DATAEXCHANGE.DLL" at base 72370000 "capcut_pro_9_4_0.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 75080000 "capcut_pro_9_4_0.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 766a0000 "capcut_pro_9_4_0.exe" loaded module "%WINDIR%\SYSWOW64\WINDOWS.STORAGE.DLL" at base 760d0000 "capcut_pro_9_4_0.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 75350000 "capcut_pro_9_4_0.exe" loaded module "URLMON.DLL" at base 71b20000 "capcut_pro_9_4_0.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 75200000 "capcut_pro_9_4_0.exe" loaded module "SSPICLI.DLL" at base 739a0000 "capcut_pro_9_4_0.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 71ad0000 "capcut_pro_9_4_0.exe" loaded module "WINHTTP.DLL" at base 719f0000 "capcut_pro_9_4_0.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 71ad0000 "capcut_pro_9_4_0.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 71990000 "capcut_pro_9_4_0.exe" loaded module "KERNEL32" at base 75350000 "capcut_pro_9_4_0.exe" loaded module "API-MS-WIN-CORE-STRING-L1-1-0" at base 75720000 "capcut_pro_9_4_0.exe" loaded module "API-MS-WIN-CORE-DATETIME-L1-1-1" at base 75720000 "capcut_pro_9_4_0.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-2-0" at base 75720000 "capcut_pro_9_4_0.exe" loaded module "API-MS-WIN-CORE-URL-L1-1-0.DLL" at base 75720000 "capcut_pro_9_4_0.exe" loaded module "NTDLL.DLL" at base 76f80000 "capcut_pro_9_4_0.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 71cb0000 "capcut_pro_9_4_0.exe" loaded module "MSISO.DLL" at base 71800000 "capcut_pro_9_4_0.exe" loaded module "CRYPTBASE.DLL" at base 73990000 "capcut_pro_9_4_0.exe" loaded module "%WINDIR%\SYSWOW64\MSHTML.DLL" at base 70470000 "capcut_pro_9_4_0.exe" loaded module "MSHTML.DLL" at base 70470000 "capcut_pro_9_4_0.exe" loaded module "SHELL32.DLL" at base 73c60000 "capcut_pro_9_4_0.exe" loaded module "WLDP.DLL" at base 70420000 "capcut_pro_9_4_0.exe" loaded module "%WINDIR%\SYSTEM32\WINDOWSCODECS.DLL" at base 702b0000 "capcut_pro_9_4_0.exe" loaded module "%WINDIR%\SYSTEM32\MSIMTF.DLL" at base 702a0000 "capcut_pro_9_4_0.exe" loaded module "EXT-MS-WIN-NTUSER-TOUCH-HITTEST-L1-1-0.DLL" at base 754a0000 "capcut_pro_9_4_0.exe" loaded module "EXT-MS-WIN-CORE-RESOURCEPOLICY-L1-1-0.DLL" at base 6fab0000 "capcut_pro_9_4_0.exe" loaded module "D3D10WARP.DLL" at base 6f570000 "capcut_pro_9_4_0.exe" loaded module "PROPSYS.DLL" at base 71cb0000 "capcut_pro_9_4_0.exe" loaded module "SECUR32.DLL" at base 6f530000 "capcut_pro_9_4_0.exe" loaded module "MLANG.DLL" at base 6f4f0000 "capcut_pro_9_4_0.exe" loaded module "WININET.DLL" at base 736c0000 "capcut_pro_9_4_0.exe" loaded module "IPHLPAPI.DLL" at base 71aa0000 "capcut_pro_9_4_0.exe" loaded module "API-MS-WIN-APPMODEL-RUNTIME-L1-1-2" at base 76040000 "capcut_pro_9_4_0.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 6f440000 "capcut_pro_9_4_0.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 6f3f0000 "capcut_pro_9_4_0.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 75630000 "capcut_pro_9_4_0.exe" loaded module "API-MS-WIN-RTCORE-NTUSER-WMPOINTER-L1-1-0.DLL" at base 754a0000 "capcut_pro_9_4_0.exe" loaded module "IEFRAME.DLL" at base 72870000 "capcut_pro_9_4_0.exe" loaded module "%WINDIR%\SYSWOW64\JSCRIPT9.DLL" at base 6f060000 "capcut_pro_9_4_0.exe" loaded module "%WINDIR%\SYSWOW64\UIAUTOMATIONCORE.DLL" at base 6eec0000 "capcut_pro_9_4_0.exe" loaded module "WINMM.DLL" at base 6ee90000 "capcut_pro_9_4_0.exe" loaded module "JSCRIPT9.DLL" at base 6f060000 "capcut_pro_9_4_0.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 75b50000 "capcut_pro_9_4_0.exe" loaded module "T2EMBED.DLL" at base 6ee30000 "capcut_pro_9_4_0.exe" loaded module "DWRITE.DLL" at base 6fad0000 "capcut_pro_9_4_0.exe" loaded module "OLEAUT32.DLL" at base 75c50000 "capcut_pro_9_4_0.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-WINDOW-EXT-L1-1-0.DLL" at base 754a0000 "capcut_pro_9_4_0.exe" loaded module "EXT-MS-WIN-RTCORE-NTUSER-INTEGRATION-L1-1-0.DLL" at base 754a0000 "capcut_pro_9_4_0.exe" loaded module "API-MS-WIN-CORE-COM-L1-1-0.DLL" at base 766a00004e:T5c3,"capcut_pro_9_4_0.exe" touched "Microsoft Web Browser" (Path: "HKCU\WOW6432NODE\CLSID\{8856F961-340A-11D0-A96B-00C04FD705A2}") "capcut_pro_9_4_0.exe" touched "Shortcut" (Path: "HKCU\WOW6432NODE\CLSID\{00021401-0000-0000-C000-000000000046}\TREATAS") "capcut_pro_9_4_0.exe" touched "Computer" (Path: "HKCU\WOW6432NODE\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "capcut_pro_9_4_0.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\WOW6432NODE\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\TREATAS") "capcut_pro_9_4_0.exe" touched "HTML Document" (Path: "HKCU\WOW6432NODE\CLSID\{25336920-03F9-11CF-8FD0-00AA00686F13}\TREATAS") "capcut_pro_9_4_0.exe" touched "Microsoft HTML About Pluggable Protocol" (Path: "HKCU\WOW6432NODE\CLSID\{3050F406-98B5-11CF-BB82-00AA00BDCE0B}\TREATAS") "capcut_pro_9_4_0.exe" touched "CActiveIMMAppEx_Trident" (Path: "HKCU\WOW6432NODE\CLSID\{50D5107A-D278-4871-8989-F4CEAAF59CFC}\TREATAS") "capcut_pro_9_4_0.exe" touched "JScript Language" (Path: "HKCU\WOW6432NODE\CLSID\{842A1268-6E6A-465C-868F-8BC445B9828F}\TREATAS") "capcut_pro_9_4_0.exe" touched "UIAutomation Registrar Class" (Path: "HKCU\WOW6432NODE\CLSID\{6E29FABF-9977-42D1-8D0E-CA7E61AD87E6}\TREATAS") "capcut_pro_9_4_0.exe" touched "TF_ThreadMgr" (Path: "HKCU\WOW6432NODE\CLSID\{529A9E6B-6587-4F23-AB9E-9C7D683E3C50}\TREATAS") "capcut_pro_9_4_0.exe" touched "TF_InputProcessorProfiles" (Path: "HKCU\WOW6432NODE\CLSID\{33C53A50-F456-4884-B049-85FD643ECFED}\TREATAS")4f:T6e2,The input sample is signed with a certificate issued by "CN=YR2, O=Let's Encrypt, C=US" (SHA1: 9D:D9:B8:2E:FA:9A:83:AE:9D:17:EE:44:71:4E:C8:E6:54:6F:CE:A5; see report for more information) The input sample is signed with a certificate issued by "CN=Root YR, O=ISRG, C=US" (SHA1: 2D:74:D6:DF:D9:6E:EA:55:AD:7B:AA:FA:0D:3C:65:52:B2:DA:DC:37; see report for more information) The input sample is signed with a certificate issued by "CN=ISRG Root X1, O=Internet Security Research Group, C=US" (SHA1: AB:9D:02:63:24:4D:D0:32:6E:B6:70:15:70:5A:66:7E:79:CF:E9:98; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 3E:BB:EB:C2:7E:73:19:9F:14:66:6F:D6:FF:49:15:9A:D8:2A:84:6A; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: 07:89:4D:00:FC:19:4A:17:DB:27:3A:EB:5C:F8:FA:CE:F1:44:23:A4; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1, O="DigiCert Inc.", C=US" (SHA1: 51:D9:AB:DA:03:49:73:D8:4F:42:66:AC:A4:82:48:E6:B3:69:C4:39; see report for more information) The input sample is signed with a certificate issued by "CN=GoGetSSL G4 CS RSA4096 SHA256 2022 CA-1, O=EnVers Group SIA, C=LV" (SHA1: D0:20:7C:CE:3D:54:D7:26:09:81:CD:C8:10:12:3C:4C:F4:B6:4A:47; see report for more information)50:T4af,Found string "ystem.IsAttachment" (Source: "00000000-00001248.00000001.113207.05990000.00000002.mdmp") Found string "ystem.Message.AttachmentContents" (Source: "00000000-00001248.00000001.113207.05990000.00000002.mdmp") Found string "ystem.Message.AttachmentNames" (Source: "00000000-00001248.00000001.113207.05990000.00000002.mdmp") Found string "ystem.Message.HasAttachments" (Source: "00000000-00001248.00000001.113207.05990000.00000002.mdmp") file/memory contains long string(Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "<0s>: No attachments present+<0s>: Unsupported framebuffer configuration1<0s>: Attachments do not have the same dimensions" (Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "Outlook Attachment" (Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "Attachments:[To modify indexing settings on another user's mail folder, that user needs to be logged in.HIndexing of Outlook email has been disabled by the System Administrator.HIndexing of Offline files has been disabled by the System Administrator." (Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp")51:T313e,"archive.7z" has type "7-zip archive data version 0.4"- Location: [%TEMP%\mediaget-installer-tmp\archive.7z]- [targetUID: 00000000-00001248] "Montserrat-Regular.eot" has type "Embedded OpenType (EOT) Montserrat family"- Location: [%TEMP%\mediaget-installer-tmp\Montserrat-Regular.eot]- [targetUID: 00000000-00001248] "Montserrat-Bold.eot" has type "Embedded OpenType (EOT) Montserrat family"- Location: [%TEMP%\mediaget-installer-tmp\Montserrat-Bold.eot]- [targetUID: 00000000-00001248] "av360.png" has type "PNG image data 720 x 356 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\av360.png]- [targetUID: 00000000-00001248] "Roboto-Regular.eot" has type "Embedded OpenType (EOT) Roboto family"- Location: [%TEMP%\mediaget-installer-tmp\Roboto-Regular.eot]- [targetUID: 00000000-00001248] "VerdanaPro-Regular.eot" has type "Embedded OpenType (EOT) Verdana Pro family"- Location: [%TEMP%\mediaget-installer-tmp\VerdanaPro-Regular.eot]- [targetUID: 00000000-00001248] "translations.json" has type "JSON text data"- Location: [%TEMP%\mediaget-installer-tmp\translations.json]- [targetUID: 00000000-00001248] "install-lenta.png" has type "PNG image data 4189 x 678 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\install-lenta.png]- [targetUID: 00000000-00001248] "opera-empty.png" has type "PNG image data 720 x 444 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\opera-empty.png]- [targetUID: 00000000-00001248] "coc.png" has type "PNG image data 720 x 444 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\coc.png]- [targetUID: 00000000-00001248] "index.html" has type "HTML document ASCII text with very long lines (345) with CRLF line terminators"- Location: [%TEMP%\mediaget-installer-tmp\index.html]- [targetUID: 00000000-00001248] "install-lenta-3-308.png" has type "PNG image data 1901 x 308 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\install-lenta-3-308.png]- [targetUID: 00000000-00001248] "page-wait.png" has type "PNG image data 720 x 444 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\page-wait.png]- [targetUID: 00000000-00001248] "wps-ru.jpg" has type "JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 baseline precision 8 720x356 components 3"- Location: [%TEMP%\mediaget-installer-tmp\img2\wps-ru.jpg]- [targetUID: 00000000-00001248] "translations_old.json" has type "JSON text data"- Location: [%TEMP%\mediaget-installer-tmp\translations_old.json]- [targetUID: 00000000-00001248] "cancel-page-new1-ru.png" has type "PNG image data 720 x 444 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\cancel-page-new1-ru.png]- [targetUID: 00000000-00001248] "wps-en.jpg" has type "JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 baseline precision 8 720x356 components 3"- Location: [%TEMP%\mediaget-installer-tmp\img2\wps-en.jpg]- [targetUID: 00000000-00001248] "earnapp.png" has type "PNG image data 200 x 176 8-bit/color RGB non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\earnapp.png]- [targetUID: 00000000-00001248] "install-lenta-2-308.png" has type "PNG image data 2645 x 308 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\install-lenta-2-308.png]- [targetUID: 00000000-00001248] "wps.jpg" has type "JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 baseline precision 8 720x356 components 3"- Location: [%TEMP%\mediaget-installer-tmp\img2\wps.jpg]- [targetUID: 00000000-00001248] "page-wait.jpg" has type "JPEG image data JFIF standard 1.01 resolution (DPI) density 72x72 segment length 16 baseline precision 8 720x444 components 3"- Location: [%TEMP%\mediaget-installer-tmp\page-wait.jpg]- [targetUID: 00000000-00001248] "main.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\mediaget-installer-tmp\pages\main.html]- [targetUID: 00000000-00001248] "main-nobundles.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\mediaget-installer-tmp\pages\main-nobundles.html]- [targetUID: 00000000-00001248] "sslkey.txt" has type "ASCII text with CRLF LF line terminators"- Location: [%TEMP%\sslkey.txt]- [targetUID: 00000000-00001248] "index.template" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\mediaget-installer-tmp\index.template]- [targetUID: 00000000-00001248] "byte.html" has type "JavaScript source Unicode text UTF-8 text"- Location: [%TEMP%\mediaget-installer-tmp\pages\byte.html]- [targetUID: 00000000-00001248] "main-logo-white.png" has type "PNG image data 168 x 127 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\main-logo-white.png]- [targetUID: 00000000-00001248] "bdv.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\mediaget-installer-tmp\pages\bdv.html]- [targetUID: 00000000-00001248] "soax-mglogo.png" has type "PNG image data 207 x 54 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\soax-mglogo.png]- [targetUID: 00000000-00001248] "sx.html" has type "HTML document ASCII text with very long lines (366) with CRLF line terminators"- Location: [%TEMP%\mediaget-installer-tmp\pages\sx.html]- [targetUID: 00000000-00001248] "flk-start.html" has type "HTML document ASCII text with very long lines (369) with CRLF line terminators"- Location: [%TEMP%\mediaget-installer-tmp\pages\flk-start.html]- [targetUID: 00000000-00001248] "op.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\mediaget-installer-tmp\pages\op.html]- [targetUID: 00000000-00001248] "op-friendly.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\mediaget-installer-tmp\pages\op-friendly.html]- [targetUID: 00000000-00001248] "a3.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\mediaget-installer-tmp\pages\a3.html]- [targetUID: 00000000-00001248] "coc.html" has type "HTML document ASCII text with very long lines (313) with CRLF line terminators"- Location: [%TEMP%\mediaget-installer-tmp\pages\coc.html]- [targetUID: 00000000-00001248] "radio-checked.png" has type "PNG image data 14 x 13 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\radio-checked.png]- [targetUID: 00000000-00001248] "main-logo-compact.png" has type "PNG image data 170 x 31 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\main-logo-compact.png]- [targetUID: 00000000-00001248] "radio-unchecked.png" has type "PNG image data 14 x 13 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\radio-unchecked.png]- [targetUID: 00000000-00001248] "earn.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\mediaget-installer-tmp\pages\earn.html]- [targetUID: 00000000-00001248] "soax-schema.png" has type "PNG image data 542 x 38 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\soax-schema.png]- [targetUID: 00000000-00001248] "psdk.html" has type "HTML document ASCII text with very long lines (375) with CRLF line terminators"- Location: [%TEMP%\mediaget-installer-tmp\pages\psdk.html]- [targetUID: 00000000-00001248] "inf.html" has type "HTML document ASCII text with very long lines (360) with CRLF line terminators"- Location: [%TEMP%\mediaget-installer-tmp\pages\inf.html]- [targetUID: 00000000-00001248] "flk.html" has type "HTML document ASCII text with very long lines (369) with CRLF line terminators"- Location: [%TEMP%\mediaget-installer-tmp\pages\flk.html]- [targetUID: 00000000-00001248] "dat.html" has type "HTML document ASCII text with very long lines (372) with CRLF line terminators"- Location: [%TEMP%\mediaget-installer-tmp\pages\dat.html]- [targetUID: 00000000-00001248] "mgru.html" has type "HTML document ASCII text with very long lines (370) with CRLF line terminators"- Location: [%TEMP%\mediaget-installer-tmp\pages\mgru.html]- [targetUID: 00000000-00001248] "install-min.template" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\mediaget-installer-tmp\install-min.template]- [targetUID: 00000000-00001248] "wps.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\mediaget-installer-tmp\pages\wps.html]- [targetUID: 00000000-00001248] "wps-ru.html" has type "HTML document ASCII text with CRLF line terminators"- Location: [%TEMP%\mediaget-installer-tmp\pages\wps-ru.html]- [targetUID: 00000000-00001248] "yandex-logo.png" has type "PNG image data 83 x 24 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\yandex-logo.png]- [targetUID: 00000000-00001248] "cancel.template" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\mediaget-installer-tmp\cancel.template]- [targetUID: 00000000-00001248] "cancel-ru.template" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\mediaget-installer-tmp\cancel-ru.template]- [targetUID: 00000000-00001248] "main-yandex.txt" has type "HTML document Unicode text UTF-8 text with very long lines (450) with CRLF line terminators"- Location: [%TEMP%\mediaget-installer-tmp\pages\main-yandex.txt]- [targetUID: 00000000-00001248] "wait.html" has type "ASCII text with CRLF line terminators"- Location: [%TEMP%\mediaget-installer-tmp\pages\wait.html]- [targetUID: 00000000-00001248] "av360-check-on.png" has type "PNG image data 24 x 24 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\av360-check-on.png]- [targetUID: 00000000-00001248] "bundle1-check-on.png" has type "PNG image data 18 x 18 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\bundle1-check-on.png]- [targetUID: 00000000-00001248] "settings-checked.png" has type "PNG image data 24 x 24 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\settings-checked.png]- [targetUID: 00000000-00001248] "opera-check-on.png" has type "PNG image data 24 x 24 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\opera-check-on.png]- [targetUID: 00000000-00001248] "bundle2-check-on.png" has type "PNG image data 18 x 18 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\bundle2-check-on.png]- [targetUID: 00000000-00001248] "bundle1-check-off.png" has type "PNG image data 18 x 18 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\bundle1-check-off.png]- [targetUID: 00000000-00001248] "main-lum.txt" has type "HTML document ASCII text with no line terminators"- Location: [%TEMP%\mediaget-installer-tmp\pages\main-lum.txt]- [targetUID: 00000000-00001248] "av360-check-off.png" has type "PNG image data 24 x 24 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\av360-check-off.png]- [targetUID: 00000000-00001248] "close-lightgray-14px.png" has type "PNG image data 14 x 14 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\close-lightgray-14px.png]- [targetUID: 00000000-00001248] "close-gray.png" has type "PNG image data 20 x 20 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\close-gray.png]- [targetUID: 00000000-00001248] "preloader.html" has type "HTML document ASCII text with no line terminators"- Location: [%TEMP%\mediaget-installer-tmp\preloader.html]- [targetUID: 00000000-00001248] "close-white.png" has type "PNG image data 20 x 20 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\close-white.png]- [targetUID: 00000000-00001248] "settings-unchecked.png" has type "PNG image data 24 x 24 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\settings-unchecked.png]- [targetUID: 00000000-00001248] "opera-check-off.png" has type "PNG image data 24 x 24 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\opera-check-off.png]- [targetUID: 00000000-00001248] "bundle2-check-off.png" has type "PNG image data 18 x 18 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\bundle2-check-off.png]- [targetUID: 00000000-00001248] "point.png" has type "PNG image data 6 x 6 8-bit/color RGBA non-interlaced"- Location: [%TEMP%\mediaget-installer-tmp\img2\point.png]- [targetUID: 00000000-00001248]52:T622,"capcut_pro_9_4_0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "capcut_pro_9_4_0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "capcut_pro_9_4_0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "capcut_pro_9_4_0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "capcut_pro_9_4_0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "capcut_pro_9_4_0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "capcut_pro_9_4_0.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "capcut_pro_9_4_0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "capcut_pro_9_4_0.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE\ASSEMBLYSTORAGEROOTS"; Key: ""; Value: "") "capcut_pro_9_4_0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: ""; Value: "") "capcut_pro_9_4_0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: ""; Value: "") "capcut_pro_9_4_0.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\POLICIES\MICROSOFT\CRYPTOGRAPHY\CONFIGURATION"; Key: ""; Value: "")53:Tc23,"capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "CAPCUT_PRO_9_4_0.EXE"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "AGGRESSIVEMTATESTING"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "ENABLEPERPROCESSSYSTEMDPI"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "CAPCUT_PRO_9_4_0"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "")54:T414,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Able to identify virtual environment using user register activity Matched sigs: Queries process mitigation policy via NtQueryInformationProcess Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Possibly tries to evade analysis by sleeping multiple times Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: The input sample contains the RDTSCP instruction Matched sigs: The input sample contains a known anti-VM trick Matched sigs: Contains ability to delay the execution of current thread55:T4f8,"capcut_pro_9_4_0.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "capcut_pro_9_4_0.exe" trying to touch file "C:\WINDOWS\system32\wow64log.dll" "capcut_pro_9_4_0.exe" trying to touch file "C:\CAPCUT_PRO_9_4_0.EXE.LOCAL" "capcut_pro_9_4_0.exe" trying to touch file "C:\capcut_pro_9_4_0.exe.Local\" "capcut_pro_9_4_0.exe" trying to touch file "C:\WININET.DLL" "capcut_pro_9_4_0.exe" trying to touch file "C:\WININET.dll" "capcut_pro_9_4_0.exe" trying to touch file "C:\Windows\SysWOW64\wininet.dll" "capcut_pro_9_4_0.exe" trying to touch file "C:\Windows\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_d0271d135f36f548\comctl32.dll" "capcut_pro_9_4_0.exe" trying to touch file "C:\WINDOWS\SysWOW64\WININET.dll" "capcut_pro_9_4_0.exe" trying to touch file "C:\WINDOWS\WinSxS\x86_microsoft.windows.common-controls_6595b64144ccf1df_5.82.16299.248_none_d0271d135f36f548\COMCTL32.dll" "capcut_pro_9_4_0.exe" trying to touch file "C:\BCRYPT.DLL" "capcut_pro_9_4_0.exe" trying to touch file "C:\bcrypt.dll" "capcut_pro_9_4_0.exe" trying to touch file "C:\Windows\SysWOW64\bcrypt.dll" "capcut_pro_9_4_0.exe" trying to touch file "C:\WINDOWS\SysWOW64\bcrypt.dll" "capcut_pro_9_4_0.exe" trying to touch file "\Device\CNG"56:T67f,"capcut_pro_9_4_0.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\WININET.DLL" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\WININET.dll" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\BCRYPT.DLL" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\bcrypt.dll" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\FLTLIB.DLL" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\MSVCP140.DLL" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\MSVCP140.dll" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\WINDOWS\SysWOW64\rpcss.dll" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\PROPSYS.DLL" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\PROPSYS.dll" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\URLMON.DLL" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\urlmon.dll" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\CLDAPI.DLL" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\CLDAPI.dll" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\AEPIC.DLL"57:T5e3,"capcut_pro_9_4_0.exe" trying to access non-existent file "C:\CAPCUT_PRO_9_4_0.EXE.LOCAL" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\capcut_pro_9_4_0.exe.Local\" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\MEDIAGET-INSTALLER-TMP" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\mediaget-installer-tmp\" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\mediaget-installer-tmp" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\mediaget-installer-tmp\preloader.html:ZONE.IDENTIFIER" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\mediaget-installer-tmp\preloader.html:Zone.Identifier" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\mediaget-installer-tmp\page-wait.jpg:ZONE.IDENTIFIER" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\mediaget-installer-tmp\page-wait.jpg:Zone.Identifier" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\mediaget-installer-tmp\CURL-CA-BUNDLE.CRT" "capcut_pro_9_4_0.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\mediaget-installer-tmp\curl-ca-bundle.crt" "capcut_pro_9_4_0.exe" trying to access non-existent file "\Device\RasAcd"58:Tc0a,Found reference to API "gethostname" (Indicator: "gethostname"; File: "capcut_pro_9_4_0.exe") Found reference to API "WSAGetLastError" (Indicator: "wsagetlasterror"; File: "capcut_pro_9_4_0.exe") Found reference to API "WSACleanup" (Indicator: "wsacleanup"; File: "capcut_pro_9_4_0.exe") Found reference to API "WSAStartup" (Indicator: "wsastartup"; File: "capcut_pro_9_4_0.exe") Found reference to API "__WSAFDIsSet" (Indicator: "__wsafdisset"; File: "capcut_pro_9_4_0.exe") Found reference to API "No valid port number in connect to host string (%s)" (Indicator: " connect "; File: "capcut_pro_9_4_0.exe") Found reference to API "Unix socket path too long: '%s'" (Indicator: " socket "; File: "capcut_pro_9_4_0.exe") Found reference to API "Couldn't bind to interface '%s'" (Indicator: " bind "; File: "capcut_pro_9_4_0.exe") Found reference to API "Couldn't bind to '%s'" (Indicator: " bind "; File: "capcut_pro_9_4_0.exe") Found reference to API "After %I64dms connect time, move on!" (Indicator: " connect "; File: "capcut_pro_9_4_0.exe") Found reference to API "Failed to connect to %s port %u after %I64d ms: %s" (Indicator: " connect "; File: "capcut_pro_9_4_0.exe") Found reference to API "Immediate connect fail for %s: %s" (Indicator: " connect "; File: "capcut_pro_9_4_0.exe") Found reference to API "Connection died, retrying a fresh connect (retry count: %d)" (Indicator: " connect "; File: "capcut_pro_9_4_0.exe") Found reference to API "allocate connect buffer" (Indicator: " connect "; File: "capcut_pro_9_4_0.exe") Found reference to API "Failed sending CONNECT to proxy" (Indicator: " connect "; File: "capcut_pro_9_4_0.exe") Found reference to API "Proxy CONNECT aborted due to timeout" (Indicator: " connect "; File: "capcut_pro_9_4_0.exe") Found reference to API "Proxy CONNECT connection closed" (Indicator: " connect "; File: "capcut_pro_9_4_0.exe") Found reference to API "Proxy CONNECT aborted" (Indicator: " connect "; File: "capcut_pro_9_4_0.exe") Found reference to API "Ignoring Content-Length in CONNECT %03d response" (Indicator: " connect "; File: "capcut_pro_9_4_0.exe") Found reference to API "Ignoring Transfer-Encoding in CONNECT %03d response" (Indicator: " connect "; File: "capcut_pro_9_4_0.exe") Found reference to API "Proxy replied %d to CONNECT request" (Indicator: " connect "; File: "capcut_pro_9_4_0.exe") Found reference to API "SOCKS4 connect to IPv4 %s (locally resolved)" (Indicator: " connect "; File: "capcut_pro_9_4_0.exe") Found reference to API "Failed to send SOCKS4 connect request." (Indicator: " connect "; File: "capcut_pro_9_4_0.exe") Found reference to API "Failed to send SOCKS4 connect request." (Indicator: " send "; File: "capcut_pro_9_4_0.exe") Found reference to API "SOCKS4: Failed receiving connect request ack: %s" (Indicator: " connect "; File: "capcut_pro_9_4_0.exe") Found reference to API "Can't complete SOCKS4 connection to %d.%d.%d.%d:%d. (%d), request rejected because SOCKS server cannot connect to identd on the client." (Indicator: " connect "; File: "capcut_pro_9_4_0.exe")59:T65f,"127.0.0.1" Potential IP "127.0.0.1" found in string "127.0.0.1/" "192.168.0.2" "51.158.210.92" Potential IPs "2.0.0.1" "2.0.0.20" "24.0.0.1" "24.0.0.22" found in string "2.0.0.1-2.0.0.20, 24.0.0.1-24.0.0.22" Potential IP "127.0.0.1" found in string "The WinRM client cannot process the request. If you do not specify an authentication mechanism or you specify Kerberos, then you cannot use "localhost" or "127.0.0.1" or "[::1]" for the remote host name." Potential IP "157.59.136.1" found in string "e.g. IPv4.Address=157.59.136.1" Potential IP "157.59.136.1" found in string "e.g. IPv4.Address=!(157.59.136.1)" Potential IPs "157.59.136.1" "157.59.136.11" found in string "e.g. IPv4.Address=(157.59.136.1,157.59.136.11)" Potential IP "157.59.136.1" found in string "e.g. IPv4.SourceAddress=157.59.136.1" Potential IP "157.59.136.1" found in string "e.g. IPv4.DestinationAddress=157.59.136.1" Potential IP "157.59.136.1" found in string "IPv4.Address=157.59.136.1'" Potential IP "157.59.136.1" found in string "e.g. 'netsh trace start capture=yes IPv4.SourceAddress=157.59.136.1'" Potential IP "157.59.136.1" found in string "This will capture IPv4 packets only from 157.59.136.1, and it" Potential IP "157.59.136.1" found in string "e.g. 'netsh trace start capture=yes IPv4.SourceAddress=157.59.136.1" Potential IPs "2.0.0.0" "3.0.0.0" found in string "providerFilter=Yes IPv4.Address=(2.0.0.0-3.0.0.0)" Potential IPs "2.0.0.0" "3.0.0.0" found in string "providerFilter=Yes IPv4.SourceAddress=(2.0.0.0,3.0.0.0)" Potential IP "2.0.0.0" found in string "providerFilter=Yes IPv4.DestinationAddress=!(2.0.0.0)"5a:T3772,Heuristic match: "tn<.tj" Heuristic match: "ts<.to" Pattern match: "https://curl.se/docs/http-cookies.html#" Heuristic match: "ftp@example.com" Pattern match: "https://curl.se/docs/alt-svc.html#" Pattern match: "https://curl.se/docs/hsts.html#" Pattern match: "www.apache.org/licenses/license-2.0uni0000uni000duni0002uni00a0uni00aduni00b2uni00b3uni00b9amacronamacronabreveabreveaogonekaogonekccircumflexccircumflexcdotaccentcdotaccentdcarondcarondcroatemacronemacronebreveebreveedotaccentedotaccenteogonekeogonekecaro" Pattern match: "654.ay/+10753!5!&$#" Pattern match: "https://opscloudio.com/privacy-policy\" Pattern match: "https://mediaget.com/license" Pattern match: "http://www.w3.org/tr/html4/loose.dtd" Pattern match: "https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.4.0/css/all.min.css" Pattern match: "https://brightvpn.com" Pattern match: "https://soax.com/terms-of-use" Pattern match: "https://flukeproxy.com/agreement/" Pattern match: "https://www.opera.com/ru/eula/computers" Pattern match: "https://www.360totalsecurity.com/license/360-total-security/" Pattern match: "https://earnapp.com/" Pattern match: "https://proxy-sdk.com/agreement.html" Pattern match: "https://infatica.io/terms/" Pattern match: "https://terms.dat.ai/" Pattern match: "https://opscloudio.com/eula" Pattern match: "https://wps.com/eula/" Pattern match: "http://legal.yandex.ru/desktop_software_agreement/" Pattern match: "http://brightdata.com/legal/sdk-sla" Heuristic match: "mediaget.com" Pattern match: "http://www.w3.org/1999/xhtml" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "excel.exe/3000" Pattern match: "onbttnie.dll/105" Pattern match: "http://www.w3.org/xml/1998/namespace" Heuristic match: "host: mediaget.com" Pattern match: "http://yr2.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl" Pattern match: "https://mediaget.com/ld/get_bconfig.php" Pattern match: "https://fs.microsoft.com/fs/windows/config.json" Pattern match: "https://fs.microsoft.com/fs/windows/config.json,config,0" Heuristic match: "ediaget.com" Heuristic match: "*.mg-prod.mediaget.com" Heuristic match: "*.mediaget.com" Heuristic match: "t: mediaget.com" Pattern match: "yr2.c.lencr.org/mitmproxy-236356893075616227624110519622398477259530153583.crl" Heuristic match: "0/443/mediaget.com" Heuristic match: "white.pn" Pattern match: "www.360totalsecurity.com/license/360-total-security/" Pattern match: "http://scripts.sil.org/ofl" Pattern match: "www.360totalsecurity.com/privacy/" Pattern match: "http://www.apache.org/licenses/license-2.0" Pattern match: "https://mediaget.com/installer/binaries/operasetup_mediaget2_2024-03-07.exe" Pattern match: "https://mediaget.com/installer/binaries/html_new_transl_2026-10-16.7z" Pattern match: "https://mediaget.com/installer/binaries/lib_2026-09-21_new_sign.7z" Pattern match: "https://free.360totalsecurity.com/totalsecurity/360ts_setup_ww.mediaget.cpi202204_6.6.0.1090.exe" Pattern match: "https://mediaget.com/ld/get_data.php?id=0&alreadyinstalled=0&vi=0&browsersinstalled=chrome,iexplore,edge&defaultbrowser=edge&bundlesinstalled=&installerversion=502&os=10.0.16299&isos64bit=1&lang=en-us" Pattern match: "https://net.geo.opera.com/opera/stable/windows?utm_source=mgt&utm_medium=apb&utm_campaign=mediaget2&utm_content=" Pattern match: "https://github.com/julietaula/montserrat" Heuristic match: "ystem.activityhistory.id" Heuristic match: "ystem.appusermodel.id" Heuristic match: "ystem.identityprovider.name" Heuristic match: "ystem.protocol.name" Heuristic match: "ystem.sam.name" Heuristic match: "ystem.structuredquery.is" Heuristic match: "ystem.structuredquery.virtual.cc" Heuristic match: "ystem.structuredquery.virtual.to" Pattern match: "scripts.sil.org/ofl" Heuristic match: "document.getelementbyid('bundlecheck5').ch" Pattern match: "http://www.zkysky.com.ar/" Heuristic match: "google.com" Pattern match: "mediaget.com/license" Pattern match: "brightvpn.com/legal/sla" Pattern match: "https://cdn.brightvpn.com/static/brightvpn-setup-latest.exe" Pattern match: "https://mediaget.com/installer/binaries/4350.7z" Pattern match: "https://mediaget.com/ld/get_data.php?id=0" Pattern match: "https://mediaget.com/client/installer.php" Pattern match: "https://mediaget.com/installer/binaries/360ts_setup_ww.mediaget.cpi202204_6.6.0.1090.exe" Heuristic match: "page.proxy_radio.no" Heuristic match: "soax.com" Heuristic match: "flukeproxy.com" Heuristic match: "proxy-sdk.com" Heuristic match: "infatica.io" Heuristic match: "opscloudio.com" Heuristic match: "dat.ai" Pattern match: "https://opscloudio.com/privacy-policy" Pattern match: "www.opera.com/ru/eula/computers" Pattern match: "ty.com/license/" Heuristic match: "ck').ch" Heuristic match: "// document.ge" Pattern match: "brightvpn.com/legal/privacy" Pattern match: "www.opera.com/ru/privacy" Heuristic match: "var posterimgels=document.ge" Heuristic match: "ttps://brightvpn.com" Pattern match: "https://net.geo.opera.com/opera/stable/windows?utm_source=mgt&utm_medium=apb&utm_campaign=mediaget2&utm_content=" Pattern match: "https://brightvpn.com/legal/sla" Pattern match: "https://brightvpn.com/legal/privacy" Pattern match: "https://www.opera.com/ru/privacy" Pattern match: "https://www.360totalsecurity.com/privacy/" Pattern match: "pache.org/li" Heuristic match: "0/.ee" Heuristic match: "a.sc aacute.sc abreve.sc" Heuristic match: "uni1eaf.sc" Heuristic match: "uni1eb7.sc" Heuristic match: "uni1eb1.sc" Heuristic match: "uni1eb3.sc" Heuristic match: "uni1eb5.sc" Heuristic match: "uni01ce.sc" Heuristic match: "acircumflex.sc" Heuristic match: "uni1ea5.sc" Heuristic match: "uni1ead.sc" Heuristic match: "uni1ea7.sc" Heuristic match: "uni1ea9.sc" Heuristic match: "uni1eab.sc" Heuristic match: "uni0201.sc" Heuristic match: "adieresis.sc" Heuristic match: "uni1ea1.sc agrave.sc" Heuristic match: "uni1ea3.sc" Heuristic match: "uni0203.sc" Heuristic match: "adieresis.alt.sc" Heuristic match: "amacron.sc" Heuristic match: "aogonek.sc" Heuristic match: "aring.sc" Heuristic match: "aringacute.sc atilde.sc" Heuristic match: "ae.sc" Heuristic match: "aeacute.sc" Heuristic match: "c.sc cacute.sc ccaron.sc" Heuristic match: "ccedilla.sc" Heuristic match: "uni1e09.sc" Heuristic match: "ccircumflex.sc" Heuristic match: "cdotaccent.sc" Heuristic match: "eth.sc dcaron.sc dcroat.sc" Heuristic match: "uni1e0d.sc" Heuristic match: "uni1e0f.sc" Heuristic match: "uni01c6.sc" Heuristic match: "e.sc eacute.sc ebreve.sc ecaron.sc" Heuristic match: "uni1e1d.sc" Heuristic match: "ecircumflex.sc" Heuristic match: "uni1ebf.sc" Heuristic match: "uni1ec7.sc" Heuristic match: "uni1ec1.sc" Heuristic match: "uni1ec3.sc" Heuristic match: "uni1ec5.sc" Heuristic match: "uni0205.sc" Heuristic match: "edieresis.sc" Heuristic match: "edotaccent.sc" Heuristic match: "uni1eb9.sc egrave.sc" Heuristic match: "uni1ebb.sc" Heuristic match: "uni0207.sc" Heuristic match: "emacron.sc" Heuristic match: "uni1e17.sc" Heuristic match: "uni1e15.sc" Heuristic match: "eogonek.sc" Heuristic match: "uni1ebd.sc" Heuristic match: "uni0259.sc" Heuristic match: "uni0292.sc" Heuristic match: "uni01ef.sc" Heuristic match: "uni01f5.sc gbreve.sc gcaron.sc" Heuristic match: "gcircumflex.sc" Heuristic match: "gcommaaccent.sc" Heuristic match: "gdotaccent.sc" Heuristic match: "uni1e21.sc" Heuristic match: "uni01e5.sc" Heuristic match: "hbar.sc" Heuristic match: "uni1e2b.sc" Heuristic match: "uni021f.sc" Heuristic match: "hcircumflex.sc" Heuristic match: "uni1e25.sc" Heuristic match: "dotlessi.sc iacute.sc" Heuristic match: "iacute_j.loclnld.sc ibreve.sc" Heuristic match: "icircumflex.sc" Heuristic match: "uni0209.sc" Heuristic match: "idieresis.sc" Heuristic match: "uni1e2f.sc" Heuristic match: "uni1ecb.sc igrave.sc" Heuristic match: "uni1ec9.sc" Heuristic match: "uni020b.sc" Heuristic match: "ij.sc" Heuristic match: "imacron.sc" Heuristic match: "iogonek.sc itilde.sc" Heuristic match: "uni006a0301.sc" Heuristic match: "jcircumflex.sc" Heuristic match: "uni01e9.sc" Heuristic match: "kcommaaccent.sc" Heuristic match: "kgreenlandic.sc" Heuristic match: "l.sc lacute.sc lcaron.sc" Heuristic match: "lcommaaccent.sc" Heuristic match: "ldot.sc" Heuristic match: "uni1e37.sc" Heuristic match: "uni01c9.sc" Heuristic match: "uni1e3b.sc lslash.sc" Heuristic match: "uni1e43.sc" Heuristic match: "n.sc nacute.sc ncaron.sc" Heuristic match: "ncommaaccent.sc" Heuristic match: "uni1e45.sc" Heuristic match: "uni1e47.sc" Heuristic match: "eng.sc" Heuristic match: "uni01cc.sc" Heuristic match: "uni1e49.sc ntilde.sc" Heuristic match: "o.sc oacute.sc obreve.sc" Heuristic match: "ocircumflex.sc" Heuristic match: "uni1ed1.sc" Heuristic match: "uni1ed9.sc" Heuristic match: "uni1ed3.sc" Heuristic match: "uni1ed5.sc" Heuristic match: "uni1ed7.sc" Heuristic match: "uni020d.sc" Heuristic match: "odieresis.sc" Heuristic match: "uni022b.sc" Heuristic match: "uni0231.sc" Heuristic match: "uni1ecd.sc ograve.sc" Heuristic match: "uni1ecf.sc" Heuristic match: "ohorn.sc" Heuristic match: "uni1edb.sc" Heuristic match: "uni1ee3.sc" Heuristic match: "uni1edd.sc" Heuristic match: "uni1edf.sc" Heuristic match: "uni1ee1.sc" Heuristic match: "ohungarumlaut.sc" Heuristic match: "uni020f.sc" Heuristic match: "omacron.sc" Heuristic match: "uni1e53.sc" Heuristic match: "uni1e51.sc" Heuristic match: "uni01eb.sc oslash.sc" Heuristic match: "oslashacute.sc otilde.sc" Heuristic match: "uni1e4d.sc" Heuristic match: "uni1e4f.sc" Heuristic match: "uni022d.sc" Heuristic match: "oe.sc" Heuristic match: "thorn.sc" Heuristic match: "r.sc racute.sc rcaron.sc" Heuristic match: "rcommaaccent.sc" Heuristic match: "uni0211.sc" Heuristic match: "uni1e5b.sc" Heuristic match: "uni0213.sc" Heuristic match: "uni1e5f.sc" Heuristic match: "s.sc sacute.sc" Heuristic match: "uni1e65.sc" Heuristic match: "unia78c.sc scaron.sc" Heuristic match: "uni1e67.sc" Heuristic match: "scedilla.sc" Heuristic match: "scircumflex.sc" Heuristic match: "scommaaccent.sc" Heuristic match: "uni1e61.sc" Heuristic match: "uni1e63.sc" Heuristic match: "uni1e69.sc" Heuristic match: "germandbls.sc" Heuristic match: "tbar.sc tcaron.sc" Heuristic match: "uni0163.sc" Heuristic match: "uni021b.sc" Heuristic match: "uni1e97.sc" Heuristic match: "uni1e6d.sc" Heuristic match: "uni1e6f.sc" Heuristic match: "u.sc uacute.sc ubreve.sc" Heuristic match: "uni01d4.sc" Heuristic match: "ucircumflex.sc" Heuristic match: "uni0215.sc" Heuristic match: "udieresis.sc" Heuristic match: "uni1ee5.sc ugrave.sc" Heuristic match: "uni1ee7.sc" Heuristic match: "uhorn.sc" Heuristic match: "uni1ee9.sc" Heuristic match: "uni1ef1.sc" Heuristic match: "uni1eeb.sc" Heuristic match: "uni1eed.sc" Heuristic match: "uni1eef.sc" Heuristic match: "uhungarumlaut.sc" Heuristic match: "uni0217.sc" Heuristic match: "umacron.sc" Heuristic match: "uni1e7b.sc" Heuristic match: "uogonek.sc" Heuristic match: "uring.sc utilde.sc" Heuristic match: "uni1e79.sc" Heuristic match: "w.sc wacute.sc" Heuristic match: "wcircumflex.sc" Heuristic match: "wdieresis.sc wgrave.sc" Heuristic match: "y.sc yacute.sc" Heuristic match: "ycircumflex.sc" Heuristic match: "ydieresis.sc" Heuristic match: "uni1e8f.sc" Heuristic match: "uni1ef5.sc ygrave.sc" Heuristic match: "uni1ef7.sc" Heuristic match: "uni0233.sc" Heuristic match: "uni1ef9.sc" Heuristic match: "z.sc zacute.sc zcaron.sc" Heuristic match: "zdotaccent.sc" Heuristic match: "zero.tf" Heuristic match: "one.tf" Heuristic match: "two.tf" Heuristic match: "three.tf" Heuristic match: "four.tf" Heuristic match: "five.tf" Heuristic match: "six.tf" Heuristic match: "seven.tf" Heuristic match: "eight.tf" Heuristic match: "guilsinglright.case exclam.sc" Heuristic match: "exclamdown.sc" Heuristic match: "guillemotleft.sc" Heuristic match: "guillemotright.sc" Heuristic match: "guilsinglleft.sc" Heuristic match: "guilsinglright.sc period.sc" Heuristic match: "question.sc" Heuristic match: "questiondown.sc" Heuristic match: "quotedbl.sc" Heuristic match: "quotedblbase.sc" Heuristic match: "quotedblleft.sc" Heuristic match: "quotedblright.sc" Heuristic match: "quoteleft.sc" Heuristic match: "quoteright.sc" Heuristic match: "quotesinglbase.sc" Heuristic match: "quotesingle.sc" Heuristic match: "ampersand.sc" Heuristic match: "uni0335.sc" Heuristic match: "uni0336.sc" Heuristic match: "uni0338.sc" Pattern match: "http://go.microsoft.com/fwlink/?linkid=247104.&click" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291337%@font-face" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291257" Pattern match: "http://go.microsoft.com/fwlink/?linkid=291257.s" Pattern match: "http://www.w3.org/xml/1998/namespace..the" Pattern match: "http://www.w3.org/2000/xmlns/" Pattern match: "http://www.w3.org/1999/xlink.{text" Pattern match: "http://go.microsoft.com/fwlink/?linkid=247104" Pattern match: "go.microsoft.com/fwlink/?linkid=109695&result=block&t=%1&url=%2" Pattern match: "http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/plugin?name=xyz" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/plugin" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/config/service" Pattern match: "http://[1::2]:80/wsman" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell" Pattern match: "http://schemas.microsoft.com/wbem/wsman/1/windows/shell/cmd" Heuristic match: "for example, for a target computer name myserver.domain.com, the spn can be one of the following: wsman/myserver.domain.com or wsman/*.domain.com" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624361" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624359" Pattern match: "http://go.microsoft.com/fwlink/?linkid=624360" Heuristic match: "treenode.textcontent = bdvpnrus360kingsoft/wps" - Source: "00000000-00001248.00000001.113207.0AC70000.00000004.mdmp") Found URL "https://mediaget.com/client/installer.php_top>infatica-m/infatica-service-app.exe" - Source: "00000000-00001248.00000001.113207.0AC70000.00000004.mdmp") Found URL "https://mediaget.com/installer/binaries/360ts_setup_ww.mediaget.cpi202204_6.6.0.1090.exesoftware\wow6432node\microsoft\windows\currentversion\uninstall\360" - Source: "00000000-00001248.00000001.113207.0AC70000.00000004.mdmp") Found URL "https://opscloudio.com/privacy-policy" - Source: "00000000-00001248.00000001.113207.0AC70000.00000004.mdmp") Found URL "https://mediaget.com/licensettps://mediaget.com/licensehttps://mediaget.com/licensettps://mediaget.com/licensettps://mediaget.com/licenseurrentstateediaget.comurrentstateurrentstateurrentstateurrentstateurrentstateurrentstateediaget.comz-bo" - Source: "00000000-00001248.00000001.113207.0B030000.00000004.mdmp") Found URL "https://github.com/julietaula/montserrat)ile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/img2/close-gray.pngregistry\user\s-1-5-21-735145574-3570218355-1207367261-1001registry\user\s-1-5-21-735145574-3570218355-1207367261-1001??\c:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\montserrat-regular.eotregistry\user\s-1-5-21-735145574-3570218355-1207367261-1001??\c:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\montserrat-regular.eotregistry\user\s-1-5-21-735145574-3570218355-1207367261-1001ile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/montserrat-bold.eotregistry\user\s-1-5-21-735145574-3570218355-1207367261-1001registry\user\s-1-5-21-735145574-3570218355-1207367261-1001ile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/roboto-regular.eotfile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/roboto-regular.eotregistry\user\s-1-5-21-735145574-3570218355-1207367261-1001registry\user\s-1-5-21-735145574-3570218355-1207367261-1001registry\user\s-1-5-21-735145574-3570218355-1207367261-1001??\c:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\montserrat-regular.eotregistry\user\s-1-5-21-735145574-3570218355-1207367261-1001r-tmp/img2/bdvpn_point.pngregistry\user\s-1-5-21-735145574-3570218355-1207367261-1001registry\user\s-1-5-21-735145574-3570218355-1207367261-1001ile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/img2/close-gray.pngile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/montserrat-bold.eotile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/img2/close-gray.pngile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/roboto-regular.eotc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\img2\av360-check-on.pngile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/img2/opera-empty.pngc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\img2\opera-check-on.pngile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/img2/bdvpn_point.pngile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/img2/close-gray.pngile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/img2/bdvpn_point.pngile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/img2/opera-empty.pngc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\img2\opera-empty.pngy.pngfile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/img2/point.pngfile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/img2/av360.pngile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/img2/opera-empty.pngile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/img2/opera-empty.pngndiv4" - Source: "00000000-00001248.00000001.113207.0B030000.00000004.mdmp") Found URL "http://www.zkysky.com.ar/hread-00000cd4-id-00000000hread-00000cd4-id-00000000hread-00000cd4-id-00000002hread-00000cd4-id-00000002return" - Source: "00000000-00001248.00000001.113207.0B030000.00000004.mdmp") Found URL "http://www.zkysky.com.ar/hread-00000cd4-id-00000002hread-00000cd4-id-00000002http://scripts.sil.org/oflf_inputprocessorprofileshread-00000cd4-id-00000002hread-00000cd4-id-00000001-tmpmediaget-installer-tmpindex.htmlusershapubwsappdatalocaltempmediaget-installer-tmproboto-regular.eot:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\index.htmlusershapubwsappdatalocaltempmediaget-installer-tmproboto-regular.eotrat-regular.eo4:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\montserrat-regular.eotusershapubwsappdatalocaltempmediaget-installer-tmpmontserrat-regular.eotusershapubwsappdatalocaltempmediaget-installer-tmproboto-regular.eotusershapubwsappdatalocaltempmediaget-installer-tmpindex.htmlusershapubwsappdatalocaltempmediaget-installer-tmpmontserrat-bold.eotregular.eot:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\montserrat-bold.eotusershapubwsappdatalocaltempmediaget-installer-tmpmontserrat-regular.eotusershapubwsappdatalocaltempmediaget-installer-tmpmontserrat-regular.eotregula4regular.eot:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\montserrat-regular.eot:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\roboto-regular.eotregular.eot:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\roboto-regular.eotart" - Source: "00000000-00001248.00000001.113207.0B030000.00000004.mdmp") Found URL "https://net.geo.opera.com/opera/stable/windows?utm_source=mgt&utm_medium=apb&utm_campaign=mediaget2&utm_content=https://mediaget.com/installer/binaries/operasetup_mediaget2_2024-03-07.exe" - Source: "00000000-00001248.00000001.113207.0B030000.00000004.mdmp") Found URL "https://free.360totalsecurity.com/totalsecurity/360ts_setup_ww.mediaget.cpi202204_6.6.0.1090.exehttps://mediaget.com/installer/binaries/360ts_setup_ww.mediaget.cpi202204_6.6.0.1090.exe1/silent=yes" - Source: "00000000-00001248.00000001.113207.0B030000.00000004.mdmp") Found URL "https://cdn.brightvpn.com/static/brightvpn-setup-latest.execaliforniasanta" - Source: "00000000-00001248.00000001.113207.0B030000.00000004.mdmp") Found URL "https://mediaget.com/installer/binaries/html_new_transl_2026-10-16.7z11

4350https://mediaget.com/installer/binaries/4350.7z4022272

lib_2026-09-21_new_signhttps://mediaget.com/installer/binaries/lib_2026-09-21_new_sign.7z69656576

tup-latest.exacmga.pngc:\uhttps://mediaget.com/installer/binaries/operasetup_mediaget2_2024-03-07.exe:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\curl-ca-bundle.crt\users\hapubws\appdata\local\temp\mediaget-installer-tmp\cancel.templateplatec:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\pages\wps-ru.htmlc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\pages\flk-start.htmlc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\pages\inf.htmlc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\pages\main-lum.txtc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\pages\sx.htmlc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\pages\wps.htmlc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\pages\flk.htmlc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\pages\main.htmlc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\pages\mgru.htmlc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\pages\wait.htmlc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\roboto-regular.eotc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\pages\op.htmlc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\translations.jsonc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\pages\psdk.html/c:\usershapubwsappdatalocaltempr]!lmediag" - Source: "00000000-00001248.00000001.113207.0B030000.00000004.mdmp") Found URL "https://mediaget.com/license'" - Source: "00000000-00001248.00000001.113207.0B030000.00000004.mdmp") Found URL "https://mediaget.com/installer/binaries/html_new_transl_2026-10-16.7z11

4350https://mediaget.com/installer/binaries/4350.7z4022272

lib_2026-09-21_new_signhttps://mediaget.com/installer/binaries/lib_2026-09-21_new_sign.7z69656576paramet" - Source: "00000000-00001248.00000001.113207.0B030000.00000004.mdmp") Found URL "http://www.w3.org/tr/html4/loose.dtd" - Source: "00000000-00001248.00000001.113207.0B030000.00000004.mdmp") Found URL "https://github.com/julietaula/montserrat)thread-00000cd4-id-00000000:subsetthread-00000cd4-id-00000000" - Source: "00000000-00001248.00000001.113207.0BF30000.00000004.mdmp") Found URL "http://www.zkysky.com.ar/this" - Source: "00000000-00001248.00000001.113207.0BF30000.00000004.mdmp") Found URL "http://scripts.sil.org/ofl^" - Source: "00000000-00001248.00000001.113207.0BF30000.00000004.mdmp") Found URL "http://scripts.sil.org/oflnullabreveuni1eaeuni1eb6uni1eb0uni1eb2uni1eb4uni01cduni1ea4uni1eacuni1ea6uni1ea8uni1eaauni0200uni1ea0uni1ea2uni0202amacronaogonekaringacuteaeacuteuni1e08ccircumflexcdotaccentuni01c4dcarondcroatuni1e0cuni1e0euni01c5ebreveecaronuni1e1cuni1ebeuni1ec6uni1ec0uni1ec2uni1ec4uni0204edotaccentuni1eb8uni1ebauni0206emacronuni1e16uni1e14eogonekuni1ebcuni01b7uni01eegcarongcircumflexgcommaaccentgdotaccentuni1e20uni01e4hbaruni1e2auni021ehcircumflexuni1e24ibreveuni0208uni1e2euni1ecauni1ec8uni020aimacroniogonekitildeuni00a40301jcircumflexuni01e8kcommaaccentuni01c7lacutelcaronlcommaaccentldotuni1e36uni01c8uni1e3auni1e42uni01canacutencaronncommaaccentuni1e44uni1e46uni01cbuni1e48obreveuni1ed0uni1ed8uni1ed2uni1ed4uni1ed6uni020cuni022auni0230uni1eccuni1eceohornuni1edauni1ee2uni1edcuni1edeuni1ee0ohungarumlautuni020eomacronuni1e52uni1e50uni01eaoslashacuteuni1e4cuni1e4euni022cracutercaronrcommaaccentuni0210uni1e5auni0212uni1e5esacuteuni1e64unia78buni1e66scircumflexscommaaccentuni1e60uni1e62uni1e68uni1e9euni018ftbartcaronuni0162uni021auni1e6cuni1e6eubreveuni01d3uni0214uni1ee4uni1ee6uhornuni1ee8uni1ef0uni1eeauni1eecuni1eeeuhungarumlautuni0216umacronuni1e7auogonekuringutildeuni1e78wacutewcircumflex" - Source: "00000000-00001248.00000001.113207.0BF30000.00000004.mdmp") Found URL "http://www.w3.org/1999/xhtml:\windows\system32\propsys.dll:\windows\system32\msimtf.dllindowspropertydescriptions:\windows\syswow64\jscript9.dllhttp://www.w3.org/2000/svg:\windows\system32\wintrust.dll:\windows\system32\d3d10warp.dll:\windows\system32\propsys.dllcalrpcacheystemalendarext/htmlocument.htmlalendarbout:blankummy://urlpmapperbout:blankpmapperpmappersasspirpcpmappersasspirpcpmapper%systemroot%\system32\pnrpnsp.dll,-1000100n%systemroot%\system32\napinsp.dll,-10001001ebcache_" - Source: "00000000-00001248.00000002.115128.00BF0000.00000004.mdmp") Found URL "https://mediaget.com" - Source: "00000000-00001248.00000002.115128.0116F000.00000004.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=247104.&click" - Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=291337%@font-face" - Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=291257the" - Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=291257.the" - Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found URL "http://go.microsoft.com/fwlink/?linkid=291257.s'<0s>'" - Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found URL "http://www.w3.org/xml/1998/namespace" - Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found URL "http://scripts.sil.org/oflegular0000cd4-id-00000002thread-00000cd4-id-00000002egular0000cd4-id-00000001aca" - Source: "00000000-00001248.00000002.115128.06850000.00000004.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json10/18" - Source: "00000000-00001248.00000002.115128.08C20000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,010/18" - Source: "00000000-00001248.00000002.115128.08C20000.00000002.mdmp") Found URL "https://mediaget.com/license/img2/close-lightgray-14px.pngc:\users\hapubwsappdataredirectxdomainblocked/img2/close-lightgray-14px.png/img2/close-lightgray-14px.png/img2/close-lightgray-14px.png/img2/close-lightgray-14px.pngurl(./montserrat-bold.eot);privacyimpactedstatechangettps://mediaget.com/license:\windows\system32\dnsapi.dllsetphishingfilterstatusprinttemplateinstantiationbcryptprimitives.dllreturn" - Source: "00000000-00001248.00000002.115128.0AC70000.00000004.mdmp") Found URL "https://mediaget.com/license:\users\hapubws\appdata\local\temp\mediag" - Source: "00000000-00001248.00000002.115128.0AC70000.00000004.mdmp") Found URL "https://cdn.brightvpn.com/static/brightvpn-setup-latest.exepathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscsoftware\microsoft\windows\currentversion\uninstall\psafe" - Source: "00000000-00001248.00000002.115128.0AC70000.00000004.mdmp") Found URL "https://mediaget.com/ld/get_bconfig.phpddfq" - Source: "00000000-00001248.00000002.115128.0AC70000.00000004.mdmp") Found URL "https://mediaget.com/installer/binaries/4350.7ztemp=c:\users\hapubws\appdata\local\tempprogramfiles(x86)=c:\program" - Source: "00000000-00001248.00000002.115128.0AC70000.00000004.mdmp") Found URL "https://mediaget.com/ld/get_data.php?id=0e.exenvm_home=c:\users\hapubws\appdata\roaming\nvmhttps://mediaget.com/client/installer.phpteem>bdvpnrus360kingsoft/wps" - Source: "00000000-00001248.00000002.115128.0AC70000.00000004.mdmp") Found URL "https://mediaget.com/client/installer.php_top>infatica-m/infatica-service-app.exe" - Source: "00000000-00001248.00000002.115128.0AC70000.00000004.mdmp") Found URL "https://mediaget.com/installer/binaries/360ts_setup_ww.mediaget.cpi202204_6.6.0.1090.exesoftware\wow6432node\microsoft\windows\currentversion\uninstall\360" - Source: "00000000-00001248.00000002.115128.0AC70000.00000004.mdmp") Found URL "https://opscloudio.com/privacy-policy" - Source: "00000000-00001248.00000002.115128.0AC70000.00000004.mdmp") Found URL "https://mediaget.com/licensettps://mediaget.com/licensehttps://mediaget.com/licensettps://mediaget.com/licensettps://mediaget.com/licenseurrentstateediaget.comurrentstateurrentstateurrentstateurrentstateurrentstateurrentstateediaget.comz-bo" - Source: "00000000-00001248.00000002.115128.0B030000.00000004.mdmp") Found URL "https://github.com/julietaula/montserrat)ile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/img2/close-gray.pngregistry\user\s-1-5-21-735145574-3570218355-1207367261-1001registry\user\s-1-5-21-735145574-3570218355-1207367261-1001??\c:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\montserrat-regular.eotregistry\user\s-1-5-21-735145574-3570218355-1207367261-1001??\c:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\montserrat-regular.eotregistry\user\s-1-5-21-735145574-3570218355-1207367261-1001ile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/montserrat-bold.eotregistry\user\s-1-5-21-735145574-3570218355-1207367261-1001registry\user\s-1-5-21-735145574-3570218355-1207367261-1001ile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/roboto-regular.eotfile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/roboto-regular.eotregistry\user\s-1-5-21-735145574-3570218355-1207367261-1001registry\user\s-1-5-21-735145574-3570218355-1207367261-1001registry\user\s-1-5-21-735145574-3570218355-1207367261-1001??\c:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\montserrat-regular.eotregistry\user\s-1-5-21-735145574-3570218355-1207367261-1001r-tmp/img2/bdvpn_point.pngregistry\user\s-1-5-21-735145574-3570218355-1207367261-1001registry\user\s-1-5-21-735145574-3570218355-1207367261-1001ile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/img2/close-gray.pngile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/montserrat-bold.eotile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/img2/close-gray.pngile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/roboto-regular.eotc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\img2\av360-check-on.pngile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/img2/opera-empty.pngc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\img2\opera-check-on.pngile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/img2/bdvpn_point.pngile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/img2/close-gray.pngile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/img2/bdvpn_point.pngile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/img2/opera-empty.pngc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\img2\opera-empty.pngy.pngfile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/img2/point.pngfile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/img2/av360.pngile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/img2/opera-empty.pngile:///c:/users/hapubws/appdata/local/temp/mediaget-installer-tmp/img2/opera-empty.pngndiv4" - Source: "00000000-00001248.00000002.115128.0B030000.00000004.mdmp") Found URL "http://www.zkysky.com.ar/hread-00000cd4-id-00000000hread-00000cd4-id-00000000hread-00000cd4-id-00000002hread-00000cd4-id-00000002return" - Source: "00000000-00001248.00000002.115128.0B030000.00000004.mdmp") Found URL "http://www.zkysky.com.ar/hread-00000cd4-id-00000002hread-00000cd4-id-00000002http://scripts.sil.org/oflf_inputprocessorprofileshread-00000cd4-id-00000002hread-00000cd4-id-00000001-tmpmediaget-installer-tmpindex.htmlusershapubwsappdatalocaltempmediaget-installer-tmproboto-regular.eot:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\index.htmlusershapubwsappdatalocaltempmediaget-installer-tmproboto-regular.eotrat-regular.eo4:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\montserrat-regular.eotusershapubwsappdatalocaltempmediaget-installer-tmpmontserrat-regular.eotusershapubwsappdatalocaltempmediaget-installer-tmproboto-regular.eotusershapubwsappdatalocaltempmediaget-installer-tmpindex.htmlusershapubwsappdatalocaltempmediaget-installer-tmpmontserrat-bold.eotregular.eot:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\montserrat-bold.eotusershapubwsappdatalocaltempmediaget-installer-tmpmontserrat-regular.eotusershapubwsappdatalocaltempmediaget-installer-tmpmontserrat-regular.eotregula4regular.eot:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\montserrat-regular.eot:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\roboto-regular.eotregular.eot:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\roboto-regular.eotart" - Source: "00000000-00001248.00000002.115128.0B030000.00000004.mdmp") Found URL "https://net.geo.opera.com/opera/stable/windows?utm_source=mgt&utm_medium=apb&utm_campaign=mediaget2&utm_content=https://mediaget.com/installer/binaries/operasetup_mediaget2_2024-03-07.exe" - Source: "00000000-00001248.00000002.115128.0B030000.00000004.mdmp") Found URL "https://free.360totalsecurity.com/totalsecurity/360ts_setup_ww.mediaget.cpi202204_6.6.0.1090.exehttps://mediaget.com/installer/binaries/360ts_setup_ww.mediaget.cpi202204_6.6.0.1090.exe1/silent=yes" - Source: "00000000-00001248.00000002.115128.0B030000.00000004.mdmp") Found URL "https://cdn.brightvpn.com/static/brightvpn-setup-latest.execaliforniasanta" - Source: "00000000-00001248.00000002.115128.0B030000.00000004.mdmp") Found URL "https://mediaget.com/installer/binaries/html_new_transl_2026-10-16.7z11

4350https://mediaget.com/installer/binaries/4350.7z4022272

lib_2026-09-21_new_signhttps://mediaget.com/installer/binaries/lib_2026-09-21_new_sign.7z69656576

tup-latest.exacmga.pngc:\uhttps://mediaget.com/installer/binaries/operasetup_mediaget2_2024-03-07.exe:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\curl-ca-bundle.crt\users\hapubws\appdata\local\temp\mediaget-installer-tmp\cancel.templateplatec:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\pages\wps-ru.htmlc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\pages\flk-start.htmlc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\pages\inf.htmlc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\pages\main-lum.txtc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\pages\sx.htmlc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\pages\wps.htmlc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\pages\flk.htmlc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\pages\main.htmlc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\pages\mgru.htmlc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\pages\wait.htmlc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\roboto-regular.eotc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\pages\op.htmlc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\translations.jsonc:\users\hapubws\appdata\local\temp\mediaget-installer-tmp\pages\psdk.html/c:\usershapubwsappdatalocaltempr]!lmediag" - Source: "00000000-00001248.00000002.115128.0B030000.00000004.mdmp") Found URL "https://mediaget.com/license'" - Source: "00000000-00001248.00000002.115128.0B030000.00000004.mdmp") Found URL "https://mediaget.com/installer/binaries/html_new_transl_2026-10-16.7z11

4350https://mediaget.com/installer/binaries/4350.7z4022272

lib_2026-09-21_new_signhttps://mediaget.com/installer/binaries/lib_2026-09-21_new_sign.7z69656576paramet" - Source: "00000000-00001248.00000002.115128.0B030000.00000004.mdmp") Found URL "http://www.w3.org/tr/html4/loose.dtd" - Source: "00000000-00001248.00000002.115128.0B030000.00000004.mdmp") Found URL "https://github.com/julietaula/montserrat)thread-00000cd4-id-00000001" - Source: "00000000-00001248.00000002.115128.0BF80000.00000004.mdmp") Found URL "http://www.zkysky.com.ar/this" - Source: "00000000-00001248.00000002.115128.0BF80000.00000004.mdmp") Found URL "http://scripts.sil.org/ofl" - Source: "00000000-00001248.00000002.115128.0BF80000.00000004.mdmp") Found URL "http://scripts.sil.org/oflnulluni00a0uni00aduni00b2uni00b3uni00b5uni00b9amacronamacronabreveabreveaogonekaogonekccircumflexccircumflexcdotaccentcdotaccentdcarondcarondcroatemacronemacronebreveebreveedotaccentedotaccenteogonekeogonekecaronecarongcircumflexgcircumflexgdotaccentgdotaccentgcommaaccentgcommaaccenthcircumflexhcircumflexhbarhbaritildeitildeimacronimacronibreveibreveiogonekiogonekjcircumflexjcircumflexkcommaaccentkcommaaccentkgreenlandiclacutelacutelcommaaccentlcommaaccentlcaronlcaronldotldotnacutenacutencommaaccentncommaaccentncaronncaronnapostropheomacronomacronobreveobreveohungarumlautohungarumlautracuteracutercommaaccentrcommaaccentrcaronrcaronsacutesacutescircumflexscircumflexuni0162uni0163tcarontcarontbartbarutildeutildeumacronumacronubreveubreveuringuringuhungarumlautuhungarumlautuogonekuogonekwcircumflexwcircumflexycircumflexycircumflexzacutezacutezdotaccentzdotaccentlongsuni018fohornohornuhornuhornuni01b7uni01c4uni01c5uni01c6uni01c7uni01c8uni01c9uni01cauni01cbuni01ccuni01cduni01ceuni01d3uni01d4uni01e4uni01e5gcarongcaronuni01e8uni01e9uni01eauni01ebuni01eeuni01efaringacutearingacuteaeacuteaeacuteoslashacuteoslashacuteuni0200uni0201uni0202uni0203uni0204uni0205uni0206uni0207uni0208uni0209uni020auni020buni020cuni020duni020euni020funi0210uni0211uni0212uni0213uni0214uni0215uni0216uni0217scommaaccentscommaaccentuni021auni021buni021euni021funi022auni022buni022cuni022duni0230uni0231uni0232uni0233uni0237uni0259uni0292uni02b9uni02bauni02bbuni02bcuni02beuni02bfuni02c8uni02c9uni02cauni02cbuni02cc" - Source: "00000000-00001248.00000002.115128.0BF80000.00000004.mdmp") Found URL "http://www.apache.org/licenses/license-2.0" - Source: "00000000-00001248.00000002.115128.0BFD0000.00000004.mdmp") Found URL "http://www.apache.org/licenses/license-2.0uni0000uni000duni0002uni00a0uni00aduni00b2uni00b3uni00b9amacronamacronabreveabreveaogonekaogonekccircumflexccircumflexcdotaccentcdotaccentdcarondcarondcroatemacronemacronebreveebreveedotaccentedotaccenteogonekeogonekecaronecarongcircumflexgcircumflexgdotaccentgdotaccentuni0122uni0123hcircumflexhcircumflexhbarhbaritildeitildeimacronimacronibreveibreveiogonekiogonekjcircumflexjcircumflexuni0136uni0137kgreenlandiclacutelacuteuni013buni013clcaronlcaronldotldotnacutenacuteuni0145uni0146ncaronncaronnapostropheomacronomacronobreveobreveohungarumlautohungarumlautracuteracuteuni0156uni0157rcaronrcaronsacutesacutescircumflexscircumflexuni0162uni0163tcarontcarontbartbarutildeutildeumacronumacronubreveubreveuringuringuhungarumlautuhungarumlautuogonekuogonekwcircumflexwcircumflexycircumflexycircumflexzacutezacutezdotaccentzdotaccentlongsuni018fohornohornuhornuhornuni01f0aringacutearingacuteaeacuteaeacuteoslashacuteoslashacuteuni0218uni0219uni021auni021buni0237uni0259uni02bcuni02c9uni02f3" - Source: "00000000-00001248.00000002.115128.0BFD0000.00000004.mdmp") Found URL "http://www.w3.org/1999/xhtml:\windows\system32\propsys.dll:\windows\system32\msimtf.dllindowspropertydescriptions:\windows\syswow64\jscript9.dllhttp://www.w3.org/2000/svg:\windows\system32\wintrust.dll:\windows\system32\d3d10warp.dll:\windows\system32\propsys.dllcalrpcacheystemalendarext/htmlocument.htmlalendarbout:blankummy://urlpmapperbout:blankpmapperpmappersasspirpcpmappersasspirpcpmapper%systemroot%\system32\pnrpnsp.dll,-1000100n%systemroot%\system32\napinsp.dll,-10001001ebcache_" - Source: "00000000-00001248.00000003.122587.00BF0000.00000004.mdmp") Found URL "https://curl.se/docs/http-cookies.html" - Source: "00000000-00001248.00000003.122587.010C9000.00000002.mdmp") Found URL "https://curl.se/docs/alt-svc.html" - Source: "00000000-00001248.00000003.122587.010C9000.00000002.mdmp") Found URL "https://curl.se/docs/hsts.html" - Source: "00000000-00001248.00000003.122587.010C9000.00000002.mdmp") Found URL "https://clients2.google.com/service/update2/crxupdate_url\extensions\unable" - Source: "00000000-00001248.00000003.122587.010C9000.00000002.mdmp") Found URL "http://mediaget.commediagetmediaget2media" - Source: "00000000-00001248.00000003.122587.010C9000.00000002.mdmp") Found URL "https://http://mediaget.com/client/installer.php/ld/get_bconfig.php/ld/get_data.php?id=%.*s%.2f" - Source: "00000000-00001248.00000003.122587.010C9000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json10/18" - Source: "00000000-00001248.00000003.122587.08C20000.00000002.mdmp") Found URL "https://fs.microsoft.com/fs/windows/config.json,config,010/18" - Source: "00000000-00001248.00000003.122587.08C20000.00000002.mdmp") Found URL "https://mediaget.com/license/img2/close-lightgray-14px.pngc:\users\hapubwsappdataredirectxdomainblocked/img2/close-lightgray-14px.png/img2/close-lightgray-14px.png/img2/close-lightgray-14px.png/img2/close-lightgray-14px.pngurl(./montserrat-bold.eot);privacyimpactedstatechangettps://mediaget.com/license:\windows\system32\dnsapi.dllsetphishingfilterstatusprinttemplateinstantiationbcryptprimitives.dllreturn" - Source: "00000000-00001248.00000003.122587.0AC70000.00000004.mdmp") Found URL "https://cdn.brightvpn.com/static/brightvpn-setup-latest.exepathext=.com;.exe;.bat;.cmd;.vbs;.vbe;.js;.jse;.wsf;.wsh;.mscsoftware\microsoft\windows\currentversion\uninstall\psafe" - Source: "00000000-00001248.00000003.122587.0AC70000.00000004.mdmp") Found URL "https://mediaget.com/ld/get_bconfig.phpddfq" - Source: "00000000-00001248.00000003.122587.0AC70000.00000004.mdmp") Found URL "https://mediaget.com/installer/binaries/4350.7ztemp=c:\users\hapubws\appdata\local\tempprogramfiles(x86)=c:\program" - Source: "00000000-00001248.00000003.122587.0AC70000.00000004.mdmp") Found URL "https://mediaget.com/ld/get_data.php?id=0e.exenvm_home=c:\users\hapubws\appdata\roaming\nvmhttps://mediaget.com/client/installer.phpteem>bdvpnrus360kingsoft/wps" - Source: "00000000-00001248.00000003.122587.0AC70000.00000004.mdmp") Found URL "https://mediaget.com/client/installer.php_top>infatica-m/infatica-service-app.exe" - Source: "00000000-00001248.00000003.122587.0AC70000.00000004.mdmp") Found URL "https://mediaget.com/installer/binaries/360ts_setup_ww.mediaget.cpi202204_6.6.0.1090.exesoftware\wow6432node\microsoft\windows\currentversion\uninstall\360" - Source: "00000000-00001248.00000003.122587.0AC70000.00000004.mdmp") Found URL "https://opscloudio.com/privacy-policy" - Source: "00000000-00001248.00000003.122587.0AC70000.00000004.mdmp")5c:T68b,Found string "Forcing HTTP/1.1 for NTLM" (Indicator: "HTTP/1.1"; File: "capcut_pro_9_4_0.exe") Found string "HTTP/1.0 proxy connection set to keep alive" (Indicator: "HTTP/1.0"; File: "capcut_pro_9_4_0.exe") Found string "HTTP/1.1 proxy connection set close" (Indicator: "HTTP/1.1"; File: "capcut_pro_9_4_0.exe") Found string "HTTP/1.0 connection set to keep alive" (Indicator: "HTTP/1.0"; File: "capcut_pro_9_4_0.exe") Found string "POST /ld/get_bconfig.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001248.00000000.111288.00BF0000.00000004.mdmp, 00000000-00001248.00000000.111288.0AC70000.00000004.mdmp") Found string "POST /client/installer.php HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp") Found string "HTTP/1.1 200 OK" (Indicator: "HTTP/1.1"; Source: "00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp, 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp") Found string "4bit=1&lang=en-US HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001248.00000001.113207.0AC70000.00000004.mdmp, 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp, 00000000-00001248.00000003.122587.0AC70000.00000004.mdmp") Found string "GET /ld/get_data.php?id=0&alreadyInstalled=0&vi=0&browsersInstalled=chrome,iexplore,edge&defaultBrowser=edge&bundlesInstalled=&installerVersion=502&os=10.0.16299&isOs64bit=1&lang=en-US HTTP/1.1" (Indicator: "HTTP/1.1"; Source: "00000000-00001248.00000001.113207.0B030000.00000004.mdmp, 00000000-00001248.00000002.115128.0B030000.00000004.mdmp")5d:T695,Found string "# Netscape HTTP Cookie File# https://curl.se/docs/http-cookies.html# This file was generated by libcurl! Edit at your own risk." (Indicator: "libcurl"; File: "capcut_pro_9_4_0.exe") Found string "Protocol "%s" not supported or disabled in libcurl" (Indicator: "libcurl"; File: "capcut_pro_9_4_0.exe") Found string "Unsupported proxy '%s', libcurl is built without the HTTPS-proxy support." (Indicator: "libcurl"; File: "capcut_pro_9_4_0.exe") Found string "# Your alt-svc cache. https://curl.se/docs/alt-svc.html# This file was generated by libcurl! Edit at your own risk." (Indicator: "libcurl"; File: "capcut_pro_9_4_0.exe") Found string "# Your HSTS cache. https://curl.se/docs/hsts.html# This file was generated by libcurl! Edit at your own risk." (Indicator: "libcurl"; File: "capcut_pro_9_4_0.exe") Found string "Unrecognized content encoding type. libcurl understands %s content encodings." (Indicator: "libcurl"; File: "capcut_pro_9_4_0.exe") Found string "A requested feature, protocol or option was not found built-in in this libcurl due to a build-time decision." (Indicator: "libcurl"; File: "capcut_pro_9_4_0.exe") Found string "A libcurl function was given a bad argument" (Indicator: "libcurl"; File: "capcut_pro_9_4_0.exe") Found string "An unknown option was passed in to libcurl" (Indicator: "libcurl"; File: "capcut_pro_9_4_0.exe") Found string "CLIENT libcurl 7.84.0MATCH %s %s %sQUIT" (Indicator: "libcurl"; File: "capcut_pro_9_4_0.exe") Found string "CLIENT libcurl 7.84.0DEFINE %s %sQUIT" (Indicator: "libcurl"; File: "capcut_pro_9_4_0.exe") Found string "CLIENT libcurl 7.84.0%sQUIT" (Indicator: "libcurl"; File: "capcut_pro_9_4_0.exe")5e:Tdae,file/memory contains long string with (Indicator: "winrm "; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found reference to API "The client certificate exceeded the maximum size allowed by the WinRM service.%n%n User Action %n Please use a different client certificate or a different authentication mechanism." (Indicator: "winrm "; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found reference to API "Request processing failed because the WinRM service cannot load data or event source: DLL="%1" %n%n User Action %n Please check if "%1" exists. %n%n Additional Data %n Loading %1 failed with error="%2" (%%%2)." (Indicator: "winrm "; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found reference to API "The WinRM service is unable to start because of a failure during initialization. %n%n Additional Data %n The error code is %1." (Indicator: "winrm "; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found reference to API "The WinRM service has received an unsecure HTTP connection from %1. %n%n This is not a secure configuration. %n%n User Action %n Set AllowUnencrypted to False in WinRM configuration to ensure packets are encrypted on the wire." (Indicator: "winrm "; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found reference to API "The WinRM service encountered a catastrophic security failure. The service can no longer run under its security context. %n%n User Action %n Stop and restart the WinRM service. %n%n Additional Data %n The error code is %1." (Indicator: "winrm "; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found reference to API "The WinRM service cannot migrate the listener with IP address %1, Port %2 and Transport %3. A listener that has Address=%4 and Transport=%5 configuration already exists." (Indicator: "winrm "; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found reference to API "The WinRM service cannot migrate the listener with Address %1 and Transport %2. A listener that has the same Address and Transport configuration already exists." (Indicator: "winrm "; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found reference to API "The WinRM service had a failure during migration. %n%n User Action %n Create the configuration again using the WinRM command line tool. %n%n Additional Data %n The error code is: %1 %%%1" (Indicator: "winrm "; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found reference to API "The WinRM service had a failure applying the current configuration and is stopping. %n%n User Action %n Check for previous event log messages and restart the service." (Indicator: "winrm "; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found reference to API "The WinRM service is listening for WS-Management requests. %n%n User Action %n Use the following command to see the specific IPs on which WinRM is listening: %n%n winrm enumerate winrm/config/listener" (Indicator: "winrm/config/"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found reference to API "The WinRM service is not listening for WS-Management requests. %n%n User Action %n If you did not intentionally stop the service, use the following command to see the WinRM configuration: %n%n winrm enumerate winrm/config/listener" (Indicator: "winrm/config/"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp")5f:T14a3,Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00001248.00000000.111288.00BF0000.00000004.mdmp, 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.066E0000.00000002.mdmp, 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp") Found string "'Protect Kerberos Service Tickets with AES Keys' - Disabled" (Indicator: "kerberos"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "'Protect Kerberos Service Tickets with AES Keys' - Enabled" (Indicator: "kerberos"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "Kerberos Service Ticket Operations" (Indicator: "kerberos"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "Kerberos Authentication Service" (Indicator: "kerberos"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "To use Kerberos, specify the computer name as the remote destination. Also verify that the client computer and the destination computer are joined to a domain." (Indicator: "kerberos"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "Specify one of the authentication mechanisms supported by the server. If Kerberos mechanism is used," (Indicator: "kerberos"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "To use Kerberos, specify the local computer name as the remote destination. Also verify that the client computer and the destination computer are joined to a domain." (Indicator: "kerberos"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "-Kerberos is used when no authentication method and no user name are specified.%n" (Indicator: "kerberos"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "-Kerberos accepts domain user names, but not local user names.%n" (Indicator: "kerberos"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "The WSMan client cannot process the request. Proxy is not supported when the authentication mechanism with the server is Kerberos or CredSSP." (Indicator: "kerberos"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "Configure service to allow authenticating requests using Kerberos protocol." (Indicator: "kerberos"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "Modify the GP setting "Disallow Kerberos authentication" to either "Not Configured" or "Disabled"." (Indicator: "kerberos"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") file/memory contains long string with (Indicator: "kerberos"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "The WinRM client cannot process the request. The SPN Server Port can only be used when the authentication mechanism is Negotiate or Kerberos." (Indicator: "kerberos"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "To use Kerberos, specify the local computer name as the remote destination." (Indicator: "kerberos"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "The WinRM client cannot process the request. Kerberos authentication is currently disabled in the client configuration." (Indicator: "kerberos"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "The WinRM client cannot process the request. If the authentication scheme is different from Kerberos, or if the client computer is not joined to a domain," (Indicator: "kerberos"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "Kerberos authentication cannot be used when the destination is an IP address." (Indicator: "kerberos"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "The WinRM client cannot process the request. Kerberos authentication cannot be used with implicit credentials if the client computer is not joined to a domain." (Indicator: "kerberos"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "Use explicit credentials or specify a different authentication mechanism than Kerberos." (Indicator: "kerberos"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "The WinRM client cannot process the request. If you do not specify an authentication mechanism or you specify Kerberos, then you cannot use "localhost" or "127.0.0.1" or "[::1]" for the remote host name." (Indicator: "kerberos"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "You can explicitly specify a different authentication mechanism than Kerberos or specify the remote host as a DNS name or NetBIOS name." (Indicator: "kerberos"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "The WinRM service supports the following profiles: Negotiate or Kerberos over HTTP, Negotiate or Kerberos over HTTPS, and mutual certificate authentication over HTTPS using issuer thumbprints." (Indicator: "kerberos"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp")60:Ta69,Found reference to API "2130882738,3284,104,,GetKeyState,user32.dll,"00:29:28.515",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001248.00000001.113207.0B030000.00000004.mdmp") Found reference to API "2131014136,3284,104,,GetKeyState,user32.dll,"00:29:28.515",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001248.00000001.113207.0B030000.00000004.mdmp") Found reference to API "2130374820,3284,104,,GetKeyState,user32.dll,"00:29:28.515",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001248.00000001.113207.0B030000.00000004.mdmp") Found reference to API "2129930364,3284,104,,GetKeyState,user32.dll,"00:29:28.515",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001248.00000001.113207.0B030000.00000004.mdmp") Found reference to API "2130940458,3284,104,,GetKeyState,user32.dll,"00:29:28.515",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001248.00000001.113207.0B030000.00000004.mdmp") Found reference to API "2131281682,3284,104,,GetKeyState,user32.dll,"00:29:28.515",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001248.00000001.113207.0B030000.00000004.mdmp") Found reference to API "2130527902,3284,104,,GetKeyState,user32.dll,"00:29:28.515",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001248.00000001.113207.0B030000.00000004.mdmp") Found reference to API "53380726360,3284,104,,GetKeyState,user32.dll,"00:29:58.203",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001248.00000002.115128.0B030000.00000004.mdmp") Found reference to API "53381131014,3284,104,,GetKeyState,user32.dll,"00:29:58.203",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001248.00000002.115128.0B030000.00000004.mdmp") Found reference to API "53380357876,3284,104,,GetKeyState,user32.dll,"00:29:58.203",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001248.00000002.115128.0B030000.00000004.mdmp") Found reference to API "53381326182,3284,104,,GetKeyState,user32.dll,"00:29:58.203",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001248.00000002.115128.0B030000.00000004.mdmp") Found reference to API "53381201336,3284,104,,GetKeyState,user32.dll,"00:29:58.203",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001248.00000002.115128.0B030000.00000004.mdmp") Found reference to API "53381262344,3284,104,,GetKeyState,user32.dll,"00:29:58.203",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001248.00000002.115128.0B030000.00000004.mdmp") Found reference to API "52655202388,3284,104,,GetKeyState,user32.dll,"00:29:57.890",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001248.00000002.115128.0B030000.00000004.mdmp")61:T92c,"capcut_pro_9_4_0.exe" called "FindFirstFileW" with parameter %TEMP%\mediaget-installer-tmp\preloader.html (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "FindFirstFileW" with parameter %TEMP%\mediaget-installer-tmp\page-wait.jpg (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "FindFirstFileW" with parameter %TEMP%\mediaget-installer-tmp\index.html (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "FindFirstFileW" with parameter %TEMP%\mediaget-installer-tmp\img2\main-logo-white.png (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "FindFirstFileW" with parameter %TEMP%\mediaget-installer-tmp\img2\close-white.png (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "FindFirstFileW" with parameter %TEMP%\mediaget-installer-tmp\img2\settings-checked.png (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "FindFirstFileW" with parameter %TEMP%\mediaget-installer-tmp\img2\close-lightgray-14px.png (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "FindFirstFileW" with parameter %TEMP%\mediaget-installer-tmp\img2\bdvpn_point.png (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "FindFirstFileW" with parameter %TEMP%\mediaget-installer-tmp\img2\av360-check-on.png (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "FindFirstFileW" with parameter %TEMP%\mediaget-installer-tmp\img2\opera-empty.png (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "FindFirstFileW" with parameter %TEMP%\mediaget-installer-tmp\img2\opera-check-on.png (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "FindFirstFileW" with parameter %TEMP%\mediaget-installer-tmp\img2\av360.png (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "FindFirstFileW" with parameter %TEMP%\mediaget-installer-tmp\img2\point.png (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "FindFirstFileW" with parameter %TEMP%\mediaget-installer-tmp\img2\close-gray.png (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "FindFirstFileW" with parameter %TEMP%\mediaget-installer-tmp\Montserrat-Bold.eot (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "FindFirstFileW" with parameter %TEMP%\mediaget-installer-tmp\Montserrat-Regular.eot (UID: 00000000-00001248) "capcut_pro_9_4_0.exe" called "FindFirstFileW" with parameter %TEMP%\mediaget-installer-tmp\Roboto-Regular.eot (UID: 00000000-00001248)62:Tc2c,Found string "AES for Intel AES-NI, CRYPTOGAMS by " (Indicator: "aes"; File: "capcut_pro_9_4_0.exe") Found string "Vector Permutation AES for x86/SSSE3, Mike Hamburg (Stanford University)" (Indicator: "aes"; File: "capcut_pro_9_4_0.exe") Found string "ChaCha20 for x86, CRYPTOGAMS by " (Indicator: "chacha"; File: "capcut_pro_9_4_0.exe") Found string "base64" (Indicator: "base64"; File: "capcut_pro_9_4_0.exe") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; File: "capcut_pro_9_4_0.exe") file/memory contains long string with (Indicator: "aes"; File: "translations_old.json") Found string "ystem.OfflineFiles.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00001248.00000001.113207.05990000.00000002.mdmp") Found string "ystem.Security.EncryptionOwners" (Indicator: ".encrypt"; Source: "00000000-00001248.00000001.113207.05990000.00000002.mdmp") Found string "ystem.Security.EncryptionOwnersDisplay" (Indicator: ".encrypt"; Source: "00000000-00001248.00000001.113207.05990000.00000002.mdmp") Found string "ystem.ZipFolder.Encrypted" (Indicator: ".encrypt"; Source: "00000000-00001248.00000001.113207.05990000.00000002.mdmp") Found string "'Protect Kerberos Service Tickets with AES Keys' - Disabled" (Indicator: "aes"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "'Protect Kerberos Service Tickets with AES Keys' - Enabled" (Indicator: "aes"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "3DES" (Indicator: "3des"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp, 00000000-00001248.00000003.122587.010C9000.00000002.mdmp") Found string "AES-128" (Indicator: "aes"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "AES-192" (Indicator: "aes"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "AES-256" (Indicator: "aes"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "Certificate ECDSA P256" (Indicator: "ecdsa"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "Certificate ECDSA P384" (Indicator: "ecdsa"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "SSL ECDSA P256" (Indicator: "ecdsa"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "SSL ECDSA P384" (Indicator: "ecdsa"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "AES-GCM 128" (Indicator: "aes"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "AES-GCM 192" (Indicator: "aes"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "AES-GCM 256" (Indicator: "aes"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "AES-GMAC 128" (Indicator: "aes"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "AES-GMAC 192" (Indicator: "aes"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp")63:T595,file/memory contains long string with (Indicator: "Get-Content"; File: "index.template") Found string "bar.className+=" ui-progressbar ui-widget ui-widget-content ui-corner-all";" (Indicator: "Get-Content"; Source: "00000000-00001248.00000001.113207.0B030000.00000004.mdmp, 00000000-00001248.00000002.115128.0B030000.00000004.mdmp, 00000000-00001248.00000002.115128.0BA60000.00000004.mdmp, 00000000-00001248.00000003.122587.0B030000.00000004.mdmp") Found string ".ui-widget-content { border: 1px solid #aaaaaa/*{borderColorContent}*/; background: #ffffff/*{bgColorContent}*/ /*{bgImgUrlContent}*/ 50%/*{bgContentXPos}*/ 50%/*{bgContentYPos}*/ repeat-x/*{bgContentRepeat}*/; color: #222222/*{fcContent}*/; }" (Indicator: "Get-Content"; Source: "00000000-00001248.00000001.113207.0B030000.00000004.mdmp, 00000000-00001248.00000002.115128.0B030000.00000004.mdmp, 00000000-00001248.00000003.122587.0B030000.00000004.mdmp") Found string ".ui-widget-content a { color: #222222/*{fcContent}*/; }" (Indicator: "Get-Content"; Source: "00000000-00001248.00000001.113207.0B030000.00000004.mdmp, 00000000-00001248.00000002.115128.0B030000.00000004.mdmp, 00000000-00001248.00000003.122587.0B030000.00000004.mdmp") Found string "ui-progressbar ui-widget ui-widget-content ui-corner-all" (Indicator: "Get-Content"; Source: "00000000-00001248.00000002.115128.0B4A0000.00000004.mdmp, 00000000-00001248.00000003.122587.0B4A0000.00000004.mdmp")64:T11bc,Found string "Excessive password length for proxy auth" (Indicator: "password"; File: "capcut_pro_9_4_0.exe") Found string "could not parse PKCS12 file, check password, OpenSSL error %s" (Indicator: "password"; File: "capcut_pro_9_4_0.exe") Found string "password" (Indicator: "password"; File: "capcut_pro_9_4_0.exe") Found string "The specified account's password has expired." (Indicator: "password"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "Unknown user name or bad password." (Indicator: "password"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "Failed to zero secret data." (Indicator: "secret"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "ChangePassword (with knowledge of old password)" (Indicator: "password"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "SetPassword (without knowledge of old password)" (Indicator: "password"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "Create a secret object" (Indicator: "secret"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "Change secret value" (Indicator: "secret"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "Query secret value" (Indicator: "secret"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "The client specified username and password in the request to the destination computer. But the destination" (Indicator: "password"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "when using HTTPS. Username and password must be specified." (Indicator: "password"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "To use Basic, specify the computer name as the remote destination, specify Basic authentication and provide user name and password." (Indicator: "password"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "To use Basic, specify the local computer name as the remote destination, specify Basic authentication and provide user name and password." (Indicator: "password"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "-The user name or password specified are invalid.%n" (Indicator: "password"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "No user name, password or client certificate should be specified with the 'no authentication' option." (Indicator: "password"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "The WinRM client cannot process the request. Requests must include user name and password when Basic or Digest authentication mechanism is used." (Indicator: "password"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "Add the user name and password or change the authentication mechanism and try the request again." (Indicator: "password"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "The WinRM client cannot process the request. Requests must not include user name and password when a certificate is used for authentication." (Indicator: "password"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "Remove the user name and password or change the authentication mechanism and try the request again." (Indicator: "password"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "The WinRM client cannot process the request. A certificate thumbprint was specified together with a user name or password." (Indicator: "password"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "The WinRM client cannot process the request. When an authentication mechanism is not specified, only user name and password credentials are allowed." (Indicator: "password"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "The WinRM client cannot process the request. For authentication mechanisms that require the credentials of an user account, both user name and password must be specified." (Indicator: "password"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "Specify the missing user name or password and try the request again." (Indicator: "password"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp")65:T147c,"SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000001.113207.0AC70000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.0AC70000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360SD" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360TotalSecurity" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360 Internet Security" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PSafe Antivirus" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360 Internet Security 2013" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PSafe Antivirus" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\safebox" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\PSafe Total" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\safebox" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001248.00000001.113207.0AC70000.00000004.mdmp 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp 00000000-00001248.00000003.122587.0AC70000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\PSafe Total" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001248.00000001.113207.0AC70000.00000004.mdmp 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp 00000000-00001248.00000003.122587.0AC70000.00000004.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\360SD" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001248.00000001.113207.0AC70000.00000004.mdmp 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp 00000000-00001248.00000003.122587.0AC70000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360 Internet Security 2013" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001248.00000001.113207.0AC70000.00000004.mdmp 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp 00000000-00001248.00000003.122587.0AC70000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360TotalSecurity" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001248.00000001.113207.0AC70000.00000004.mdmp 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp 00000000-00001248.00000003.122587.0AC70000.00000004.mdmp "SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\360 Internet Security" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00001248.00000001.113207.0AC70000.00000004.mdmp 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp 00000000-00001248.00000003.122587.0AC70000.00000004.mdmp66:Tfed,Found string "Hostname '%s' was found in DNS cache" (Indicator: "hostname"; File: "capcut_pro_9_4_0.exe") Found string "Hostname in DNS cache was stale, zapped" (Indicator: "hostname"; File: "capcut_pro_9_4_0.exe") Found string "Hostname %s was found in DNS cache" (Indicator: "hostname"; File: "capcut_pro_9_4_0.exe") Found string "Hostname '%s' was found" (Indicator: "hostname"; File: "capcut_pro_9_4_0.exe") Found string "SOCKS5: hostname '%s' found" (Indicator: "hostname"; File: "capcut_pro_9_4_0.exe") Found string "service missing in parameters or hostname" (Indicator: "hostname"; File: "capcut_pro_9_4_0.exe") Found string "region missing in parameters or hostname" (Indicator: "hostname"; File: "capcut_pro_9_4_0.exe") Found string "Hostname mismatch" (Indicator: "hostname"; File: "capcut_pro_9_4_0.exe") Found string "The hostname pattern is invalid: "%1"" (Indicator: "hostname"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "Hostname patterns must contain one or more patterns." (Indicator: "hostname"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "TrustedHosts list contains an invalid hostname or hostname pattern." (Indicator: "hostname"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "The WinRM client could not create a push subscription because there are no listeners configured that match the specified hostname and transport, or because there is no enabled firewall exception on the port used by the selected listener." (Indicator: "hostname"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "Change the hostname and transport, create an appropriate firewall exception, or run winrm quickconfig." (Indicator: "hostname"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "Transport, port and suffix are optional. The host may be a hostname or an IP address." (Indicator: "hostname"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "The WinRM client cannot process the request. The certificate CN and the hostname that were provided do not match." (Indicator: "hostname"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "You may want to use the CHCP command to change the client Code Page to 437 and receive the results in English." (Indicator: "chcp"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "The destination computer name must be a hostname or an IP address, and must not be a URL." (Indicator: "hostname"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "DNS query for %2 hostname is sent: Handle=%3" (Indicator: "hostname"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "DNS query for %2 hostname is complete: Handle=%3, Addresses=%5" (Indicator: "hostname"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "DNS query for %2 hostname failed: Handle=%3 Error=%4" (Indicator: "hostname"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "Re-used DNS cache, query for %2 hostname is complete: Handle=%3, Addresses=%5" (Indicator: "hostname"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "nslookup [-opt ...] # interactive mode using default server" (Indicator: "nslookup"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "nslookup [-opt ...] - server # interactive mode using 'server'" (Indicator: "nslookup"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "nslookup [-opt ...] host # just look up 'host' using default server" (Indicator: "nslookup"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp") Found string "nslookup [-opt ...] host server # just look up 'host' using 'server'" (Indicator: "nslookup"; Source: "00000000-00001248.00000002.115128.066E0000.00000002.mdmp")67:Ta41,"capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") "capcut_pro_9_4_0.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "")68:T567,"capcut_pro_9_4_0.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MEDIA GET LLC\MEDIAGET2-SYSTEMSCOPE\MEDIAGET_INFO"; Key: "HASDOWNLOADEDUPDATE"; Value: "false") "capcut_pro_9_4_0.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS"; Value: "0100000000") "capcut_pro_9_4_0.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "INTRANETNAME"; Value: "0100000000") "capcut_pro_9_4_0.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0100000000") "capcut_pro_9_4_0.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0000000000") "capcut_pro_9_4_0.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT"; Key: "CACHEPREFIX"; Value: "000000") "capcut_pro_9_4_0.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES"; Key: "CACHEPREFIX"; Value: "Cookie:") "capcut_pro_9_4_0.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY"; Key: "CACHEPREFIX"; Value: "Visited:")69:Tb79,"av360.png" has type "PNG image data 720 x 356 8-bit/color RGBA non-interlaced" and extension "png" "install-lenta.png" has type "PNG image data 4189 x 678 8-bit/color RGBA non-interlaced" and extension "png" "opera-empty.png" has type "PNG image data 720 x 444 8-bit/color RGBA non-interlaced" and extension "png" "coc.png" has type "PNG image data 720 x 444 8-bit/color RGBA non-interlaced" and extension "png" "install-lenta-3-308.png" has type "PNG image data 1901 x 308 8-bit/color RGBA non-interlaced" and extension "png" "page-wait.png" has type "PNG image data 720 x 444 8-bit/color RGBA non-interlaced" and extension "png" "wps-ru.jpg" has type "JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 baseline precision 8 720x356 components 3" and extension "jpg" "cancel-page-new1-ru.png" has type "PNG image data 720 x 444 8-bit/color RGBA non-interlaced" and extension "png" "wps-en.jpg" has type "JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 baseline precision 8 720x356 components 3" and extension "jpg" "earnapp.png" has type "PNG image data 200 x 176 8-bit/color RGB non-interlaced" and extension "png" "install-lenta-2-308.png" has type "PNG image data 2645 x 308 8-bit/color RGBA non-interlaced" and extension "png" "wps.jpg" has type "JPEG image data JFIF standard 1.01 aspect ratio density 1x1 segment length 16 baseline precision 8 720x356 components 3" and extension "jpg" "page-wait.jpg" has type "JPEG image data JFIF standard 1.01 resolution (DPI) density 72x72 segment length 16 baseline precision 8 720x444 components 3" and extension "jpg" "main-logo-white.png" has type "PNG image data 168 x 127 8-bit/color RGBA non-interlaced" and extension "png" "soax-mglogo.png" has type "PNG image data 207 x 54 8-bit/color RGBA non-interlaced" and extension "png" "radio-checked.png" has type "PNG image data 14 x 13 8-bit/color RGBA non-interlaced" and extension "png" "main-logo-compact.png" has type "PNG image data 170 x 31 8-bit/color RGBA non-interlaced" and extension "png" "radio-unchecked.png" has type "PNG image data 14 x 13 8-bit/color RGBA non-interlaced" and extension "png" "soax-schema.png" has type "PNG image data 542 x 38 8-bit/color RGBA non-interlaced" and extension "png" "yandex-logo.png" has type "PNG image data 83 x 24 8-bit/color RGBA non-interlaced" and extension "png" "av360-check-on.png" has type "PNG image data 24 x 24 8-bit/color RGBA non-interlaced" and extension "png" "bundle1-check-on.png" has type "PNG image data 18 x 18 8-bit/color RGBA non-interlaced" and extension "png" "settings-checked.png" has type "PNG image data 24 x 24 8-bit/color RGBA non-interlaced" and extension "png" "opera-check-on.png" has type "PNG image data 24 x 24 8-bit/color RGBA non-interlaced" and extension "png" "bundle2-check-on.png" has type "PNG image data 18 x 18 8-bit/color RGBA non-interlaced" and extension "png"6a:T9d8,Found string "SleepConditionVariableCS" (Source: capcut_pro_9_4_0.exe, API is part of module: KERNELBASE.DLL) Found string "AddDllDirectory" (Source: capcut_pro_9_4_0.exe, API is part of module: KERNELBASE.DLL) Found string "RtlVerifyVersionInfo" (Source: capcut_pro_9_4_0.exe, API is part of module: NTDLL.DLL) Found string "FlsAlloc" (Source: capcut_pro_9_4_0.exe, API is part of module: KERNELBASE.DLL) Found string "FlsFree" (Source: capcut_pro_9_4_0.exe, API is part of module: KERNELBASE.DLL) Found string "FlsGetValue" (Source: capcut_pro_9_4_0.exe, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: capcut_pro_9_4_0.exe, API is part of module: KERNELBASE.DLL) Found string "log10" (Source: capcut_pro_9_4_0.exe, API is part of module: MSVCRT.DLL) Found string "atan2" (Source: capcut_pro_9_4_0.exe, API is part of module: MSVCRT.DLL) Found string "floor" (Source: capcut_pro_9_4_0.exe, API is part of module: MSVCRT.DLL) Found string "ldexp" (Source: capcut_pro_9_4_0.exe, API is part of module: MSVCRT.DLL) Found string "frexp" (Source: capcut_pro_9_4_0.exe, API is part of module: MSVCRT.DLL) Found string "AreFileApisANSI" (Source: capcut_pro_9_4_0.exe, API is part of module: KERNELBASE.DLL) Found string "CompareStringEx" (Source: capcut_pro_9_4_0.exe, API is part of module: KERNELBASE.DLL) Found string "EnumSystemLocalesEx" (Source: capcut_pro_9_4_0.exe, API is part of module: KERNELBASE.DLL) Found string "GetDateFormatEx" (Source: capcut_pro_9_4_0.exe, API is part of module: KERNELBASE.DLL) Found string "GetLocaleInfoEx" (Source: capcut_pro_9_4_0.exe, API is part of module: KERNELBASE.DLL) Found string "GetTimeFormatEx" (Source: capcut_pro_9_4_0.exe, API is part of module: KERNELBASE.DLL) Found string "GetUserDefaultLocaleName" (Source: capcut_pro_9_4_0.exe, API is part of module: KERNELBASE.DLL) Found string "IsValidLocaleName" (Source: capcut_pro_9_4_0.exe, API is part of module: KERNELBASE.DLL) Found string "LocaleNameToLCID" (Source: capcut_pro_9_4_0.exe, API is part of module: KERNELBASE.DLL) Found string "RoInitialize" (Source: capcut_pro_9_4_0.exe, API is part of module: COMBASE.DLL) Found string "RoUninitialize" (Source: capcut_pro_9_4_0.exe, API is part of module: COMBASE.DLL) Found string "AppPolicyGetProcessTerminationMethod" (Source: capcut_pro_9_4_0.exe, API is part of module: KERNEL.APPCORE.DLL) Found string "AppPolicyGetThreadInitializationType" (Source: capcut_pro_9_4_0.exe, API is part of module: KERNEL.APPCORE.DLL)6b:T504,"POST /ld/get_bconfig.php HTTP/1.1 Host: mediaget.com User-Agent: m_installer Accept: */* Content-Length: 7 Content-Type: application/x-www-form-urlencoded" with payload::==> "3465872" HTTP/1.1 200 OK Alt-Svc: h3=":8443"; ma=2592000 Content-Type: text/html; charset=UTF-8 Date: Sun 18 Oct 2026 13:33:00 GMT Server: nginx/1.28.0 Set-Cookie: cookie=da5a39eab07327fa; Path=/; HttpOnly; Secure; SameSite=None Transfer-Encoding: chunked with response body ==>7B2262756E646C6573223A5B7B226E616D65223A22666C756B65222C22636865636B73223A5B7B226D6574686F64223A312C22706174685F656E765F76617222....... "POST /client/installer.php HTTP/1.1 Host: mediaget.com User-Agent: m_installer Accept: */* Content-Length: 197 Content-Type: application/x-www-form-urlencoded" with payload::==> "start5020010.0.16299" HTTP/1.1 200 OK Alt-Svc: h3=":8443"; ma=2592000 Content-Type: text/xml;charset=UTF-8 Date: Sun 18 Oct 2026 13:33:01 GMT Server: nginx/1.28.0 Transfer-Encoding: chunked with response body ==>3C3F786D6C2076657273696F6E3D22312E302220656E636F64696E673D227574662D38223F3E0A3C726573706F6E73653E3C5374617475733E3230303C2F5374.......6c:T400,AAABAAEAICAQdQAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAZmZm5mYAAAAAAAAAAAAAZu7u7u7u5gAAAAAAAAAAZu7u5mZu7u7mAAAAAAAABmbuYGZmYADu7uAAAAAAAGZu5m7u7uAAAO7uAAAAAA5mYG7u7u7gDuYO7uAAAADuZg7u7gAAAA7uZm7mAAAA7mDu7gAAAgAA7uYO7mAAAO5u7mAAACMgAA7uYO7gAADuDuYAAAI3MAAA7uZu5gAAAO7mAAAiNzIAAA7mDuYAAADuYAACI3dzIAAO7m7uAAAA7mAAIjMzMzIAAO5m7gAADu4AACMzMzMzIADuYO4A7gbuAAIzMzMzMzIA7uDuYO5m7gAiMzMzMzMyAO7g7mDuZu4AIiMzMzMzIiDuYA4A7mDuYAACMzMzMgAA7mAAAO7g7mAAAnd3d3IADu5gAADu4G7gAAJ3d3dyAA7uAAAADuYO5gACiIiIggDu5uYAAA7uBu5gAiIiIiIG7uBmYAAA7uBu5gAAAAAAbu5uZmAAAO7mBu5gAAAAZu7uZmYAAAAO7mAG4ADmbu7u5mZgAAAAAO7uAAAO7u7u4GZmYAAAAAAO7uYAAO7uYGZm7gAAAAAAAO7u5mYABmbm7gAAAAAAAAAO7u7u7u7u7uAAAAAAAAAAAADu7u7u7uAAAAAAAAAAAAAAAAAAAAAAAAAAAAD///////gf///AA///n+H///j4f//Afj//g/8f/h//j/x//8/8/v/H+Px/5/n4P+Pz8B+z8+APs/PAB7MzgAOTM4ADkzOAA58T4A8/m+APP5/gDz+f4A5/z+AMf8f/+P/n/+H/8/4D//D8D//8f////g/z//+AB///8D///////w==30:["$","$Lc",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$33"}}],["$","$L35",null,{"initialData":{"schema_version":"1.0.17","sha256":"d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":80,"unified_at_epoch_ms":1794662346232,"unified_at":"2026-11-14T13:19:06.232Z","metadata":{"hashes":{"sha256":"d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","sha1":"0351f98e359b726e1fdf1050be7de9b34a84bc5d","md5":"e4673d5521f2561ae2a3c4d86103ec53","sha512":"8d3696e981ab50b867f5ebe56f3875ad1334860cc02c9c1373820c937c1c69f646126161232d70f59fd5927120f8826fadfc92a1fa9c879cdb4b3e9e202eae08","ssdeep":"98304:xRTr0vFD/SS4IoEK/JrE3HclayesmsG0w:xxoD/SS4bEUJ43HKG0w","ssdeep_chunks":["98304:xRTr0vF","98304:RTr0vFD","98304:Tr0vFD/","98304:r0vFD/S","98304:0vFD/SS","98304:vFD/SS4","98304:FD/SS4I","98304:D/SS4Io","98304:/SS4IoE","98304:SS4IoEK","98304:S4IoEK/","98304:4IoEK/J","98304:IoEK/Jr","98304:oEK/JrE","98304:EK/JrE3","98304:K/JrE3H","98304:/JrE3Hc","98304:JrE3Hcl","98304:rE3Hcla","98304:E3Hclay","98304:3Hclaye","98304:Hclayes","98304:clayesm","98304:layesms","98304:ayesmsG","98304:yesmsG0","98304:esmsG0w","196608:xRTr0vF","196608:RTr0vFD","196608:Tr0vFD/","196608:r0vFD/S","196608:0vFD/SS","196608:vFD/SS4","196608:FD/SS4I","196608:D/SS4Io","196608:/SS4IoE","196608:SS4IoEK","196608:S4IoEK/","196608:4IoEK/J","196608:IoEK/Jr","196608:oEK/JrE","196608:EK/JrE3","196608:K/JrE3H","196608:/JrE3Hc","196608:JrE3Hcl","196608:rE3Hcla","196608:E3Hclay","196608:3Hclaye","196608:Hclayes","196608:clayesm","196608:layesms","196608:ayesmsG","196608:yesmsG0","196608:esmsG0w","98304:xxoD/SS","98304:xoD/SS4","98304:oD/SS4b","98304:D/SS4bE","98304:/SS4bEU","98304:SS4bEUJ","98304:S4bEUJ4","98304:4bEUJ43","98304:bEUJ43H","98304:EUJ43HK","98304:UJ43HKG","98304:J43HKG0","98304:43HKG0w"],"imphash":"0d3c44be4726ca9d807ea242ceb49c39","pehash":"0b54726292fd0e130463454b8c19e4e6363500e8"},"file_info":{"file_name":"capcut_pro_9_4_0.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":3240672,"entropy":6.88,"compile_timestamp":"2026-10-15T10:43:34","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792171165000,"last_seen":1792330351000,"last_multi_scan":1792330351000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":5,"import_count":0,"export_count":0,"embedded_file_count":11,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":2389330,"raw_size":2389504},{"name":".rdata","virtual_address":"0x249000","virtual_size":677782,"raw_size":677888},{"name":".data","virtual_address":"0x2ef000","virtual_size":51168,"raw_size":24576},{"name":".rsrc","virtual_address":"0x2fc000","virtual_size":35344,"raw_size":35840},{"name":".reloc","virtual_address":"0x305000","virtual_size":90756,"raw_size":91136}],"section_names":[".text",".rdata",".data",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":80,"tags":["windows-server-utility"]},"stats":{"av":{"malicious_count":7,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":99},"sandbox_signatures":{"informative_count":229,"suspicious_count":17,"malicious_count":1,"total":247},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Application.Bundler.MediaGet.6","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"malicious","threat_name":"PUABundler_Win32_MediaGet","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/grayware_confidence_70% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"PUP.Win32.MediaGet.sd!c","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader ( 005d539c1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Application.Bundler.MediaGet.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Reconnaissance","technique":"IP Addresses","attack_id":"T1590.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1590/005","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Recently renewed or created SSL certificate"},{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Initial Access","technique":"External Remote Services","attack_id":"T1133","attack_id_wiki":"https://attack.mitre.org/techniques/T1133","identifiers":[{"type":"informative","value":"Able to configure Windows Remote Management service"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Execution","technique":"Command and Scripting Interpreter","attack_id":"T1059","attack_id_wiki":"https://attack.mitre.org/techniques/T1059","identifiers":[{"type":"informative","value":"Logged script engine calls"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"},{"type":"informative","value":"Contains ability to start a service (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Credential Access","technique":"Credentials In Files","attack_id":"T1552.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/001","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Credential Access","technique":"Steal Web Session Cookie","attack_id":"T1539","attack_id_wiki":"https://attack.mitre.org/techniques/T1539","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"},{"type":"informative","value":"Sets a windows hook"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Found registry location strings in memory"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Calls an API used to retrieve geographical location information"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve specified item(s) (Powershell command string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve the host name of a computer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Contains ability to enumerate running processes using Tasklist"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Queries kernel debugger information"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"},{"type":"informative","value":"Able to identify virtual environment using user register activity"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to find open windows (API string)"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Queries the user identity associated with the current process token"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to retrieve system network configuration"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"informative","value":"Possibly checks for the presence of an Antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"},{"type":"informative","value":"Imports a library used to perform LDAP operation"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample contains the RDTSCP instruction"},{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Discovery","technique":"Internet Connection Discovery","attack_id":"T1016.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1016/001","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"},{"type":"informative","value":"Attempts to access Microsoft Outlook file path"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Collection","technique":"Archive Collected Data","attack_id":"T1560","attack_id_wiki":"https://attack.mitre.org/techniques/T1560","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Queries the display settings of system associated file extensions"},{"type":"informative","value":"Writes files in a temp directory"},{"type":"informative","value":"Queries list of installed browsers"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Collection","technique":"Data Staged","attack_id":"T1074","attack_id_wiki":"https://attack.mitre.org/techniques/T1074","identifiers":[{"type":"informative","value":"Able to aggregate collected data, possibly for exfiltration"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"},{"type":"informative","value":"Uses HTTPS for communication"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to transfer data using curl"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops files with image extension"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Uses cURL to communicate over HTTPS"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"GETs files from a web server (PE files)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Contains reference to Mail transfer protocol"},{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Command and Control","technique":"Remote Access Tools","attack_id":"T1219","attack_id_wiki":"https://attack.mitre.org/techniques/T1219","identifiers":[{"type":"informative","value":"Able to use IDE tunneling for remote connection"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Command and Control","technique":"Steganography","attack_id":"T1001.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1001/002","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"informative","value":"Shows ability to use asymmetric encryption algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"POSTs data to a web server"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to cryptographic keys"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"},{"type":"informative","value":"The input sample is signed with a valid certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"suspicious","value":"YARA signature match - ChaCha20 encryption algorithm"},{"type":"informative","value":"Contains key cryptographic functions (API string)"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"YARA signature match – Encryption algorithm"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"YARA signature match - Djb2 Hash Algorithm"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Stealth","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"suspicious","value":"Creates a mutant associated with known malware"},{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Stealth","technique":"Compression","attack_id":"T1027.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/015","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Stealth","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"},{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – cryptographic algorithms"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"The WS-Management service does not support the specified compression scheme (%1).\" (Source: \"00000000-00001248.00000002.115128.066E0000.00000002.mdmp\")\n Found string \"The only supported compression type is \"xpress\".\" (Source: \"00000000-00001248.00000002.115128.066E0000.00000002.mdmp\")\n Found string \"The WinRM client cannot process the request. The request contained the compression option but contained an unrecognized value.\" (Source: \"00000000-00001248.00000002.115128.066E0000.00000002.mdmp\")\n Found string \"Change the value for the compression option and try the request again.\" (Source: \"00000000-00001248.00000002.115128.066E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"capcut_pro_9_4_0.exe\" called \"FindResourceW\" with parameter \"129\" - (UID: 00000000-00001248)\n \"capcut_pro_9_4_0.exe\" called \"FindResourceW\" with parameter \"12900216\" - (UID: 00000000-00001248)\n \"capcut_pro_9_4_0.exe\" called \"FindResourceW\" with parameter \"13523824\" - (UID: 00000000-00001248)\n \"capcut_pro_9_4_0.exe\" called \"FindResourceW\" with parameter \"181683040\" - (UID: 00000000-00001248)\n \"capcut_pro_9_4_0.exe\" called \"FindResourceW\" with parameter \"181683264\" - (UID: 00000000-00001248)\n \"capcut_pro_9_4_0.exe\" called \"FindResourceW\" with parameter \"181683200\" - (UID: 00000000-00001248)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"capcut_pro_9_4_0.exe\" called \"LoadResource with parameter {'hModule': '15204352', 'hResInfo': '18334416'}\" (UID: 00000000-00001248)\n \"capcut_pro_9_4_0.exe\" called \"LoadResource with parameter {'hModule': '15204352', 'hResInfo': '18334336'}\" (UID: 00000000-00001248)\n \"capcut_pro_9_4_0.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '18334256'}\" (UID: 00000000-00001248)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"QueryPerformanceFrequency\" (Indicator: \"QueryPerformanceFrequency\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"SleepEx\" (Indicator: \"SleepEx\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObject\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"WaitForSingleObjectEx\" (Indicator: \"WaitForSingleObjectEx\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"WaitForMultipleObjects\" (Indicator: \"WaitForMultipleObjects\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"FreeLibraryAndExitThread\" (Indicator: \"FreeLibrary\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"capcut_pro_9_4_0.exe\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"capcut_pro_9_4_0.exe\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-\"; File: \"capcut_pro_9_4_0.exe\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SHA512 block transform for x86, CRYPTOGAMS by \" (Indicator: \"SHA512\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to \"%s4-HMAC-SHA256%s%s%s\" (Indicator: \"HMAC\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to \"Authorization: %s4-HMAC-SHA256 Credential=%s/%s, SignedHeaders=%s, Signature=%sX-%s-Date: %s\" (Indicator: \"HMAC\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00001248.00000002.115128.066E0000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$36","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"capcut_pro_9_4_0.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"capcut_pro_9_4_0.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$37","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$38","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$39","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$3a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$3b","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptReleaseContext\" (Indicator: \"CryptReleaseContext\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"CryptExportKey\" (Indicator: \"CryptExportKey\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"CryptDestroyKey\" (Indicator: \"CryptDestroyKey\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"CryptCreateHash\" (Indicator: \"CryptCreateHash\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"CryptDestroyHash\" (Indicator: \"CryptDestroyHash\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"CryptGetUserKey\" (Indicator: \"CryptGetUserKey\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"CryptAcquireContextW\" (Indicator: \"CryptAcquireContextW\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001248.00000000.111288.00BF0000.00000004.mdmp, 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp, 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"$3c","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$3d","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$3e","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use asymmetric encryption algorithm","description":"The analysis found public/private key which shows ability to use asymmetric encryption algorithm. Matched sigs: Possibly contains Public/Private key (encryption)","origin":"Indicator Combinations","mitre_attack_id":"T1573.002","relevance":1,"id":"summary-33","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$3f","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"Copyright 2011 The Montserrat Project Authors (https://github.com/JulietaUla/Montserrat)\" (Indicator: \"github.com\"; Source: \"00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000001.113207.0A5D0000.00000004.mdmp, 00000000-00001248.00000001.113207.0B030000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.0B030000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"github.com\"; Source: \"00000000-00001248.00000001.113207.0BF30000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"github.com\"; Source: \"00000000-00001248.00000002.115128.0BF80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"etUserNameA\" (Source: \"00000000-00001248.00000000.111288.0AC70000.00000004.mdmp\")\n Found string \"ystem.Identity.QualifiedUserName\" (Source: \"00000000-00001248.00000001.113207.05990000.00000002.mdmp\")\n Found string \"ystem.Identity.UserName\" (Source: \"00000000-00001248.00000001.113207.05990000.00000002.mdmp\")\n Found string \"ystem.UserName\" (Source: \"00000000-00001248.00000001.113207.05990000.00000002.mdmp\")\n Found string \"The credential consists of both Password and UserName being supplied together in a pair.\" (Source: \"00000000-00001248.00000002.115128.066E0000.00000002.mdmp\")\n Found string \"VPN.UserName=\" (Source: \"00000000-00001248.00000002.115128.066E0000.00000002.mdmp\")\n Found string \"providerFilter=Yes VPN.UserName=\"UserXXX\"\" (Source: \"00000000-00001248.00000002.115128.066E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"capcut_pro_9_4_0.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"$40","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatusEx\" (File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"EnumSystemLocalesW\" (Indicator: \"EnumSystemLocales\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"EnumSystemLocalesEx\" (Indicator: \"EnumSystemLocales\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetLocaleInfoEx\" (Indicator: \"GetLocaleInfo\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetUserDefaultLocaleName\" (Indicator: \"GetUserDefaultLocaleName\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetTimeFormatW\" (Indicator: \"GetTimeFormat\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"getaddrinfo() thread failed to start\" (Indicator: \"getaddrinfo\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"ExpandEnvironmentStringsW\" in file \"capcut_pro_9_4_0.exe\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"capcut_pro_9_4_0.exe\"\n Found system information discovery API: \"GetUserObjectInformationW\" in file \"capcut_pro_9_4_0.exe\"\n Found system information discovery API: \"GetMonitorInfoW\" in file \"capcut_pro_9_4_0.exe\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetSystemDefaultUILanguage\" (Indicator: \"GetSystemDefaultUILanguage\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"findwindow\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"SendMessageW\" (Indicator: \"sendmessage\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"postMessage\" (Indicator: \"postmessage\"; Source: \"00000000-00001248.00000002.115128.0BA80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"capcut_pro_9_4_0.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00001248)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"capcut_pro_9_4_0.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00001248)\n \"capcut_pro_9_4_0.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00001248)\n \"capcut_pro_9_4_0.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00001248)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"capcut_pro_9_4_0.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00001248)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"capcut_pro_9_4_0.exe\" called \"IsWow64Process\" with parameter \"1248\" - (UID: 00000000-00001248)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"capcut_pro_9_4_0.exe\" called \"GetWindowTextW\" (UID: 00000000-00001248)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"capcut_pro_9_4_0.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001248)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$41","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\"capcut_pro_9_4_0.exe\" called \"GetVersionExA\" with parameter 940000000a00000000000000ab3f00000200000000e48a06c0e48a0606d3356e40d08f0080dee46e2cd18f00e0e3e46ee6ef5e00feffffff97e6e46eb1e6e46e10eae46ea8d08f003a27e36e10eae46e735f1a7501000000200ee56e885f1a754027e36e832ff065d8d08f0048e0e46ef810e36e0c11e36e00000000000000009ee0e46e3f005c00000090005c00570000000000 (UID: 00000000-00001248)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\"capcut_pro_9_4_0.exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00001248)\n \"capcut_pro_9_4_0.exe\" called \"GetLocaleInfoW\" with parameter \"1024\" - (UID: 00000000-00001248)","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve geographical location information","description":"Observed import api \"getaddrinfo\" which can be \"used to convert host name to address\" [Source: capcut_pro_9_4_0.exe]","origin":"Static Parser","mitre_attack_id":"T1082","relevance":5,"id":"static-190","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"capcut_pro_9_4_0.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set default crypto engine '%s'\" (Indicator: \"set \"; File: \"capcut_pro_9_4_0.exe\")\n Found string \"set default crypto engine '%s' failed\" (Indicator: \"set \"; File: \"capcut_pro_9_4_0.exe\")\n Found string \"set timeouts for state %d; Total % I64d, retry %d maxtry %d\" (Indicator: \"set \"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToSystemTime\" (Indicator: \"FileTimeToSystemTime\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"SystemTimeToFileTime\" (Indicator: \"SystemTimeToFileTime\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"FindWindowW\" (Indicator: \"FindWindow\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetWindowTextLengthW\" (Indicator: \"GetWindowText\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetWindowTextW\" (Indicator: \"GetWindowText\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system network configuration","description":"$42","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-430","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$43","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Queries list of installed browsers","description":"$44","origin":"Registry Access","mitre_attack_id":"T1005","relevance":1,"id":"registry-137","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"capcut_pro_9_4_0.exe\" queried token user identity (UID: 00000000-00001248)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"capcut_pro_9_4_0.exe\" queries volume information of \"C:\\Windows\\Fonts\\times.ttf\" at 00000000-00001248-00000C17-293354542\n \"capcut_pro_9_4_0.exe\" queries volume information of \"C:\\Windows\\Fonts\\arial.ttf\" at 00000000-00001248-00000C17-298907523","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"capcut_pro_9_4_0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"$45","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Able to aggregate collected data, possibly for exfiltration","description":"\"archive.7z\" copied on \"%TEMP%\\mediaget-installer-tmp\\archive.7z\"","origin":"Binary File","mitre_attack_id":"T1074","relevance":1,"id":"binary-87","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKeyExW\" in file \"capcut_pro_9_4_0.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"QueryServiceStatusEx\" (Indicator: \"QueryServiceStatus\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"capcut_pro_9_4_0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\mediaget-installer-tmp (UID: 00000000-00001248)\n \"capcut_pro_9_4_0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\mediaget-installer-tmp\\ (UID: 00000000-00001248)\n \"capcut_pro_9_4_0.exe\" called \"CreateDirectoryW\" with parameter %TEMP%\\mediaget-installer-tmp\\img2 (UID: 00000000-00001248)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$46","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$47","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"mediaget.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"51.158.210.92:443\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"WaitForMultipleObjects@KERNEL32.dll at 26611-5560-00607BB0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: capcut_pro_9_4_0.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$48","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"ShellExecuteW\" (Indicator: \"ShellExecute\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"ShellExecuteExW\" (Indicator: \"ShellExecute\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"ShellExecute error:\" (Indicator: \"ShellExecute\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"FindResourceExW\" (Indicator: \"FindResource\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"Found reference to API \"User authentication using Basic authentication scheme failed. %n%n Additional Data %n Unexpected error received from LogonUser %1: %%%1.\" (Indicator: \"LogonUser\"; Source: \"00000000-00001248.00000002.115128.066E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"CommandLineToArgvW\" (Indicator: \"CommandLineToArgv\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"CommandLineToArgvW failed:\" (Indicator: \"CommandLineToArgv\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"GetLastError\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"WSASetLastError\" (Indicator: \"SetLastError\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"The function \"%1\" failed unexpectedly. Error=%2!d!, GetLastError=%3!d!.\" (Indicator: \"GetLastError\"; Source: \"00000000-00001248.00000002.115128.066E0000.00000002.mdmp\")\n Found reference to API \"The function: \"%1\" failed unexpectedly. GetLastError=%2!d!.\" (Indicator: \"GetLastError\"; Source: \"00000000-00001248.00000002.115128.066E0000.00000002.mdmp\")\n Found reference to API \"GetLastError: %2!d!.%n\" (Indicator: \"GetLastError\"; Source: \"00000000-00001248.00000002.115128.066E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Contains ability to start a service (API string)","description":"Found reference to API \"StartServiceW\" (Indicator: \"StartService\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-209","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileExW in import section (Source: capcut_pro_9_4_0.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$49","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"$4a","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"capcut_pro_9_4_0.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"appro@openssl.org\"\n Pattern match: \"ftp@example.com\"\n Pattern match: \"iepo@microsoft.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"User-Agent: %s\" (Indicator: \"user-agent: \"; File: \"capcut_pro_9_4_0.exe\")\n Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; File: \"capcut_pro_9_4_0.exe\")\n Found string \"User-Agent: m_installer\" (Indicator: \"user-agent: \"; Source: \"00000000-00001248.00000000.111288.00BF0000.00000004.mdmp, 00000000-00001248.00000000.111288.0AC70000.00000004.mdmp, 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000001.113207.0AC70000.00000004.mdmp, 00000000-00001248.00000001.113207.0B030000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.0AC70000.00000004.mdmp, 00000000-00001248.00000002.115128.0B030000.00000004.mdmp, 00000000-00001248.00000003.122587.0AC70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Found a reference to a known community page","description":"Found string \"(.*?)\" (Indicator: \"youtube\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","relevance":2,"id":"string-10","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$4b","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"Copyright 2011 The Montserrat Project Authors (https://github.com/JulietaUla/Montserrat)\" (Indicator: \"github.com\")\n \"Copyright 2011 The Montserrat Project Authors (https://github.com/JulietaUla/Montserrat)Thread-00000cd4-Id-00000000:SubsetThread-00000cd4-Id-00000000 BoldVersion 7.200Montserrat-BoldJulieta Ulanovskyhttp://www.zkysky.com.ar/This Font Software is licensed under the SIL Open Font License, Version 1.1. This license is available with a FAQ at: http://scripts.sil.org/OFL\" (Indicator: \"github.com\")\n \"Copyright 2011 The Montserrat Project Authors (https://github.com/JulietaUla/Montserrat)Thread-00000cd4-Id-00000001 RegularThread-00000cd4-Id-00000001:SubsetVersion 7.200Montserrat-RegularJulieta Ulanovskyhttp://www.zkysky.com.ar/This Font Software is licensed under the SIL Open Font License, Version 1.1. This license is available with a FAQ at: http://scripts.sil.org/OFL\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$4c","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"capcut_pro_9_4_0.exe\" loaded module \"%WINDIR%\\SysWOW64\\Wldap32.dll\" at 75DB0000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$4d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"capcut_pro_9_4_0.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75630000\n \"capcut_pro_9_4_0.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcrypt.dll\" at 736A0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"capcut_pro_9_4_0.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 739C0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Logged script engine calls","description":"\"capcut_pro_9_4_0.exe\" called \"Shell.Explorer.2.CreateObject\" ... ","origin":"API Call","mitre_attack_id":"T1059","relevance":10,"id":"api-64","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"capcut_pro_9_4_0.exe\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"capcut_pro_9_4_0.exe\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"capcut_pro_9_4_0.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$4e","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"capcut_pro_9_4_0.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"capcut_pro_9_4_0.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"capcut_pro_9_4_0.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"capcut_pro_9_4_0.exe\" file has an entrypoint instructions - \"call\t0x5ce1f2,jmp\t0x5cd998,cmp\tecx, dword ptr [0x6ef014],jne\t0x5cdb27,ret\t,jmp\t0x5cdb54,push\tebp,mov\tebp, esp,push\t0,call\tdword ptr [0x64923c],push\tdword ptr [ebp + 8],call\tdword ptr [0x649238],push\t0xc0000409,call\tdword ptr [0x6491a4],push\teax,call\tdword ptr [0x64917c],pop\tebp,ret\t,push\tebp,mov\tebp, esp,sub\tesp, 0x324,push\t0x17,call\tdword ptr [0x649240],test\teax, eax,je\t0x5cdb6e,push\t2,pop\tecx,int\t0x29,mov\tdword ptr [0x6f4ff0], eax,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x247600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x247552\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Possibly checks for the presence of an Antivirus engine","description":"\"antivirus\" (Indicator: \"antivirus\") in Source: 26611-513-00460A8F","origin":"File/Memory","mitre_attack_id":"T1518.001","relevance":2,"id":"string-8","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"mediaget.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"capcut_pro_9_4_0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"capcut_pro_9_4_0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"capcut_pro_9_4_0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"capcut_pro_9_4_0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\WINDOWS\\System32\\WLDAP32.dll\" (Source: \"00000000-00001248.00000000.111288.00BF0000.00000004.mdmp, 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp, 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"capcut_pro_9_4_0.exe\" searching for class \"ApplicationManager_DesktopShellWindow\"\n \"capcut_pro_9_4_0.exe\" searching for class \"MS_AutodialMonitor\"\n \"capcut_pro_9_4_0.exe\" searching for class \"MS_WebCheckMonitor\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Sets a windows hook","description":"\"capcut_pro_9_4_0.exe\" sets a windows hook with filter \"WH_MOUSE\" for thread ID 3284\n \"capcut_pro_9_4_0.exe\" sets a windows hook with filter \"WH_KEYBOARD\" for thread ID 3284","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-71","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"The input sample contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 166667)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$4f","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"capcut_pro_9_4_0.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"capcut_pro_9_4_0.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\mediaget-installer-tmp\\page-wait.jpg\"\n \"capcut_pro_9_4_0.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\mediaget-installer-tmp\\preloader.html\"\n \"capcut_pro_9_4_0.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\sslkey.txt\"\n \"capcut_pro_9_4_0.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\mediaget-installer-tmp\\archive.7z\"\n \"capcut_pro_9_4_0.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\mediaget-installer-tmp\\cancel-ru.template\"\n \"capcut_pro_9_4_0.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\mediaget-installer-tmp\\cancel.template\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"$50","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"LoadLibraryExA\" (Indicator: \"LoadLibrary\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"capcut_pro_9_4_0.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$51","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$52","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"capcut_pro_9_4_0.exe\" queries basic process information of the \"C:\\capcut_pro_9_4_0.exe\" (UID: 1248)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$53","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"capcut_pro_9_4_0.exe\" reads file \"c:\\capcut_pro_9_4_0.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$54","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$55","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"capcut_pro_9_4_0.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\Caches\"\n \"capcut_pro_9_4_0.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCache\"\n \"capcut_pro_9_4_0.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\INetCookies\"\n \"capcut_pro_9_4_0.exe\" touched file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"capcut_pro_9_4_0.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"capcut_pro_9_4_0.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\"\n \"capcut_pro_9_4_0.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies\"\n \"capcut_pro_9_4_0.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$56","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$57","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"capcut_pro_9_4_0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\mediaget-installer-tmp\\page-wait.jpg\"\n \"capcut_pro_9_4_0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\mediaget-installer-tmp\\preloader.html\"\n \"capcut_pro_9_4_0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\sslkey.txt\"\n \"capcut_pro_9_4_0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\mediaget-installer-tmp\\archive.7z\"\n \"capcut_pro_9_4_0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\mediaget-installer-tmp\\cancel-ru.template\"\n \"capcut_pro_9_4_0.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\mediaget-installer-tmp\\cancel.template\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"POST /ld/get_bconfig.php\"\n Found http requests in header \"GET /ld/get_data.php?id=0&alreadyInstalled=0&vi=0&browsersInstalled=chrome,iexplore,edge&defaultBrowser=edge&bundlesInstalled=&installerVersion=502&os=10.0.16299&isOs64bit=1&lang=en-US\"\n Found http requests in header \"POST /client/installer.php\"\n Found http requests in header \"GET /installer/binaries/html_new_transl_2026-10-16.7z\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"nslookup: WSAStartup:%0\" (Indicator: \"WSAStartup\"; Source: \"00000000-00001248.00000002.115128.066E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"Handle %1 created by InternetOpenURL: SessionHandle=%2,URL=%4, Headers=%6, Flags=%7\" (Indicator: \"InternetOpen\"; Source: \"00000000-00001248.00000002.115128.066E0000.00000002.mdmp\")\n Found reference to API \"Handle %1 created by InternetConnect: SessionHandle=%2, Server=%4:%5, %7, Flags=%8\" (Indicator: \"InternetConnect\"; Source: \"00000000-00001248.00000002.115128.066E0000.00000002.mdmp\")\n Found reference to API \"Request handle %1 created by HttpOpenRequest: ConnectionHandle=%2, %4, Target=%6, Ver=%8, Referrer=%10, Media types=%12, Flags=%13\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00001248.00000002.115128.066E0000.00000002.mdmp\")\n Found reference to API \"nslookup: WSAStartup:%0\" (Indicator: \"WSAStartup\"; Source: \"00000000-00001248.00000002.115128.066E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"Handle %1 created by InternetConnect: SessionHandle=%2, Server=%4:%5, %7, Flags=%8\" (Indicator: \"InternetConnect\"; Source: \"00000000-00001248.00000002.115128.066E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"Request handle %1 created by HttpOpenRequest: ConnectionHandle=%2, %4, Target=%6, Ver=%8, Referrer=%10, Media types=%12, Flags=%13\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00001248.00000002.115128.066E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"PeekNamedPipe\" (Indicator: \"PeekNamedPipe\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"AppendData (or AddSubdirectory or CreatePipeInstance)\" (Indicator: \"CreatePipe\"; Source: \"00000000-00001248.00000002.115128.066E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Network Related","name":"Contains ability to transfer data using curl","description":"Observed string: \"curl user interface\" (Indicator: \"curl \") in Source: capcut_pro_9_4_0.exe","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-576","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"Found string \"SMTPu!\" (Indicator: \"smtp\"; File: \"capcut_pro_9_4_0.exe\")\n Found string \"SMTPS\" (Indicator: \"smtp\"; File: \"capcut_pro_9_4_0.exe\")\n Found string \"SMTPUTF8\" (Indicator: \"smtp\"; File: \"capcut_pro_9_4_0.exe\")\n Found string \"Got unexpected smtp-server response: %d\" (Indicator: \"smtp\"; File: \"capcut_pro_9_4_0.exe\")\n Found string \"smtp.\" (Indicator: \"smtp\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"Handle %1 created by InternetOpenURL: SessionHandle=%2,URL=%4, Headers=%6, Flags=%7\" (Indicator: \"InternetOpen\"; Source: \"00000000-00001248.00000002.115128.066E0000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$58","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"imap.\" [Source: capcut_pro_9_4_0.exe]\n Observed email domain:\"smtp.\" [Source: capcut_pro_9_4_0.exe]\n Observed email domain:\"pop3.\" [Source: capcut_pro_9_4_0.exe]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"$59","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$5b","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /ld/get_data.php?id=0&alreadyInstalled=0&vi=0&browsersInstalled=chrome\niexplore\nedge&defaultBrowser=edge&bundlesInstalled=&installerVersion=502&os=10.0.16299&isOs64bit=1&lang=en-US HTTP/1.1\nHost: mediaget.com\nUser-Agent: m_installer\nAccept: */*\n\n GET /installer/binaries/html_new_transl_2026-10-16.7z HTTP/1.1\nHost: mediaget.com\nUser-Agent: m_installer\nAccept: */*\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5659c10619c455ea477287b12cf3f7e7","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://curl.se\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Network Related","name":"Recently renewed or created SSL certificate","description":"Newly renewed or created SSL certificate: \"mediaget.com\" (12 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-4","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS POST request to https://mediaget.com/ld/get_bconfig.php\n Found HTTPS GET request to https://mediaget.com/ld/get_data.php?id=0&alreadyInstalled=0&vi=0&browsersInstalled=chrome\niexplore\nedge&defaultBrowser=edge&bundlesInstalled=&installerVersion=502&os=10.0.16299&isOs64bit=1&lang=en-US\n Found HTTPS POST request to https://mediaget.com/client/installer.php\n Found HTTPS GET request to https://mediaget.com/installer/binaries/html_new_transl_2026-10-16.7z","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"mediaget.com\" (89 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"51.158.210.92\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Network Related","name":"Uses cURL to communicate over HTTPS","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-722","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on process \"00000000-00001248\"\n YARA signature for AES encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-103","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Djb2 Hash Algorithm","description":"YARA signature for Djb2 Hash Algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-542","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – Encryption algorithm","description":"YARA signature for encryption algorithm process \"00000000-00001248\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":7,"id":"yara-208","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Remote Access Related","name":"Able to configure Windows Remote Management service","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1133","relevance":1,"id":"string-909","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Remote Access Related","name":"Able to use IDE tunneling for remote connection","description":"Found string \"SSL peer certificate or SSH remote key was not OK\" (Indicator: \" ssh \"; File: \"capcut_pro_9_4_0.exe\")\n Found string \"Error in the SSH layer\" (Indicator: \" ssh \"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1219","relevance":1,"id":"string-883","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"Found string \"F+ncalrpc:[OLEE8646B28DF7709C7657388A45FDA]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001248.00000000.111288.00BF0000.00000004.mdmp, 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp\")\n Found string \"+ncalrpc:[OLEE8646B28DF7709C7657388A45FDA]\" (Indicator: \"ncalrpc\"; Source: \"00000000-00001248.00000000.111288.00BF0000.00000004.mdmp, 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp, 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp, 00000000-00001248.00000003.122587.0AC70000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"Found reference to API \"CreateCompatibleBitmap\" (Indicator: \"CreateCompatibleBitmap\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"BitBlt\" (Indicator: \"BitBlt\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"CreateCompatibleDC\" (Indicator: \"CreateCompatibleDC\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"350286,3284,3024,,RtlGetVersion,NTDLL.dll,\"00:28:56.890\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00001248.00000000.111288.00BF0000.00000004.mdmp, 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp, 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp\")\n Found reference to API \"3024,,RtlGetVersion,NTDLL.dll,\"00:28:56.812\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00001248.00000000.111288.00BF0000.00000004.mdmp, 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp, 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: capcut_pro_9_4_0.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryInfoKeyW\" in file \"capcut_pro_9_4_0.exe\"\n Found registry query API: \"RegEnumKeyExW\" in file \"capcut_pro_9_4_0.exe\"\n Found registry query API: \"RegQueryValueExW\" in file \"capcut_pro_9_4_0.exe\"\n Found registry query API: \"RegOpenKeyExW\" in file \"capcut_pro_9_4_0.exe\"\n Found registry query API: \"RegEnumKeyW\" in file \"capcut_pro_9_4_0.exe\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to access Microsoft Outlook file path","description":"\"capcut_pro_9_4_0.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\"; Key: \"\"; Value: \"\")\n \"capcut_pro_9_4_0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\OUTLOOK.EXE\"; Key: \"PATH\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1114","relevance":1,"id":"registry-237","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"capcut_pro_9_4_0.exe\" loaded module \"%WINDIR%\\SysWOW64\\samcli.dll\" at 723C0000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$61","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"capcut_pro_9_4_0.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"capcut_pro_9_4_0.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"capcut_pro_9_4_0.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$62","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileExW\" (Indicator: \"FindFirstFile\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetEnvironmentStringsW\" (Indicator: \"GetEnvironmentStrings\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate running processes using Tasklist","description":"Observed string: \"tasklist.exe\" [Source: 00000000-00001248.00000002.115128.066E0000.00000002.mdmp]\n Observed string: \"tasklist.exe.mui\" [Source: 00000000-00001248.00000002.115128.066E0000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-517","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleExW\" (Indicator: \"GetModuleHandle\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetSystemDirectoryW\" (Indicator: \"GetSystemDirectory\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetFileInformationByHandle\" (Indicator: \"GetFileInformationByHandle\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetFileAttributesExW\" (Indicator: \"GetFileAttributes\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetCurrentDirectoryW\" (Indicator: \"GetCurrentDirectory\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"SHGetSpecialFolderLocation\" (Indicator: \"SHGetSpecialFolderLocation\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve specified item(s) (Powershell command string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-394","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host name of a computer (API string)","description":"Found reference to API \"gethostname\" (Indicator: \"gethostname\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-532","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"getsockname() failed with errno %d: %s\" (Indicator: \"getsockname\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"getsockname() failed: %s\" (Indicator: \"getsockname\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$64","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$65","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$66","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in file \"capcut_pro_9_4_0.exe\"\n Found registry deletion API: \"RegDeleteKeyW\" in file \"capcut_pro_9_4_0.exe\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: capcut_pro_9_4_0.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \":\\WINDOWS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00001248.00000000.111288.00BF0000.00000004.mdmp, 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp, 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\capcut_pro_9_4_0.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00001248.00000000.111288.00BF0000.00000004.mdmp, 00000000-00001248.00000001.113207.00BF0000.00000004.mdmp, 00000000-00001248.00000002.115128.00BF0000.00000004.mdmp, 00000000-00001248.00000003.122587.00BF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: capcut_pro_9_4_0.exe\n Observed string: \"Shutdown System Privilege\" (Indicator: \"shutdown \") in Source: 00000000-00001248.00000002.115128.066E0000.00000002.mdmp\n Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00001248.00000002.115128.066E0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"capcut_pro_9_4_0.exe\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"capcut_pro_9_4_0.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"System Security","name":"Imports a library used to perform LDAP operation","description":"Observed import dll \"wldap32.dll\" which can perform LDAP operation [Source: capcut_pro_9_4_0.exe]","origin":"Static Parser","mitre_attack_id":"T1069.002","relevance":3,"id":"static-225","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"capcut_pro_9_4_0.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$67","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$68","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"capcut_pro_9_4_0.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files with image extension","description":"$69","origin":"Binary File","mitre_attack_id":"T1105","id":"binary-56","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"capcut_pro_9_4_0.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"WWAHost.exe.mui\" (Indicator: \"wwahost.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"capcut_pro_9_4_0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \"capcut_pro_9_4_0.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries kernel debugger information","description":"\"capcut_pro_9_4_0.exe\" at 00000000-00001248-00000C15-290609429","origin":"API Call","mitre_attack_id":"T1622","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)","description":"\"capcut_pro_9_4_0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"DISABLECACHINGOFSSLPAGES\")\n \"capcut_pro_9_4_0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"BYPASSHTTPNOCACHECHECK\")\n \"capcut_pro_9_4_0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"BYPASSHTTPNOCACHECHECK\")\n \"capcut_pro_9_4_0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"BYPASSSSLNOCACHECHECK\")\n \"capcut_pro_9_4_0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"BYPASSSSLNOCACHECHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-29","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/grayware_confidence_70% (D)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"6/24 Antivirus vendors marked sample as malicious (25% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$6b","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"capcut_pro_9_4_0.exe\" reads file \"C:\\Users\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 51.158.210.92 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\"\n YARA signature for ChaCha20 128-bit key algorithm matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":9,"id":"yara-44","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – cryptographic algorithms","description":"YARA signature matched on Chacha20 instruction used in process \"00000000-00001248\"\n YARA signature matched on Chacha20 instruction used in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-155","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"capcut_pro_9_4_0.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"capcut_pro_9_4_0.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\MEDIAGET-INSTALLER-TMP\" with delete access\n \"capcut_pro_9_4_0.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\mediaget-installer-tmp\\ARCHIVE.7Z\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"Wow64Transition@NTDLL.DLL\" in \"capcut_pro_9_4_0.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"capcut_pro_9_4_0.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\"; Value: \"0100000000\")","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"capcut_pro_9_4_0.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"suspicious","category":"System Security","name":"Queries the display settings of system associated file extensions","description":"\"capcut_pro_9_4_0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.HTML\"; Key: \"ALWAYSSHOWEXT\")\n \"capcut_pro_9_4_0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\DOCUMENT\"; Key: \"ALWAYSSHOWEXT\")\n \"capcut_pro_9_4_0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\.HTML\"; Key: \"NEVERSHOWEXT\")\n \"capcut_pro_9_4_0.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\CLASSES\\SYSTEMFILEASSOCIATIONS\\DOCUMENT\"; Key: \"NEVERSHOWEXT\")","origin":"Registry Access","mitre_attack_id":"T1005","relevance":7,"id":"registry-47","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Creates a mutant associated with known malware","description":"\"mediaget-installer-singleapplication-mutex\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":6,"id":"mutant-2","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteValueW\n RegCreateKeyExW\n RegEnumKeyExW\n RegDeleteKeyW\n RegCloseKey\n StartServiceW\n RegOpenKeyExW\n RegEnumKeyW\n GetModuleHandleExW\n CreateFileW\n UnhandledExceptionFilter\n GetModuleHandleW\n GetFileAttributesW\n FindFirstFileExW\n GetDriveTypeW\n GetSystemDirectoryW\n FindFirstFileW\n LoadLibraryA\n GetCommandLineW\n GetTempPathW\n OutputDebugStringW\n CreateProcessW\n GetModuleHandleA\n FindNextFileW\n CreateThread\n GetCommandLineA\n GetProcAddress\n LoadLibraryExW\n GetVersionExW\n ExitThread\n VirtualAlloc\n FindResourceW\n DeleteFileW\n GetFileSizeEx\n GetModuleFileNameW\n LockResource\n IsDebuggerPresent\n GetFileAttributesExW\n LoadLibraryW\n Sleep\n CreateDirectoryW\n SleepEx\n WriteFile\n GetStartupInfoW\n TerminateProcess\n FindResourceExW\n LoadLibraryExA\n GetTickCount\n OpenProcess\n ShellExecuteW\n ShellExecuteExW\n FindWindowW\n GetWindowThreadProcessId\n sendto\n closesocket\n send\n connect\n WSAStartup\n accept\n socket\n recvfrom\n recv\n bind\n listen","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]}],"incidents":[{"name":"Spyware","details_count":3,"details":[{"detail":"Hooks API calls"},{"detail":"POSTs data to a web server"},{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Identified FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Possibly tries to evade analysis by sleeping multiple times"},{"detail":"The input sample contains a known anti-VM trick"},{"detail":"Writes archive files"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]}],"intel_graph":{"map":{"Domain:mediaget.com":{"type":"Domain","value":"mediaget.com"},"File:057bc6c47c47aaccdf31adc48a6b401f6090a02c28e354099eff80907dc2af32":{"type":"File","value":"057bc6c47c47aaccdf31adc48a6b401f6090a02c28e354099eff80907dc2af32"},"File:2d445a49383ef3d251935caebe0a7b178f0bd69b20e54a44f67394409b6141a7":{"type":"File","value":"2d445a49383ef3d251935caebe0a7b178f0bd69b20e54a44f67394409b6141a7"},"File:3ebd2bea7b3e1d9a09edf27b3aae63195d5dae08d6581713bec25c193c6a04cb":{"type":"File","value":"3ebd2bea7b3e1d9a09edf27b3aae63195d5dae08d6581713bec25c193c6a04cb"},"File:4d5e673049921dad57828db74bce9ae5ab7dcf63aa20b8a25d5d539b254e0479":{"type":"File","value":"4d5e673049921dad57828db74bce9ae5ab7dcf63aa20b8a25d5d539b254e0479"},"File:667718f4f6d4214069d583019177eecc9a4fcf7ebff1208adaa2217ee24ab94e":{"type":"File","value":"667718f4f6d4214069d583019177eecc9a4fcf7ebff1208adaa2217ee24ab94e"},"File:6b6cc5da3905d0ec949fe4ab470d10005f37873c32b8874773b6e4ddcf34d314":{"type":"File","value":"6b6cc5da3905d0ec949fe4ab470d10005f37873c32b8874773b6e4ddcf34d314"},"File:6cedf381d59fa4caabfb836e9a3720420645cbcea32491a5ac5f07cf274ceac6":{"type":"File","value":"6cedf381d59fa4caabfb836e9a3720420645cbcea32491a5ac5f07cf274ceac6"},"File:7615a4bb88a5680cfead49c1774013ce48c4c7343cb82d7585f7935c705400b0":{"type":"File","value":"7615a4bb88a5680cfead49c1774013ce48c4c7343cb82d7585f7935c705400b0"},"File:77c795b0b6006f43e4f4e25b8deed80cdecbda09b14c2c7f317792e61d989220":{"type":"File","value":"77c795b0b6006f43e4f4e25b8deed80cdecbda09b14c2c7f317792e61d989220"},"File:7d90d0c4256650c2bcd046800cbe3e2b24c67175ac21969313082ab61a908e6f":{"type":"File","value":"7d90d0c4256650c2bcd046800cbe3e2b24c67175ac21969313082ab61a908e6f"},"File:8b8f0ad0cdf07227f759cb18c64ff64ae72fcbfc7916524acb355d889ddece3f":{"type":"File","value":"8b8f0ad0cdf07227f759cb18c64ff64ae72fcbfc7916524acb355d889ddece3f"},"File:8e07c1e7ad7529539ea77c51ca663042cacb68841496f11ab75950c6686a6f0d":{"type":"File","value":"8e07c1e7ad7529539ea77c51ca663042cacb68841496f11ab75950c6686a6f0d","filetype":"DER Encoded PKCS#7 Signed Data","filetype_short":"PKCS7","mime_type":"application/x-x509-ca-cert"},"File:9b89878b847bdad03a4024ad4c78dcc3c1f8174b4803130105a7c275b0e52966":{"type":"File","value":"9b89878b847bdad03a4024ad4c78dcc3c1f8174b4803130105a7c275b0e52966"},"File:9ba220b02676f499296b258227582e7f9347890e530d0e6795aa476150d909c3":{"type":"File","value":"9ba220b02676f499296b258227582e7f9347890e530d0e6795aa476150d909c3"},"File:a59ffc5abe4274fc224c8edcb5877c94af974c949fd391b056265f470e08cdf9":{"type":"File","value":"a59ffc5abe4274fc224c8edcb5877c94af974c949fd391b056265f470e08cdf9"},"File:c1d3c989cfc39531d46e25867e0f15c552688b3fbef8f5bd59dbae303aae9048":{"type":"File","value":"c1d3c989cfc39531d46e25867e0f15c552688b3fbef8f5bd59dbae303aae9048"},"File:c647d39712e14d129124168b6b8febbb58504892ec2916c390ad8c66621b9bf9":{"type":"File","value":"c647d39712e14d129124168b6b8febbb58504892ec2916c390ad8c66621b9bf9"},"File:caec781eb9c39273dacfb6227adf6db3927b4c55d7591158fe8101238edb2032":{"type":"File","value":"caec781eb9c39273dacfb6227adf6db3927b4c55d7591158fe8101238edb2032"},"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59":{"type":"File","value":"d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"},"File:f2541446fdd1aa134a66b9a6f91ebf7f880f0a6120e0bfbc85e7bee3a6d49db7":{"type":"File","value":"f2541446fdd1aa134a66b9a6f91ebf7f880f0a6120e0bfbc85e7bee3a6d49db7"},"File:f894ccdda93a17a8b7b0dce1d295e490c2b66444e05a8f5b319515cf83378361":{"type":"File","value":"f894ccdda93a17a8b7b0dce1d295e490c2b66444e05a8f5b319515cf83378361"},"File:ffc40bd54dd7a0010b1fee3270133a0e9b917b925f461e5e09c0b3fbc0b638f6":{"type":"File","value":"ffc40bd54dd7a0010b1fee3270133a0e9b917b925f461e5e09c0b3fbc0b638f6"},"Ip:51.158.210.92":{"type":"Ip","value":"51.158.210.92"},"Url:/client/installer.php":{"type":"Url","value":"/client/installer.php"},"Url:/installer/binaries/html_new_transl_2026-10-16.7z":{"type":"Url","value":"/installer/binaries/html_new_transl_2026-10-16.7z"},"Url:/ld/get_bconfig.php":{"type":"Url","value":"/ld/get_bconfig.php"},"Url:/ld/get_data.php?id=0&alreadyInstalled=0&vi=0&browsersInstalled=chrome,iexplore,edge&defaultBrowser=edge&bundlesInstalled=&installerVersion=502&os=10.0.16299&isOs64bit=1&lang=en-US":{"type":"Url","value":"/ld/get_data.php?id=0&alreadyInstalled=0&vi=0&browsersInstalled=chrome,iexplore,edge&defaultBrowser=edge&bundlesInstalled=&installerVersion=502&os=10.0.16299&isOs64bit=1&lang=en-US"}},"chains":[{"id":"1561371416270005565","root":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","edges":[{"edge_kind":"extracted_from_archive","from_key":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","to_key":"File:8e07c1e7ad7529539ea77c51ca663042cacb68841496f11ab75950c6686a6f0d"}],"verdict":{"verdict":"unknown"}},{"id":"sandbox_network","root":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","edges":[{"edge_kind":"contacted_ip","from_key":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","to_key":"Ip:51.158.210.92"},{"edge_kind":"contacted_domain","from_key":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","to_key":"Domain:mediaget.com"},{"edge_kind":"resolves_to","from_key":"Domain:mediaget.com","to_key":"Ip:51.158.210.92"},{"edge_kind":"contacted_url","from_key":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","to_key":"Url:/ld/get_bconfig.php"},{"edge_kind":"contacted_url","from_key":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","to_key":"Url:/ld/get_data.php?id=0&alreadyInstalled=0&vi=0&browsersInstalled=chrome,iexplore,edge&defaultBrowser=edge&bundlesInstalled=&installerVersion=502&os=10.0.16299&isOs64bit=1&lang=en-US"},{"edge_kind":"contacted_url","from_key":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","to_key":"Url:/client/installer.php"},{"edge_kind":"contacted_url","from_key":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","to_key":"Url:/installer/binaries/html_new_transl_2026-10-16.7z"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","edges":[{"edge_kind":"extracted","from_key":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","to_key":"File:8e07c1e7ad7529539ea77c51ca663042cacb68841496f11ab75950c6686a6f0d"},{"edge_kind":"extracted","from_key":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","to_key":"File:7615a4bb88a5680cfead49c1774013ce48c4c7343cb82d7585f7935c705400b0"},{"edge_kind":"extracted","from_key":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","to_key":"File:057bc6c47c47aaccdf31adc48a6b401f6090a02c28e354099eff80907dc2af32"},{"edge_kind":"extracted","from_key":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","to_key":"File:6cedf381d59fa4caabfb836e9a3720420645cbcea32491a5ac5f07cf274ceac6"},{"edge_kind":"extracted","from_key":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","to_key":"File:a59ffc5abe4274fc224c8edcb5877c94af974c949fd391b056265f470e08cdf9"},{"edge_kind":"extracted","from_key":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","to_key":"File:77c795b0b6006f43e4f4e25b8deed80cdecbda09b14c2c7f317792e61d989220"},{"edge_kind":"extracted","from_key":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","to_key":"File:7d90d0c4256650c2bcd046800cbe3e2b24c67175ac21969313082ab61a908e6f"},{"edge_kind":"extracted","from_key":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","to_key":"File:c647d39712e14d129124168b6b8febbb58504892ec2916c390ad8c66621b9bf9"},{"edge_kind":"extracted","from_key":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","to_key":"File:667718f4f6d4214069d583019177eecc9a4fcf7ebff1208adaa2217ee24ab94e"},{"edge_kind":"extracted","from_key":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","to_key":"File:8b8f0ad0cdf07227f759cb18c64ff64ae72fcbfc7916524acb355d889ddece3f"},{"edge_kind":"extracted","from_key":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","to_key":"File:caec781eb9c39273dacfb6227adf6db3927b4c55d7591158fe8101238edb2032"},{"edge_kind":"extracted","from_key":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","to_key":"File:f2541446fdd1aa134a66b9a6f91ebf7f880f0a6120e0bfbc85e7bee3a6d49db7"},{"edge_kind":"extracted","from_key":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","to_key":"File:f894ccdda93a17a8b7b0dce1d295e490c2b66444e05a8f5b319515cf83378361"},{"edge_kind":"extracted","from_key":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","to_key":"File:ffc40bd54dd7a0010b1fee3270133a0e9b917b925f461e5e09c0b3fbc0b638f6"},{"edge_kind":"extracted","from_key":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","to_key":"File:3ebd2bea7b3e1d9a09edf27b3aae63195d5dae08d6581713bec25c193c6a04cb"},{"edge_kind":"extracted","from_key":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","to_key":"File:9b89878b847bdad03a4024ad4c78dcc3c1f8174b4803130105a7c275b0e52966"},{"edge_kind":"extracted","from_key":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","to_key":"File:9ba220b02676f499296b258227582e7f9347890e530d0e6795aa476150d909c3"},{"edge_kind":"extracted","from_key":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","to_key":"File:2d445a49383ef3d251935caebe0a7b178f0bd69b20e54a44f67394409b6141a7"},{"edge_kind":"extracted","from_key":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","to_key":"File:c1d3c989cfc39531d46e25867e0f15c552688b3fbef8f5bd59dbae303aae9048"},{"edge_kind":"extracted","from_key":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","to_key":"File:4d5e673049921dad57828db74bce9ae5ab7dcf63aa20b8a25d5d539b254e0479"},{"edge_kind":"extracted","from_key":"File:d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","to_key":"File:6b6cc5da3905d0ec949fe4ab470d10005f37873c32b8874773b6e4ddcf34d314"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":16,"imported_dlls_count":101,"dropped_files_count":0,"extracted_files_count":21,"files_written_count":80,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":4,"http_requests_count":4},"behavior_tags":["windows-server-utility"],"sample_flags":["Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"6ad4ca6e8b86366e1e0f2431","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":80,"malware_family":"PUP.MediaGet.sd","contacted_countries":["NLD"],"submit_name":"capcut_pro_9_4_0.exe","analysis_start_time":"2026-10-18T13:32:32+00:00","indicators_count":{"informative":229,"suspicious":48,"malicious":1},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"51.158.210.92","port":443,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]}],"dns_resolutions":[{"domain":"mediaget.com","address":"51.158.210.92","ttl":300,"country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]}],"http_requests":[{"host":"mediaget.com","host_ip":"51.158.210.92:443","url":"/ld/get_bconfig.php","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /ld/get_bconfig.php HTTP/1.1\nHost: mediaget.com\nUser-Agent: m_installer\nAccept: */*\nContent-Length: 7\nContent-Type: application/x-www-form-urlencoded","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"host":"mediaget.com","host_ip":"51.158.210.92:443","url":"/ld/get_data.php?id=0&alreadyInstalled=0&vi=0&browsersInstalled=chrome,iexplore,edge&defaultBrowser=edge&bundlesInstalled=&installerVersion=502&os=10.0.16299&isOs64bit=1&lang=en-US","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /ld/get_data.php?id=0&alreadyInstalled=0&vi=0&browsersInstalled=chrome,iexplore,edge&defaultBrowser=edge&bundlesInstalled=&installerVersion=502&os=10.0.16299&isOs64bit=1&lang=en-US HTTP/1.1\nHost: mediaget.com\nUser-Agent: m_installer\nAccept: */*","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"host":"mediaget.com","host_ip":"51.158.210.92:443","url":"/client/installer.php","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /client/installer.php HTTP/1.1\nHost: mediaget.com\nUser-Agent: m_installer\nAccept: */*\nContent-Length: 197\nContent-Type: application/x-www-form-urlencoded","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"host":"mediaget.com","host_ip":"51.158.210.92:443","url":"/installer/binaries/html_new_transl_2026-10-16.7z","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /installer/binaries/html_new_transl_2026-10-16.7z HTTP/1.1\nHost: mediaget.com\nUser-Agent: m_installer\nAccept: */*","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}],"processes":[{"pid":1248,"ppid":0,"name":"capcut_pro_9_4_0.exe","command_line":"","sha256":"d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59","normalized_path":"C:\\capcut_pro_9_4_0.exe","uid":"00000000-00001248","icon":"$6c"}],"all_imported_dlls":["d3d10warp.dll","user32.dll","win32u.dll","msvcrt.dll","twinapi.appcore.dll","TextInputFramework.dll","KernelBase.dll","sechost.dll","oleaut32.dll","msvcp140.dll","ResourcePolicyClient.dll","userenv.dll","secur32.dll","t2embed.dll","sspicli.dll","comctl32.dll","fltLib.dll","cryptsp.dll","CoreUIComponents.dll","gdi32full.dll","netapi32.dll","nsi.dll","wintrust.dll","WindowsCodecs.dll","wow64win.dll","cfgmgr32.dll","shlwapi.dll","powrprof.dll","bcrypt.dll","samcli.dll","DataExchange.dll","rmclient.dll","vcruntime140.dll","uxtheme.dll","winnsi.dll","cldapi.dll","ntmarta.dll","srpapi.dll","dnsapi.dll","FWPUCLNT.DLL","combase.dll","netutils.dll","msIso.dll","wldp.dll","d2d1.dll","DWrite.dll","winmm.dll","wow64.dll","cryptbase.dll","advapi32.dll","imm32.dll","UIAutomationCore.dll","kernel32.dll","ole32.dll","iertutil.dll","aepic.dll","mlang.dll","rasadhlp.dll","WinTypes.dll","ws2_32.dll","rpcrt4.dll","shell32.dll","SHCore.dll","winhttp.dll","gdi32.dll","profapi.dll","clbcatq.dll","version.dll","dxgi.dll","urlmon.dll","sxs.dll","ntdll.dll","wow64cpu.dll","msasn1.dll","kernel.appcore.dll","ieframe.dll","jscript9.dll","ucrtbase.dll","dwmapi.dll","IPHLPAPI.DLL","msls31.dll","winmmbase.dll","windows.storage.dll","msctf.dll","wkscli.dll","dcomp.dll","propsys.dll","mswsock.dll","msimtf.dll","CoreMessaging.dll","bcryptprimitives.dll","crypt32.dll","d3d11.dll","OnDemandConnRouteHelper.dll","Wldap32.dll","msvcp_win.dll","wininet.dll","VxSSL32.dll","atlthunk.dll","imagehlp.dll","mshtml.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"8e07c1e7ad7529539ea77c51ca663042cacb68841496f11ab75950c6686a6f0d","sha256":"8e07c1e7ad7529539ea77c51ca663042cacb68841496f11ab75950c6686a6f0d","verdict":"undetected","sources":[{"report_type":"qsp","report_id":""}]},{"name":"Montserrat-Bold.eot","sha256":"7615a4bb88a5680cfead49c1774013ce48c4c7343cb82d7585f7935c705400b0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"Montserrat-Regular.eot","sha256":"057bc6c47c47aaccdf31adc48a6b401f6090a02c28e354099eff80907dc2af32","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"Roboto-Regular.eot","sha256":"6cedf381d59fa4caabfb836e9a3720420645cbcea32491a5ac5f07cf274ceac6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"VerdanaPro-Regular.eot","sha256":"a59ffc5abe4274fc224c8edcb5877c94af974c949fd391b056265f470e08cdf9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"archive.7z","sha256":"77c795b0b6006f43e4f4e25b8deed80cdecbda09b14c2c7f317792e61d989220","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"cancel-ru.template","sha256":"7d90d0c4256650c2bcd046800cbe3e2b24c67175ac21969313082ab61a908e6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"cancel.template","sha256":"c647d39712e14d129124168b6b8febbb58504892ec2916c390ad8c66621b9bf9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"av360-check-off.png","sha256":"667718f4f6d4214069d583019177eecc9a4fcf7ebff1208adaa2217ee24ab94e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"av360-check-on.png","sha256":"8b8f0ad0cdf07227f759cb18c64ff64ae72fcbfc7916524acb355d889ddece3f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"av360.png","sha256":"caec781eb9c39273dacfb6227adf6db3927b4c55d7591158fe8101238edb2032","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"bundle1-check-off.png","sha256":"f2541446fdd1aa134a66b9a6f91ebf7f880f0a6120e0bfbc85e7bee3a6d49db7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"bundle1-check-on.png","sha256":"f894ccdda93a17a8b7b0dce1d295e490c2b66444e05a8f5b319515cf83378361","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"bundle2-check-off.png","sha256":"ffc40bd54dd7a0010b1fee3270133a0e9b917b925f461e5e09c0b3fbc0b638f6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"bundle2-check-on.png","sha256":"3ebd2bea7b3e1d9a09edf27b3aae63195d5dae08d6581713bec25c193c6a04cb","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"cancel-page-new1-ru.png","sha256":"9b89878b847bdad03a4024ad4c78dcc3c1f8174b4803130105a7c275b0e52966","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"close-gray.png","sha256":"9ba220b02676f499296b258227582e7f9347890e530d0e6795aa476150d909c3","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"close-lightgray-14px.png","sha256":"2d445a49383ef3d251935caebe0a7b178f0bd69b20e54a44f67394409b6141a7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"close-white.png","sha256":"c1d3c989cfc39531d46e25867e0f15c552688b3fbef8f5bd59dbae303aae9048","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"coc.png","sha256":"4d5e673049921dad57828db74bce9ae5ab7dcf63aa20b8a25d5d539b254e0479","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"earnapp.png","sha256":"6b6cc5da3905d0ec949fe4ab470d10005f37873c32b8874773b6e4ddcf34d314","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\page-wait.jpg","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\preloader.html","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\sslkey.txt","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\archive.7z","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\cancel-ru.template","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\cancel.template","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\av360-check-off.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\av360-check-on.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\av360.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\bundle1-check-off.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\bundle1-check-on.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\bundle2-check-off.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\bundle2-check-on.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\cancel-page-new1-ru.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\close-gray.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\close-lightgray-14px.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\close-white.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\coc.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\earnapp.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\install-lenta-2-308.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\install-lenta-3-308.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\install-lenta.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\main-logo-compact.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\main-logo-white.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\opera-check-off.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\opera-check-on.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\opera-empty.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\page-wait.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\point.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\radio-checked.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\radio-unchecked.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\settings-checked.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\settings-unchecked.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\soax-mglogo.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\soax-schema.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\wps-en.jpg","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\wps-ru.jpg","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\wps.jpg","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\img2\\yandex-logo.png","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\index.template","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\install-min.template","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\Montserrat-Bold.eot","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\Montserrat-Regular.eot","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\pages\\a3.html","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\pages","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\pages\\bdv.html","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\pages\\byte.html","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\pages\\coc.html","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\pages\\dat.html","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\pages\\earn.html","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\pages\\flk-start.html","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\pages\\flk.html","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\pages\\inf.html","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\pages\\main-lum.txt","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\pages\\main-nobundles.html","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\pages\\main-yandex.txt","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\pages\\main.html","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\pages\\mgru.html","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\pages\\op-friendly.html","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\pages\\op.html","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\pages\\psdk.html","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\pages\\sx.html","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\pages\\wait.html","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\pages\\wps-ru.html","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\pages\\wps.html","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\Roboto-Regular.eot","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\translations.json","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\translations_old.json","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\VerdanaPro-Regular.eot","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"path":"%TEMP%\\mediaget-installer-tmp\\index.html","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\MEDIA GET LLC\\MEDIAGET2-SYSTEMSCOPE\\MEDIAGET_INFO\\","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"key":"HKCUHKCU\\SOFTWARE\\","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"key":"HKCUHKCU\\SOFTWARE\\MEDIA GET LLC\\","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"key":"HKCUHKCU\\SOFTWARE\\MEDIA GET LLC\\MEDIAGET2-SYSTEMSCOPE\\","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"Local\\SM0:1248:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"MSIMGSIZECacheMutex","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"mediaget-installer-singleapplication-mutex","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"SM0:1248:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"SM0:1248:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"Local\\SM0:1248:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1248:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1248:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\mediaget-installer-singleapplication-mutex","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:1248:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:1248:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"6ad4ca6e8b86366e1e0f2431"}]}]}},"report_ids":{"sandbox_job_ids":["6ad4ca6e8b86366e1e0f2431"]}}}]]}] 2c:[["$","title","0",{"children":"Malicious Application.Bundler.MediaGet.Generic Sample d02e2f6c2ef7… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d02e2f6c2ef7…. Malware family: Application.Bundler.MediaGet.Generic. Threat score 80/100. 7/25 AV engines flagged this file. 1 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59"}],["$","meta","4",{"property":"og:title","content":"Malicious Application.Bundler.MediaGet.Generic Sample d02e2f6c2ef7… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d02e2f6c2ef7…. Malware family: Application.Bundler.MediaGet.Generic. Threat score 80/100. 7/25 AV engines flagged this file. 1 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d02e2f6c2ef750d5e93910f371c2e874f6b96d407a65fba87f7718f23eba9a59"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Application.Bundler.MediaGet.Generic Sample d02e2f6c2ef7… — Score 80/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d02e2f6c2ef7…. Malware family: Application.Bundler.MediaGet.Generic. Threat score 80/100. 7/25 AV engines flagged this file. 1 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L6d","11",{}]] 32:null