24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 4c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T427,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample df2bd537b83f… — Score 56/100 — Hybrid Analysis","description":"Malicious verdict for sample df2bd537b83f…. Threat score 56/100. 0/0 AV engines flagged this file. 9 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05"],"about":{"@type":"SoftwareApplication","name":"SUPERAntiSpyware.exe","applicationCategory":["neexe","executable"],"identifier":"df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05","additionalType":"Malicious sample"},"threatScore":56,"antivirusDetections":{"malicious":0,"total":0},"behavioralIndicators":{"malicious":9,"suspicious":18},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T65c,"SUPERAntiSpyware.exe" called "GetWindowTextW" (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetWindowTextW" with parameter "System Tools" - (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetWindowTextW" with parameter "Help && Registration" - (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetWindowTextW" with parameter "Real-Time Protection" - (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetWindowTextW" with parameter "Scheduled Scanning" - (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetWindowTextW" with parameter "Automatic Updates" - (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetWindowTextW" with parameter "Cancel" - (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetWindowTextA" with parameter "SUPERAntiSpyware Definitions Update Reminder" - (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetWindowTextA" with parameter "It is important to check for definition updates to protect you against the latest threats. You have not checked for definition updates in days." - (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetWindowTextW" with parameter "Close" - (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetWindowTextA" (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetWindowTextA" with parameter "154257" - (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetWindowTextW" with parameter "SUPERAntiSpyware Version 10.0.1252" - (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetWindowTextW" with parameter "LIFETIME Professional Subscription" - (UID: 00000000-00002816)26:T1bc6,"SUPERAntiSpyware.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000001812284001000000000000000000000000000000000000000100000000000000506237400100000050fd020200000000d1ad18400100000003000000ffffffff38e6274001000000b0c5490500000000a0c6490500000000b4c3490500000000c0c1490500000000000000000000000012498977000000003e000000010000003e0002000100000000000000000000000000000000000000f007000000000000000000000000000000284d050000000090274d0500000000f00700000000000004000000000000000100000001000000c0c149050000000000ff00ff (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000060000000000000000000000000000004000000000000000d78a2540010000002000000000000000b030230200000000000000000000000000000000000000000000000000000000000000000000000000000000000000007a88254001000000a8fe02020000000080fe020200000000e03900400100000068fe0202000000004200000000000000d28c25400100000030c527400100000004668977000000000200000000000000a8fe02020000000002000000ffffffff90fe02020000000098fe020200000000b71c1e40010000002a000000 (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000802350200000000008035020000000000000000000000002000000000000000f80035020000000020ff020200000000b7a781fdfe0700000300000000000000000100000000000050c323020000000054073502000000000000000000000000ea908a77000000002786ae400100000000000000000000000000000200000000001003000000000002000000020005000000000023022081648601000000000000e485006dda8600000000000000000062a781fdfe070000e0da0202000000000000000000000000400000000000000000001d020000000001000000 (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "RtlGetVersion" (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000000000000000000000000000401626020000000080ef9b090000000000001d0200000000e88c8b7700000000000000000000000020162502000000009a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010100000000000000000000000000009a10000000000000000000000000d90100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000005c0200000000000000000000000030e9240200000000f8005c020000000000000000000000008e2c8e77000000000300000000000000207e1d0200000000000a0000000000001c801d020000000080841d0200000000ea908a770000000000005c020000000030025c020000000000000000000000000000000000000000c8039877000000000000000000000000e07d5d020000000000001d02000000000011ebfafe0700003000000000000000b8021d020000000080004402000000000000000000000000b002440200000000a01044020000000010821d020000000000005c02 (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000060a0c4fdfe070000e0da020200000000a3f1000000000000c0a0240200000000550050004500520041006e007400690053007000790077006100720065002e00207e1d020000000000000000000000001c801d020000000080841d020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c8039877000000000000000000000000400000000000000000001d0200000000a0b2c4fdfe0700003000000000000000b8021d020000000048dd8b77000000000000000000000000300000000000000022007600 (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000077617265000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000000000000000830000000000000080d62402ff0300004e1500000000000080d62402000000008300000000000000000000000000000000000000000000002a00000000000000c0d2250200000000080000000000000070451d02000000000000000001001d02010000000000000080d624020000000014461d020000000070451d0200000000ff030000000000000000000001001d020900000000000000f0d52402800000002a0000000000000070451d02000000000900000000000000600000000000000000000000000000000000000080000000c0d2250200000000d11500c4 (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000200000000000000000000000000000000000000000002000002000000000200000000000000c0b225020000000040562102000000006019007900000000ffff0000ffffffff000087770000000010821d0200000000408b1d020000000040801d0200000000207e1d0200000000000000000000000012498977000000002700000001000000270002000100000000000000000000000000000000000000f01f0000000000000000000000000000f0b2250200000000c0b2250200000000f01f00000000000019000200000000000c00000001000000207e1d020000000010fb2c02 (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000007e050000000060ff1c0400000000470000000000000042000000000000008a2a81fdfe07000008007e05000000000100000000000000420000000000000008007e050000000000000000000000003b9481fdfe07000000ce02020000000008007e05000000000000000000000000981e5deffe07000000000000000000000400000000000000f0cd020200000000835be6fdfe07000060ff1c0400000000000000000000000000ce020200000000010000000000000030ce020200000000f0cd0202000000000000000000000000e269e7fdfe07000000000000 (UID: 00000000-00002816)27:Ta5c,"SUPERAntiSpyware.exe" (Access type: "QUERY"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "SUPERAntiSpyware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "ENABLEDHCP"; Value: "") "SUPERAntiSpyware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "REGISTRATIONENABLED"; Value: "") "SUPERAntiSpyware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "REGISTERADAPTERNAME"; Value: "") "SUPERAntiSpyware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "DOMAIN"; Value: "") "SUPERAntiSpyware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "DHCPDOMAIN"; Value: "") "SUPERAntiSpyware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{E63BE247-2D1C-4749-B86C-7B5FABD92F0C}"; Key: "NAMESERVER"; Value: "") "SUPERAntiSpyware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "ENABLEDHCP"; Value: "") "SUPERAntiSpyware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTRATIONENABLED"; Value: "") "SUPERAntiSpyware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "REGISTERADAPTERNAME"; Value: "") "SUPERAntiSpyware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DOMAIN"; Value: "") "SUPERAntiSpyware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPDOMAIN"; Value: "") "SUPERAntiSpyware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "NAMESERVER"; Value: "") "SUPERAntiSpyware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES\{846EE342-7039-11DE-9D20-806E6F6E6963}"; Key: "DHCPNAMESERVER"; Value: "")28:T861,"SUPERAntiSpyware.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "SUPERAntiSpyware.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "SUPERAntiSpyware.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "SUPERAntiSpyware.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "SUPERAntiSpyware.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "SUPERAntiSpyware.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "SUPERAntiSpyware.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CRLS"; Key: "") "SUPERAntiSpyware.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\CA\CTLS"; Key: "") "SUPERAntiSpyware.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "SUPERAntiSpyware.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "SUPERAntiSpyware.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "SUPERAntiSpyware.exe" (Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "SUPERAntiSpyware.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED"; Key: "") "SUPERAntiSpyware.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CERTIFICATES"; Key: "") "SUPERAntiSpyware.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CRLS"; Key: "") "SUPERAntiSpyware.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\DISALLOWED\CTLS"; Key: "") "SUPERAntiSpyware.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT"; Key: "") "SUPERAntiSpyware.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CERTIFICATES"; Key: "") "SUPERAntiSpyware.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CRLS"; Key: "") "SUPERAntiSpyware.exe" (Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SYSTEMCERTIFICATES\ROOT\CTLS"; Key: "")29:T47a,"SUPERAntiSpyware.exe" (Path: "HKLM\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\AUTHROOT\AUTOUPDATE"; Key: "DISALLOWEDCERTSYNCDELTATIME") "SUPERAntiSpyware.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\MY"; Key: "") "SUPERAntiSpyware.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA"; Key: "") "SUPERAntiSpyware.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES"; Key: "") "SUPERAntiSpyware.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\104C63D2546B8021DD105E9FBA5A8D78169F6B32"; Key: "BLOB") "SUPERAntiSpyware.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\1FB86B1168EC743154062E8C9CC5B171A4B7CCB4"; Key: "BLOB") "SUPERAntiSpyware.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\247106A405B288A46E70A0262717162D0903E734"; Key: "BLOB") "SUPERAntiSpyware.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\27AC9369FAF25207BB2627CEFACCBE4EF9C319B8"; Key: "BLOB") "SUPERAntiSpyware.exe" (Path: "HKCU\SOFTWARE\MICROSOFT\SYSTEMCERTIFICATES\CA\CERTIFICATES\339CDD57CFD5B141169B615FF31428782D1DA639"; Key: "BLOB")2a:T70d,"SUPERAntiSpyware.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\SUPERAntiSpyware.com (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "CreateDirectoryW" with parameter %ALLUSERSPROFILE%\SUPERAntiSpyware.com\SUPERAntiSpyware (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "CreateDirectoryA" with parameter %APPDATA%\SUPERAntiSpyware.com (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "CreateDirectoryA" with parameter %APPDATA%\SUPERAntiSpyware.com\SUPERAntiSpyware (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "CreateDirectoryW" with parameter C:\Users\%OSUSER% (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Local (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "CreateDirectoryW" with parameter %USERPROFILE%\AppData\Roaming (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "CreateDirectoryW" with parameter %APPDATA%\Microsoft\Windows\Cookies (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "CreateDirectoryW" with parameter %LOCALAPPDATA%\Microsoft\Windows\History (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "CreateDirectoryA" with parameter %APPDATA%\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "CreateDirectoryA" with parameter %ALLUSERSPROFILE%\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "CreateDirectoryA" with parameter %APPDATA%\SUPERAntiSpyware.com\SUPERAntiSpyware\Quarantine (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "CreateDirectoryA" (UID: 00000000-00002816)2b:T60a,"SUPERAntiSpyware.exe" called "LoadLibrary" with a parameter WINTRUST.DLL (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "LoadLibrary" with a parameter PSAPI.DLL (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "LoadLibrary" with a parameter uxtheme.dll (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "LoadLibrary" with a parameter comctl32.dll (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\uxtheme.dll (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "LoadLibrary" with a parameter UxTheme.dll (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "LoadLibrary" with a parameter %WINDIR%\WinSxS\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\gdiplus.dll (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "LoadLibrary" with a parameter C:\SUPERAntiSpyware.exe (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "LoadLibrary" with a parameter propsys.dll (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "LoadLibrary" with a parameter API-MS-Win-Core-LocalRegistry-L1-1-0.dll (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "LoadLibrary" with a parameter netprofm.dll (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00002816)2c:T7d4,"SUPERAntiSpyware.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetProcAddress" with a parameter VirtualProtect (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetProcAddress" with a parameter GetTempFileNameA (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetProcAddress" with a parameter GetTempFileNameW (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetProcAddress" with a parameter GetWindowsDirectoryA (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetProcAddress" with a parameter CreateDirectoryA (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetProcAddress" with a parameter RemoveDirectoryA (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetProcAddress" with a parameter RemoveDirectoryW (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetProcAddress" with a parameter CreateFileA (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetProcAddress" with a parameter CreateFileW (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetProcAddress" with a parameter SetFileAttributesA (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetProcAddress" with a parameter SetFileAttributesW (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetProcAddress" with a parameter GetFileAttributesA (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetProcAddress" with a parameter DeleteFileA (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetProcAddress" with a parameter DeleteFileW (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetProcAddress" with a parameter FindFirstFileA (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetProcAddress" with a parameter FindFirstFileW (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetProcAddress" with a parameter FindNextFileA (UID: 00000000-00002816) "SUPERAntiSpyware.exe" called "GetProcAddress" with a parameter FindNextFileW (UID: 00000000-00002816)2d:T83f,Found reference to API (Indicator: "Sleep"; File: "df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05.bin") Found reference to API (Indicator: "GetModuleHandleA"; File: "df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05.bin") Found reference to API (Indicator: "GetProcAddress"; File: "df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05.bin") Found reference to API (Indicator: "GetDC"; File: "df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05.bin") Found reference to API (Indicator: "GetOpenFileNameW"; File: "df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05.bin") Found reference to API (Indicator: "CoCreateGuid"; File: "df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05.bin") Found reference to API (Indicator: "GetProcessMemoryInfo"; File: "df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05.bin") Found reference to API (Indicator: "CertGetNameStringW"; File: "df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05.bin") Found reference to API (Indicator: "GetAdaptersInfo"; File: "df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05.bin") Found reference to API (Indicator: "UuidCreate"; File: "df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05.bin") Found reference to API (Indicator: "WinHttpOpen"; File: "df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05.bin") Found reference to API (Indicator: "InternetOpenA"; File: "df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05.bin") Found reference to API (Indicator: "VerQueryValueA"; File: "df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05.bin") Found reference to API (Indicator: "NetUseEnum"; File: "df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05.bin") Found reference to API (Indicator: "Beep"; Source: "00000000-00002816.00000000.66390.7EFE0000.00000002.mdmp, 00000000-00002816.00000001.68309.7EFE0000.00000002.mdmp, 00000000-00002816.00000002.70228.7EFE0000.00000002.mdmp, 00000000-00002816.00000003.77656.7EFE0000.00000002.mdmp")2e:T1060,"\Registry\Machine\System\CurrentControlSet\Control\Keyboard Layout" in Source: 00000000-00002816.00000000.66390.7EFE0000.00000002.mdmp 00000000-00002816.00000001.68309.7EFE0000.00000002.mdmp 00000000-00002816.00000002.70228.7EFE0000.00000002.mdmp 00000000-00002816.00000003.77656.7EFE0000.00000002.mdmp "Software\Microsoft\RegEdt32" in Source: 00000000-00002816.00000000.66390.7EFE0000.00000002.mdmp 00000000-00002816.00000001.68309.7EFE0000.00000002.mdmp 00000000-00002816.00000002.70228.7EFE0000.00000002.mdmp 00000000-00002816.00000003.77656.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts" in Source: 00000000-00002816.00000000.66390.7EFE0000.00000002.mdmp 00000000-00002816.00000001.68309.7EFE0000.00000002.mdmp 00000000-00002816.00000002.70228.7EFE0000.00000002.mdmp 00000000-00002816.00000003.77656.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Devices" in Source: 00000000-00002816.00000000.66390.7EFE0000.00000002.mdmp 00000000-00002816.00000001.68309.7EFE0000.00000002.mdmp 00000000-00002816.00000002.70228.7EFE0000.00000002.mdmp 00000000-00002816.00000003.77656.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TRUETYPE" in Source: 00000000-00002816.00000000.66390.7EFE0000.00000002.mdmp 00000000-00002816.00000001.68309.7EFE0000.00000002.mdmp 00000000-00002816.00000002.70228.7EFE0000.00000002.mdmp 00000000-00002816.00000003.77656.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\EXTENSIONS" in Source: 00000000-00002816.00000000.66390.7EFE0000.00000002.mdmp 00000000-00002816.00000001.68309.7EFE0000.00000002.mdmp 00000000-00002816.00000002.70228.7EFE0000.00000002.mdmp 00000000-00002816.00000003.77656.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\TWAIN" in Source: 00000000-00002816.00000000.66390.7EFE0000.00000002.mdmp 00000000-00002816.00000001.68309.7EFE0000.00000002.mdmp 00000000-00002816.00000002.70228.7EFE0000.00000002.mdmp 00000000-00002816.00000003.77656.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CHARMAP" in Source: 00000000-00002816.00000000.66390.7EFE0000.00000002.mdmp 00000000-00002816.00000001.68309.7EFE0000.00000002.mdmp 00000000-00002816.00000002.70228.7EFE0000.00000002.mdmp 00000000-00002816.00000003.77656.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\NETWORK\\PERSISTENT CONNECTIONS" in Source: 00000000-00002816.00000000.66390.7EFE0000.00000002.mdmp 00000000-00002816.00000001.68309.7EFE0000.00000002.mdmp 00000000-00002816.00000002.70228.7EFE0000.00000002.mdmp 00000000-00002816.00000003.77656.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\WINDOWS HELP" in Source: 00000000-00002816.00000000.66390.7EFE0000.00000002.mdmp 00000000-00002816.00000001.68309.7EFE0000.00000002.mdmp 00000000-00002816.00000002.70228.7EFE0000.00000002.mdmp 00000000-00002816.00000003.77656.7EFE0000.00000002.mdmp "SOFTWARE\\MICROSOFT\\CLOCK" in Source: 00000000-00002816.00000000.66390.7EFE0000.00000002.mdmp 00000000-00002816.00000001.68309.7EFE0000.00000002.mdmp 00000000-00002816.00000002.70228.7EFE0000.00000002.mdmp 00000000-00002816.00000003.77656.7EFE0000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows" in Source: 00000000-00002816.00000000.66390.7EFE0000.00000002.mdmp 00000000-00002816.00000001.68309.7EFE0000.00000002.mdmp 00000000-00002816.00000002.70228.7EFE0000.00000002.mdmp 00000000-00002816.00000003.77656.7EFE0000.00000002.mdmp "Software\Policies\Microsoft\Internet Explorer\Main" in Source: 00000000-00002816.00000001.68309.021D0000.00000004.mdmp 00000000-00002816.00000002.70228.021D0000.00000004.mdmp 00000000-00002816.00000003.77656.021D0000.00000004.mdmp "CHINE\Software\Wow6432Node" in Source: 00000000-00002816.00000001.68309.021D0000.00000004.mdmp 00000000-00002816.00000002.70228.021D0000.00000004.mdmp 00000000-00002816.00000003.77656.021D0000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00002816.00000001.68309.040D0000.00000004.mdmp 00000000-00002816.00000002.70228.040D0000.00000004.mdmp 00000000-00002816.00000003.77656.040D0000.00000004.mdmp2f:T2424,"SUPERAntiSpyware.exe" loaded module "C:\SUPERAntiSpyware.exe" at 40000000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\ntdll.dll" at 77870000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\kernel32.dll" at 77750000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\KernelBase.dll" at FD800000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\user32.dll" at 77650000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\gdi32.dll" at FF450000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\lpk.dll" at FDC60000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\usp10.dll" at FF1D0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\msvcrt.dll" at FFAE0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\comdlg32.dll" at FD920000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\shlwapi.dll" at FDF30000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\winsxs\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll" at FBEE0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\shell32.dll" at FE0D0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\rpcrt4.dll" at FD9C0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\winsxs\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.23894_none_145eb2808b8d6928\GdiPlus.dll" at FB820000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\winmm.dll" at FA610000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\psapi.dll" at 77A40000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\crypt32.dll" at FD630000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\msasn1.dll" at FD560000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\wintrust.dll" at FD7C0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\msimg32.dll" at F6480000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\IPHLPAPI.DLL" at FC770000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\nsi.dll" at FF5A0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\winnsi.dll" at FC760000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\wsock32.dll" at FB130000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\ws2_32.dll" at FE080000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\winhttp.dll" at F8FB0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\webio.dll" at F8F40000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\wininet.dll" at FF5B0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\api-ms-win-downlevel-user32-l1-1-0.dll" at FD890000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\api-ms-win-downlevel-shlwapi-l1-1-0.dll" at FD620000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\api-ms-win-downlevel-version-l1-1-0.dll" at FD8E0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\version.dll" at FC7A0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\api-ms-win-downlevel-normaliz-l1-1-0.dll" at FD910000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\normaliz.dll" at 77A30000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\iertutil.dll" at FEF00000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\api-ms-win-downlevel-advapi32-l1-1-0.dll" at FD900000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\advapi32.dll" at FDE50000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\sechost.dll" at FEEE0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\userenv.dll" at FD870000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\profapi.dll" at FD570000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\netapi32.dll" at FB370000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\netutils.dll" at FBC10000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\srvcli.dll" at FCF60000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\wkscli.dll" at FBBF0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\uxtheme.dll" at FBA40000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\secur32.dll" at FD090000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\sspicli.dll" at FD330000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\imm32.dll" at 02170000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\imm32.dll" at FE050000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\msctf.dll" at FDAF0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\WindowsShell.Manifest" at 02190000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\api-ms-win-core-synch-l1-2-0.dll" at F8BA0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\samcli.dll" at FB350000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\Globalization\Sorting\SortDefault.nls" at 05510000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\rpcss.dll" at 022D0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\cryptbase.dll" at FD3C0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\propsys.dll" at FBC30000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\setupapi.dll" at FDC70000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\cfgmgr32.dll" at FD8A0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\devobj.dll" at FD7A0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\netprofm.dll" at F7090000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\nlaapi.dll" at FAEA0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\api-ms-win-downlevel-advapi32-l2-1-0.dll" at F9DF0000 "SUPERAntiSpyware.exe" loaded module "%LOCALAPPDATA%\Microsoft\Windows\Temporary Internet Files\counters.dat" at 022E0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\api-ms-win-downlevel-ole32-l1-1-0.dll" at FD8F0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\urlmon.dll" at FF2C0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\api-ms-win-downlevel-shlwapi-l2-1-0.dll" at F6490000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\dnsapi.dll" at FCB70000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\dhcpcsvc6.dll" at FAAD0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\dhcpcsvc.dll" at FC640000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\RpcRtRemote.dll" at FD4B0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\npmproxy.dll" at F6980000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\ole32.dll" at FF8E0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\oleaut32.dll" at FF4C0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\Temp\VxSSL64.dll" at EF810000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\fltLib.dll" at F6090000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\Temp\VxOle64.dll" at EF690000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\taskschd.dll" at FAD60000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\mstask.dll" at FAC90000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\hhctrl.ocx" at EF5D0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\dwmapi.dll" at FB660000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\en-US\KernelBase.dll.mui" at 04250000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\ntmarta.dll" at FC730000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\Wldap32.dll" at FDC00000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\mswsock.dll" at FCCF0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\wship6.dll" at FCCE0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\FWPUCLNT.DLL" at FAB00000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\schannel.dll" at FCAE0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\WSHTCPIP.DLL" at FC630000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\rasadhlp.dll" at FA670000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\wshqos.dll" at F9170000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\wshqos.dll" at F9180000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\ncrypt.dll" at FCED0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\bcrypt.dll" at FCEA0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\cryptsp.dll" at FCD50000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\rsaenh.dll" at FCA50000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\gpapi.dll" at FC800000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\QAGENTRT.DLL" at F5500000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\fveui.dll" at F6E10000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\fveui.dll" at F5550000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\wuaueng.dll" at EF340000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\en-US\user32.dll.mui" at 02360000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\Fonts\StaticCache.dat" at 174E0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\en-US\msctf.dll.mui" at 02370000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\credssp.dll" at FC950000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\System32\bcryptprimitives.dll" at FC99000030:T16c4,"SUPERAntiSpyware.exe" loaded module "WINTRUST.DLL" at base fd7c0000 "SUPERAntiSpyware.exe" loaded module "PSAPI.DLL" at base 77a40000 "SUPERAntiSpyware.exe" loaded module "UXTHEME.DLL" at base fba40000 "SUPERAntiSpyware.exe" loaded module "COMCTL32.DLL" at base fbee0000 "SUPERAntiSpyware.exe" loaded module "KERNEL32.DLL" at base 77750000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base fba40000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\WINSXS\AMD64_MICROSOFT.WINDOWS.GDIPLUS_6595B64144CCF1DF_1.1.7601.23894_NONE_145EB2808B8D6928\GDIPLUS.DLL" at base fb820000 "SUPERAntiSpyware.exe" loaded module "OLE32.DLL" at base ff8e0000 "SUPERAntiSpyware.exe" loaded module "CRYPTBASE.DLL" at base fd3c0000 "SUPERAntiSpyware.exe" loaded module "PROPSYS.DLL" at base fbc30000 "SUPERAntiSpyware.exe" loaded module "OLEAUT32.DLL" at base ff4c0000 "SUPERAntiSpyware.exe" loaded module "ADVAPI32.DLL" at base fde50000 "SUPERAntiSpyware.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 77750000 "SUPERAntiSpyware.exe" loaded module "NETPROFM.DLL" at base f7090000 "SUPERAntiSpyware.exe" loaded module "NTMARTA.DLL" at base fc730000 "SUPERAntiSpyware.exe" loaded module "SECUR32.DLL" at base fd090000 "SUPERAntiSpyware.exe" loaded module "SHELL32.DLL" at base fe0d0000 "SUPERAntiSpyware.exe" loaded module "API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" at base f9df0000 "SUPERAntiSpyware.exe" loaded module "API-MS-WIN-DOWNLEVEL-OLE32-L1-1-0.DLL" at base fd8f0000 "SUPERAntiSpyware.exe" loaded module "WS2_32.DLL" at base fe080000 "SUPERAntiSpyware.exe" loaded module "WINHTTP.DLL" at base f8fb0000 "SUPERAntiSpyware.exe" loaded module "URLMON.DLL" at base ff2c0000 "SUPERAntiSpyware.exe" loaded module "API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" at base f6490000 "SUPERAntiSpyware.exe" loaded module "DNSAPI.DLL" at base fcb70000 "SUPERAntiSpyware.exe" loaded module "RPCRT4.DLL" at base fd9c0000 "SUPERAntiSpyware.exe" loaded module "API-MS-WIN-SECURITY-SDDL-L1-1-0.DLL" at base feee0000 "SUPERAntiSpyware.exe" loaded module "DHCPCSVC6.DLL" at base faad0000 "SUPERAntiSpyware.exe" loaded module "IPHLPAPI.DLL" at base fc770000 "SUPERAntiSpyware.exe" loaded module "DHCPCSVC.DLL" at base fc640000 "SUPERAntiSpyware.exe" loaded module "CLBCATQ.DLL" at base 3d00000 "SUPERAntiSpyware.exe" loaded module "API-MS-WIN-SECURITY-LSALOOKUP-L1-1-0.DLL" at base feee0000 "SUPERAntiSpyware.exe" loaded module "RPCRTREMOTE.DLL" at base fd4b0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\SYSTEM32\NPMPROXY.DLL" at base f6980000 "SUPERAntiSpyware.exe" loaded module "SETUPAPI.DLL" at base fdc70000 "SUPERAntiSpyware.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base f8ba0000 "SUPERAntiSpyware.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 0 "SUPERAntiSpyware.exe" loaded module "KERNEL32" at base 77750000 "SUPERAntiSpyware.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 0 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base ef690000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\SYSTEM32\TASKSCHD.DLL" at base fad60000 "SUPERAntiSpyware.exe" loaded module "SSPICLI.DLL" at base fd330000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\SYSTEM32\MSTASK.DLL" at base fac90000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\SYSTEM32\HHCTRL.OCX" at base ef5d0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\SYSTEM32\ADVAPI32.DLL" at base fde50000 "SUPERAntiSpyware.exe" loaded module "DWMAPI.DLL" at base fb660000 "SUPERAntiSpyware.exe" loaded module "USER32.DLL" at base 77650000 "SUPERAntiSpyware.exe" loaded module "NTDLL.DLL" at base 77870000 "SUPERAntiSpyware.exe" loaded module "PROFAPI.DLL" at base fd570000 "SUPERAntiSpyware.exe" loaded module "SHLWAPI.DLL" at base fdf30000 "SUPERAntiSpyware.exe" loaded module "CFGMGR32.DLL" at base fd8a0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base fccf0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\SYSTEM32\WSHIP6.DLL" at base fcce0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base fab00000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\SYSTEM32\SCHANNEL.DLL" at base fcae0000 "SUPERAntiSpyware.exe" loaded module "CRYPT32.DLL" at base fd630000 "SUPERAntiSpyware.exe" loaded module "USERENV.DLL" at base fd870000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\SYSTEM32\WSHTCPIP.DLL" at base fc630000 "SUPERAntiSpyware.exe" loaded module "RASADHLP.DLL" at base fa670000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base fe080000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\SYSTEM32\NETPROFM.DLL" at base f7090000 "SUPERAntiSpyware.exe" loaded module "NCRYPT.DLL" at base fced0000 "SUPERAntiSpyware.exe" loaded module "CRYPTSP.DLL" at base fcd50000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\SYSTEM32\RSAENH.DLL" at base fca50000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\SYSTEM32\OLEAUT32.DLL" at base ff4c0000 "SUPERAntiSpyware.exe" loaded module "GPAPI.DLL" at base fc800000 "SUPERAntiSpyware.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L1-1-0.DLL" at base feee0000 "SUPERAntiSpyware.exe" loaded module "API-MS-WIN-SERVICE-MANAGEMENT-L2-1-0.DLL" at base feee0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\SYSTEM32\WININET.DLL" at base ff5b0000 "SUPERAntiSpyware.exe" loaded module "IMM32.DLL" at base fe050000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\SYSTEM32\OLE32.DLL" at base ff8e0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\SYSTEM32\MSCTF.DLL" at base fdaf0000 "SUPERAntiSpyware.exe" loaded module "CREDSSP.DLL" at base fc950000 "SUPERAntiSpyware.exe" loaded module "NSI.DLL" at base ff5a0000 "SUPERAntiSpyware.exe" loaded module "%WINDIR%\SYSTEM32\BCRYPTPRIMITIVES.DLL" at base fc99000031:T4d3,"SUPERANTISPYWARE-5-6-2023_ 19-20-56 _.SDB" has type "Non-ISO extended-ASCII text with very long lines with NEL line terminators"- [targetUID: 00000000-00002816] "SAS_CURRENTUSER.DB3" has type "SQLite 3.x database last written using SQLite version 3008011"- Location: [%APPDATA%\SUPERAntiSpyware.com\SUPERAntiSpyware\SAS_CURRENTUSER.DB3]- [targetUID: 00000000-00002816] "SAS_CURRENTUSER.DB3-journal" has type "SQLite Rollback Journal"- Location: [%APPDATA%\SUPERAntiSpyware.com\SUPERAntiSpyware\SAS_CURRENTUSER.DB3-journal]- [targetUID: 00000000-00002816] "SAS_ALLUSER.DB3-journal" has type "SQLite Rollback Journal"- Location: [%ALLUSERSPROFILE%\SUPERAntiSpyware.com\SUPERAntiSpyware\SAS_ALLUSER.DB3-journal]- [targetUID: 00000000-00002816] "SAS_ALLUSER.DB3" has type "SQLite 3.x database last written using SQLite version 3008011"- Location: [%ALLUSERSPROFILE%\SUPERAntiSpyware.com\SUPERAntiSpyware\SAS_ALLUSER.DB3]- [targetUID: 00000000-00002816] "sas-data.tmp" has type "SAS"- Location: [%APPDATA%\SUPERAntiSpyware.com\SUPERAntiSpyware\sas-data.tmp]- [targetUID: 00000000-00002816] "sas-data.tmp" has type "SAS"- Location: [%ALLUSERSPROFILE%\SUPERAntiSpyware.com\SUPERAntiSpyware\sas-data.tmp]- [targetUID: 00000000-00002816]32:T715,"SUPERAntiSpyware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "SUPERAntiSpyware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "SUPERAntiSpyware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "SUPERAntiSpyware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "SUPERAntiSpyware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "SUPERAntiSpyware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "SUPERAntiSpyware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "SUPERAntiSpyware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "HELPERDLLNAME"; Value: "") "SUPERAntiSpyware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "SUPERAntiSpyware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "SUPERAntiSpyware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") "SUPERAntiSpyware.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "AUTODIALDLL"; Value: "")33:T15e1,"SUPERAntiSpyware.exe" trying to access non-existent file "C:\WINMM.dll" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\MSIMG32.dll" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\IPHLPAPI.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\WINNSI.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\WSOCK32.dll" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\WINHTTP.dll" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\webio.dll" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\version.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\NETAPI32.dll" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\netutils.dll" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\srvcli.dll" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\wkscli.dll" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\UxTheme.dll" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Secur32.dll" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\SSPICLI.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\FLTLIB.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\CRYPTBASE.dll" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\SSUPDATE64.EXE" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\PROPSYS.dll" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\netprofm.dll" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\nlaapi.dll" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\api-ms-win-downlevel-advapi32-l2-1-0.dll" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\api-ms-win-downlevel-shlwapi-l2-1-0.dll" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\DNSAPI.dll" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\dhcpcsvc6.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\dhcpcsvc.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\RpcRtRemote.dll" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\dwmapi.dll" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\ntmarta.dll" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\rasadhlp.dll" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\ncrypt.dll" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\bcrypt.dll" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\CRYPTSP.dll" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\WINMM.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\MSIMG32.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\WSOCK32.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\WINHTTP.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\WEBIO.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\VERSION.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\GPAPI.dll" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\NETAPI32.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\NETUTILS.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\SRVCLI.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\WKSCLI.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\UXTHEME.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\SECUR32.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\SAMCLI.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\CRYPTBASE.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\PROPSYS.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\NETPROFM.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\NLAAPI.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\API-MS-WIN-DOWNLEVEL-ADVAPI32-L2-1-0.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\API-MS-WIN-DOWNLEVEL-SHLWAPI-L2-1-0.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\credssp.dll" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\DNSAPI.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\DHCPCSVC6.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\DHCPCSVC.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\RPCRTREMOTE.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\DWMAPI.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\NTMARTA.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\RASADHLP.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\NCRYPT.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\BCRYPT.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\GPAPI.DLL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\CREDSSP.DLL"34:T18f7,"SUPERAntiSpyware.exe" trying to access non-existent file "C:\SUPERAntiSpyware.exe.Local\" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Users\MclhaAL\AppData\Roaming\SUPERAntiSpyware.com" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Users\MclhaAL\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Users\MclhaAL\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SAS_CURRENTUSER.DB3" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SAS_ALLUSER.DB3" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Users\MclhaAL\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SAS_CURRENTUSER.DB3-wal" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SAS_ALLUSER.DB3-wal" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\sas_preconfig.db3" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SetupOptions.db3" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\IMGPartnerSplash.bmp" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Windows\system32\IMGPartnerSplash.bmp" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Windows\system\IMGPartnerSplash.bmp" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Windows\IMGPartnerSplash.bmp" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath\IMGPartnerSplash.bmp" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Windows\System32\Wbem\IMGPartnerSplash.bmp" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\IMGPartnerSplash.bmp" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Program Files\Wireshark\IMGPartnerSplash.bmp" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38\Scripts\IMGPartnerSplash.bmp" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38\IMGPartnerSplash.bmp" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SUPERANTISPYWARE.DB3-wal" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\SUPERANTISPYWARE.EXE.LOCAL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\content1\" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\SUPERANTISPYWARE.COM" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\SUPERAntiSpyware.com\SUPERANTISPYWARE" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SAS_CURRENTUSER.DB3" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SAS_CURRENTUSER.DB3-JOURNAL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SAS_CURRENTUSER.DB3-WAL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SAS_ALLUSER.DB3-JOURNAL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SAS_ALLUSER.DB3-WAL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\SAS_PRECONFIG.DB3" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SETUPOPTIONS.DB3" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\PROCESSLIST.BIN" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\SAS DEFAULT.SET" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SAS DEFAULT.SET" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\IMGPARTNERSPLASH.BMP" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Windows\System32\IMGPARTNERSPLASH.BMP" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Windows\system\IMGPARTNERSPLASH.BMP" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Windows\IMGPARTNERSPLASH.BMP" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\ProgramData\Oracle\Java\javapath_target_713187\IMGPARTNERSPLASH.BMP" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Windows\System32\wbem\IMGPARTNERSPLASH.BMP" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Windows\System32\WindowsPowerShell\v1.0\IMGPARTNERSPLASH.BMP" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Program Files\Wireshark\IMGPARTNERSPLASH.BMP" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38\Scripts\IMGPARTNERSPLASH.BMP" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Programs\Python\Python38\IMGPARTNERSPLASH.BMP" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SUPERANTISPYWARE.DB3" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SUPERANTISPYWARE.DB3-JOURNAL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SUPERANTISPYWARE.DB3-WAL" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\PROCESSLISTRELATED.DB" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\PROCESSLIST.BIN.WORKING" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\ALLOWED.STG" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Roaming\SUPERAntiSpyware.com\SUPERAntiSpyware\SASDETECT.STG" "SUPERAntiSpyware.exe" trying to access non-existent file "C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\CONTENT1"35:T52d,Found reference to API "WinHttpOpen" (Indicator: "WinHttpOpen"; File: "df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05.bin") Found reference to API "WinHttpReadData" (Indicator: "WinHttpReadData"; Source: "00000000-00002816-00000C1F-25749786") Found reference to API "WinHttpQueryHeaders" (Indicator: "WinHttpQueryHeaders"; Source: "00000000-00002816-00000C1F-25750210") Found reference to API "WinHttpSendRequest" (Indicator: "WinHttpSendRequest"; Source: "00000000-00002816-00000C1F-25751249") Found reference to API "WinHttpOpenRequest" (Indicator: "WinHttpOpenRequest"; Source: "00000000-00002816-00000C1F-25753363") Found reference to API "WinHttpConnect" (Indicator: "WinHttpConnect"; Source: "00000000-00002816-00000C1F-25754210") Found reference to API "InternetReadFile" (Indicator: "InternetReadFile"; Source: "00000000-00002816-00000C1F-25757853") Found reference to API "WSASend" (Indicator: "WSASend"; Source: "00000000-00002816-00000C1F-30199494") Found reference to API "WSARecv" (Indicator: "WSARecv"; Source: "00000000-00002816-00000C1F-30202024") Found reference to API "accept" (Indicator: "accept"; Source: "00000000-00002816.00000001.68309.02440000.00000004.mdmp, 00000000-00002816.00000002.70228.02440000.00000004.mdmp, 00000000-00002816.00000003.77656.02440000.00000004.mdmp")36:Tad4,"POST /application.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: SAS_APPHost: www.superantispyware.comContent-Length: 1302Cache-Control: no-cache" "DATA1=kxPQlRZUEU9UEhPTkVIT01FJlQ9MTkyMTAyMDExNyZTQVNBUFBJRD0lN0IxNTk3Rjg4Ri1GQTA1LTQ4OTgtOTE3Ni1GRTAwNUY3RDYyNkQlN0QmU0FTSEFSRFdBUkVJRD1DRFJJRDVBRkU4RTgzQThDRTM4NzJFNzBFMDQ1OTFDRTc0NUYwLUhERElERjM1QTM2RkE0QjkzNUM2MTI1NTQwNjlBMTk4Q0Y4OEEtRElTSUQ2MEM0NkZFMjEyRDlGRjEzRkYzRTc1OERFNDAxRTVBMC1JREVJRENENzg5MzNERUZGQjU0RUJDQjRFRjM2NzA5RjgxNTQ2LU5JQ0lERUM1MUM1NTE5MjJGQUQxQjFBNTRGQTAxQzA1NDNCMTYtVk9MSUQxOTA1OUE1NjA0QUQzM0YxQ0E4NkJFMzhCNjY0MEYzOC1DUFVJRDAzRjc5NTg3NDMxNDEwMkEwQjMxRDA2RTI5OUE4RTBELU1FTUlEQTEwQTBDREE3QTAxOURCMEVDRDE2MjBFNDBEMzYwNUQmU0FTUkVHQ09ERT0wMDAtMDAwLTAwMDAmU0FTQVBQU1RBVEU9UFJPJlNBU1ZFUlNJT049MTAuMC4xMjUyJlNBU0NPUkU9MCZBVklSQUtFWU1ENT0mQVZJUkFBTExPV0VEPTAmU0FTQ1BVPTY0NDM3MDY1NzEzOTQ2NmM3OTY4JlNBU0xBTkdVQUdFPTA0MDkmVFJJQUxQRVJJT0REQVlTPTE0JlRSQUNLSU5HQ0xJQ0tTPXRyaWFsZXhwaXJpbmd0b2FzdGVyYnV5bm93Y2xpY2s6MCU3Q1NPU1RPQVNURVIxQ0xJQ0s6MCU3Q1NPU1RPQVNURVIwMzEzMjAyMENMSUNLOjAlN0MmVFJBQ0tJTkdWSUVXUz10cmlhbGV4cGlyaW5ndG9hc3RlcmJ1eW5vd3ZpZXc6MCU3Q1NPU1RPQVNURVIxVklFVzowJTdDU09TVE9BU1RFUjAzMTMyMDIwVklFVzowJTdDJlZURD1ydW5jb3VudDoxJTdDSU5TVEFMTFRZUEU6JTdDQVZTQ0FOTkVEOjAlN0NBVkRFVEVDVEVEOjAlN0NPU1ZFUlNJT046V2luZG93cyUyMDclMjBQcm9mZXNzaW9uYWwlMjA2NC1iaXQsJTIwU2VydmljZSUyMFBhY2slMjAxJTIwKEJ1aWxkJTIwNi4wMS43NjAxKSU3Q0lFVkVSU0lPTjoxMS4wLjk2MDAuMTg4NjAlN0NTY3JlZW5SZXNvbHV0aW9uOjEwMjQtNjExJTdDQ" "HTTP/1.1 200 OKDate: Sat, 06 May 2023 19:20:28 GMTServer: ApachePermissions-Policy: accelerometer=(),autoplay=(),camera=(),encrypted-media=(),fullscreen=*,geolocation=*,gyroscope=(),interest-cohort=(),magnetometer=(),microphone=(),midi=(),payment=("https://*.paypal.com" "https://*.barion.com"),sync-xhr=*,usb=(),xr-spatial-tracking=()Strict-Transport-Security: max-age=63072000; includeSubDomainsContent-Security-Policy: upgrade-insecure-requestsReferrer-Policy: same-originVary: Accept-EncodingX-Frame-Options: SAMEORIGINX-Content-Type-Options: nosniffContent-Length: 80Content-Type: text/html; charset=UTF-81024|35030640|51|17564|106769|0|01025|0007|05-20-20231026|1028|11030|0" "GET /appdata/sas/public/20000002.XML HTTP/1.1User-Agent: SASDef_GetDescriptorHost: securedownloads.superantispyware.comCache-Control: no-cache" "HTTP/1.1 200 OKAccept-Ranges: bytesAge: 81509Cache-Control: max-age=604800Content-Type: text/xmlDate: Sat, 06 May 2023 19:20:33 GMTEtag: "1957795420"Expires: Sat, 13 May 2023 19:20:33 GMTLast-Modified: Fri, 05 May 2023 20:41:22 GMTServer: ECAcc (sac/254E)X-Cache: HITContent-Length: 189" "17564/appdata/sas/public/new.17564.SASFF0C847E477F33104513920B3C7DE4CF213983430"37:Tf55,Heuristic match: "PS.pa" Heuristic match: "{>#.Aq" Heuristic match: "pQx.Vn" Heuristic match: "Kq.tf" Heuristic match: "x:.lA" Heuristic match: "r-5.nL" Heuristic match: "|V.Cm" Heuristic match: "NMnd.tZ" Heuristic match: "nicks@superadblocker.com" Pattern match: "www.superantispyware.com/purchase_products_ex.htmlExpireToFreeScanFaultCount,ScanLastDefinitionCheckTimeRenewalDialogShown,InstallationTimeTICompleteTIExtraTITagTIReferrerTIResellerIdTIRetrievedComponentsVerifiedLastUpdateVersion,SubscriptionExpirationRegC" Pattern match: "www.superantispyware.com/professionalupgrade.htmlPurchaseURLhttps://www.superantispyware.com/purchase_products_ex.htmlExpireToFreeScanFaultCount,ScanLastDefinitionCheckTimeRenewalDialogShown,InstallationTimeTICompleteTIExtraTITagTIReferrerTIResellerIdTIRet" Heuristic match: "securedownloads.superantispyware.com" Pattern match: "www.superantispyware.com" Pattern match: "www.superantispyware.comContent-Length" Pattern match: "https://*.paypal.com" Heuristic match: "%ALLUSERSPROFILE%\SUPERAntiSpyware.com" Heuristic match: "%APPDATA%\SUPERAntiSpyware.com" Heuristic match: "H;.MS" Pattern match: "http://go.microsoft.com/fwlink/p/?LinkId=255141" Pattern match: "www.superantispyware.com/" Pattern match: "http://certs.godaddy.com/repository/1301" Pattern match: "http://ocsp.godaddy.com/05" Pattern match: "http://crl.godaddy.com/gdroot-g2.crl0F" Pattern match: "https://certs.godaddy.com/repository/0" Pattern match: "ispyware.com/professionalupgrade.html" Heuristic match: "ware.com" Heuristic match: "uperantispyware.com" Heuristic match: "ww.superantispyware.com" Heuristic match: "pc.edgecastcdn.net" Heuristic match: "p27b2.wpc.edgecastcdn.net" Heuristic match: "ecuredownloads.superantispyware.com" Pattern match: "www.superantispyware.com/application.php" Heuristic match: "superantispyware.com" Pattern match: "https://www.superantispyware.com/professionalupgrade.html" Pattern match: "https://www.superantispyware.com/purchase_products_ex.html" Pattern match: "http://www.microsoft.com/windows0" Heuristic match: "pc.5f43.edgecastcdn.net" Heuristic match: "wnloads.superantispyware.com" Heuristic match: "p27b2.wpc.5f43.edgecastcdn.net" Heuristic match: "fp27b2.wpc.edgecastcdn.net" Heuristic match: "w.superantispyware.com" Pattern match: "securedownloads.superantispyware.com/appdata/sas/public/20000002.XML" Pattern match: "securedownloads.superantispyware.com/appdata/sas/public/new.17564.SAS" Heuristic match: "fp27b2.wpc.5f43.edgecastcdn.net" Heuristic match: "$securedownloads.superantispyware.com" Pattern match: "igicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0@" Pattern match: "http://crl4.digicert.com/DigiCertTLSRSASHA2562020CA1-4.crl0" Pattern match: "http://www.digicert.com/CPS0" Pattern match: "http://ocsp.digicert.com0I" Pattern match: "http://cacerts.digicert.com/DigiCertTLSRSASHA2562020CA1-1.crt0" Pattern match: "www.digicert.com1" Pattern match: "http://ocsp.digicert.com0@" Pattern match: "cacerts.digicert.com/DigiCertGlobalRootCA.crt0B" Pattern match: "crl3.digicert.com/DigiCertGlobalRootCA.crl0=" Pattern match: "http://crl.godaddy.com/gdig2s1-4347.crl0" Pattern match: "http://certificates.godaddy.com/repository/0" Pattern match: "http://ocsp.godaddy.com/0@" Pattern match: "certificates.godaddy.com/repository/gdig2.crt0" Pattern match: "www.superantispyware.com0" Pattern match: "http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q" Pattern match: "http://crt.comodoca.com/COMODORSAAddTrustCA.crt0$" Pattern match: "http://ocsp.comodoca.com0" Pattern match: "http://ocsp.digicert.com0" Pattern match: "crl3.digicert.com/DigiCertGlobalRootCA.crl07" Pattern match: "crl4.digicert.com/DigiCertGlobalRootCA.crl0=" Pattern match: "https://www.digicert.com/CPS0" Pattern match: "http://crl.globalsign.net/root-r2.crl0" Pattern match: "http://crl.securetrust.com/STCA.crl0"38:T4dcd,Found URL "http://go.microsoft.com/fwlink/p/?linkid=255141c:\ssupdate64.exee.exeak%@9yfwy" - Source: "00000000-00002816.00000001.68309.01FF1000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002816.00000001.68309.021D0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002816.00000001.68309.021D0000.00000004.mdmp") Found URL "https://www.superantispyware.com/professionalupgrade.htmlpurchaseurlhttps://www.superantispyware.com/purchase_products_ex.htmlexpiretofreescanfaultcount,scanlastdefinitionchecktimerenewaldialogshown,installationtimeticompletetiextratitagtireferrertireselleridtiretrievedcomponentsverifiedlastupdateversion,subscriptionexpirationregcodeexregistrationapplicationguidapplicationpath,lasttrialexpiringnotificationtime,lastupdatechecktimeinstalltypeforceupdateidavallowedscanrequiredsetupwizardcompleteemailregproductidemailregistrationrenewalurlupgradeurlhttps://www.superantispyware.com/professionalupgrade.htmlpurchaseurlhttps://www.superantispyware.com/purchase_products_ex.htmlexpiretofreescanfaultcount,scanlastdefinitionchecktimerenewaldialogshown,installationtimeticompletetiextratitagtireferrertireselleridtiretrievedcomponentsverifiedlastupdateversion,subscriptionexpirationregcodeexregistrationapplicationguidapplicationpath,lasttrialexpiringnotificationtime,lastupdatechecktimeinstalltypeforceupdateidavallowedscanrequiredsetupwizardcompletesqlite" - Source: "00000000-00002816.00000001.68309.040D0000.00000004.mdmp") Found URL "http://www.microsoft.com/windows0^ziq$(c\a6\4[=lmem8$/a*ma>,matchmatchmatchmatchwevymatchmatchlmemlmemlmemlmem.com/ic" - Source: "00000000-00002816.00000001.68309.040D0000.00000004.mdmp") Found URL "https://*.paypal.com" - Source: "00000000-00002816.00000001.68309.040D0000.00000004.mdmp") Found URL "https://*.barion.com" - Source: "00000000-00002816.00000001.68309.040D0000.00000004.mdmp") Found URL "http://crl4.digicert.com/digicerttlsrsasha2562020ca1-4.crl0>705030)0'http://www.digicert.com/cps0s0q0$http://ocsp.digicert.com0i=http://cacerts.digicert.com/digicerttlsrsasha2562020ca1-1.crt0" - Source: "00000000-00002816.00000001.68309.181D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0@4http://cacerts.digicert.com/digicertglobalrootca.crt0b;09071http://crl3.digicert.com/digicertglobalrootca.crl0=6040je4^=ym'quj->d1.3.6.1.4.1.311.67.1.2matchmatchmatchuwutpce" - Source: "00000000-00002816.00000001.68309.181D0000.00000004.mdmp") Found URL "https://www.superantispyware.com/professionalupgrade.htmlavfilesdetectedavfilesscannedruncounthelpurlaffiliatefriendlynamesubaffiliateidaffiliateidemailrealtimeinvestigatorlog_omittrustedemailinvestigatoremailscancleanemailscandetectionsemailalertsemailalertsaddressshowrenewaldaysshowtrialexpireddayslastrenewreminderlastpurchasereminderdisablethreatmapsenddiagnosticemailregtenantemailregproductidemailregistrationrenewalurlupgrade=" - Source: "00000000-00002816.00000001.68309.181D0000.00000004.mdmp") Found URL "https://www.superantispyware.com/purchase_products_ex.htmlexpiretofreescanfaultcount,scanlastdefinitionchecktimerenewaldialogshown,installationtimeticompletetiextratitagtireferrertireselleridtiretrievedcomponentsverifiedlastupdateversion,subscriptionexpirationregcodeexregistrationapplicationpath,lasttrialexpiringnotificationtime,lastupdatechecktimeinstalltypeforceupdateidavallowedscanrequiredsetupwizardcompleteemailregproductidemailregistrationrenewalurlupgradeurlhttps://www.superantispyware.com/professionalupgrade.htmlpurchaseurlhttps://www.superantispyware.com/purchase_products_ex.htmlexpiretofreescanfaultcount,scanlastdefinitionchecktimerenewaldialogshown,installationtimeticompletetiextratitagtireferrertireselleridtiretrievedcomponentsverifiedlastupdateversion,subscriptionexpirationregcodeexregistrationapplicationguidapplicationpath,lasttrialexpiringnotificationtime,lastupdatechecktimeinstalltypeforceupdateidavallowedscanrequiredsetupwizardcompletesqlite" - Source: "00000000-00002816.00000001.68309.181D0000.00000004.mdmp") Found URL "https://www.superantispyware.com/purchase_products_ex.htmlexpiretofreescanfaultcount,scanlastdefinitionchecktimerenewaldialogshown,installationtimeticompletetiextratitagtireferrertireselleridtiretrievedcomponentsverifiedlastupdateversion,subscriptionexpirationregcodeexregistrationapplicationpath,lasttrialexpiringnotificationtime,lastupdatechecktimeinstalltypeforceupdateidavallowedsetupwizardcompleteemailregproductidemailregistrationrenewalurlupgradeurlhttps://www.superantispyware.com/professionalupgrade.htmlpurchaseurlhttps://www.superantispyware.com/purchase_products_ex.htmlexpiretofreescanfaultcount,scanlastdefinitionchecktimerenewaldialogshown,installationtimeticompletetiextratitagtireferrertireselleridtiretrievedcomponentsverifiedlastupdateversion,subscriptionexpirationregcodeexregistrationapplicationguidapplicationpath,lasttrialexpiringnotificationtime,lastupdatechecktimeinstalltypeforceupdateidavallowedscanrequiredsetupwizardcompletesqlite" - Source: "00000000-00002816.00000001.68309.181D0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002816.00000001.68309.181D0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002816.00000001.68309.181D0000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig2s1-4347.crl0]v0t0h0907+http://certificates.godaddy.com/repository/0j0h0$http://ocsp.godaddy.com/0@4http://certificates.godaddy.com/repository/gdig2.crt0superantispyware.comwww.superantispyware.com0'" - Source: "00000000-00002816.00000001.68309.181D0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002816.00000001.68309.181D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0" - Source: "00000000-00002816.00000001.68309.181D0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicertglobalrootca.crl071http://crl4.digicert.com/digicertglobalrootca.crl0=604020*0(https://www.digicert.com/cps0s6" - Source: "00000000-00002816.00000001.68309.181D0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,,matchmatchmatchmatchwevymatchmatchlmemlmemlmemlmem.com/ic" - Source: "00000000-00002816.00000002.70228.040D0000.00000004.mdmp") Found URL "https://*.paypal.com" - Source: "00000000-00002816.00000002.70228.040D0000.00000004.mdmp") Found URL "https://*.barion.com" - Source: "00000000-00002816.00000002.70228.040D0000.00000004.mdmp") Found URL "http://crl4.digicert.com/digicerttlsrsasha2562020ca1-4.crl0>705030)0'http://www.digicert.com/cps0s0q0$http://ocsp.digicert.com0i=http://cacerts.digicert.com/digicerttlsrsasha2562020ca1-1.crt0" - Source: "00000000-00002816.00000002.70228.181D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0@4http://cacerts.digicert.com/digicertglobalrootca.crt0b;09071http://crl3.digicert.com/digicertglobalrootca.crl0=6040je4^=ym'quj->d1.3.6.1.4.1.311.67.1.2matchmatchmatchuwutpce" - Source: "00000000-00002816.00000002.70228.181D0000.00000004.mdmp") Found URL "https://www.superantispyware.com/professionalupgrade.htmlavfilesdetectedavfilesscannedruncounthelpurlaffiliatefriendlynamesubaffiliateidaffiliateidemailrealtimeinvestigatorlog_omittrustedemailinvestigatoremailscancleanemailscandetectionsemailalertsemailalertsaddressshowrenewaldaysshowtrialexpireddayslastrenewreminderlastpurchasereminderdisablethreatmapsenddiagnosticemailregtenantemailregproductidemailregistrationrenewalurlupgrade=" - Source: "00000000-00002816.00000002.70228.181D0000.00000004.mdmp") Found URL "https://www.superantispyware.com/purchase_products_ex.htmlexpiretofreescanfaultcount,scanlastdefinitionchecktimerenewaldialogshown,installationtimeticompletetiextratitagtireferrertireselleridtiretrievedcomponentsverifiedlastupdateversion,subscriptionexpirationregcodeexregistrationapplicationpath,lasttrialexpiringnotificationtime,lastupdatechecktimeinstalltypeforceupdateidavallowedscanrequiredsetupwizardcompleteemailregproductidemailregistrationrenewalurlupgradeurlhttps://www.superantispyware.com/professionalupgrade.htmlpurchaseurlhttps://www.superantispyware.com/purchase_products_ex.htmlexpiretofreescanfaultcount,scanlastdefinitionchecktimerenewaldialogshown,installationtimeticompletetiextratitagtireferrertireselleridtiretrievedcomponentsverifiedlastupdateversion,subscriptionexpirationregcodeexregistrationapplicationguidapplicationpath,lasttrialexpiringnotificationtime,lastupdatechecktimeinstalltypeforceupdateidavallowedscanrequiredsetupwizardcompletesqlite" - Source: "00000000-00002816.00000002.70228.181D0000.00000004.mdmp") Found URL "https://www.superantispyware.com/purchase_products_ex.htmlexpiretofreescanfaultcount,scanlastdefinitionchecktimerenewaldialogshown,installationtimeticompletetiextratitagtireferrertireselleridtiretrievedcomponentsverifiedlastupdateversion,subscriptionexpirationregcodeexregistrationapplicationpath,lasttrialexpiringnotificationtime,lastupdatechecktimeinstalltypeforceupdateidavallowedsetupwizardcompleteemailregproductidemailregistrationrenewalurlupgradeurlhttps://www.superantispyware.com/professionalupgrade.htmlpurchaseurlhttps://www.superantispyware.com/purchase_products_ex.htmlexpiretofreescanfaultcount,scanlastdefinitionchecktimerenewaldialogshown,installationtimeticompletetiextratitagtireferrertireselleridtiretrievedcomponentsverifiedlastupdateversion,subscriptionexpirationregcodeexregistrationapplicationguidapplicationpath,lasttrialexpiringnotificationtime,lastupdatechecktimeinstalltypeforceupdateidavallowedscanrequiredsetupwizardcompletesqlite" - Source: "00000000-00002816.00000002.70228.181D0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002816.00000002.70228.181D0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002816.00000002.70228.181D0000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig2s1-4347.crl0]v0t0h0907+http://certificates.godaddy.com/repository/0j0h0$http://ocsp.godaddy.com/0@4http://certificates.godaddy.com/repository/gdig2.crt0superantispyware.comwww.superantispyware.com0'" - Source: "00000000-00002816.00000002.70228.181D0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002816.00000002.70228.181D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0" - Source: "00000000-00002816.00000002.70228.181D0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicertglobalrootca.crl071http://crl4.digicert.com/digicertglobalrootca.crl0=604020*0(https://www.digicert.com/cps0s6" - Source: "00000000-00002816.00000002.70228.181D0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,705030)0'http://www.digicert.com/cps0s0q0$http://ocsp.digicert.com0i=http://cacerts.digicert.com/digicerttlsrsasha2562020ca1-1.crt0" - Source: "00000000-00002816.00000003.77656.181D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0@4http://cacerts.digicert.com/digicertglobalrootca.crt0b;09071http://crl3.digicert.com/digicertglobalrootca.crl0=6040je4^=ym'quj->d1.3.6.1.4.1.311.67.1.2matchmatchmatchuwutpce" - Source: "00000000-00002816.00000003.77656.181D0000.00000004.mdmp") Found URL "https://www.superantispyware.com/professionalupgrade.htmlavfilesdetectedavfilesscannedruncounthelpurlaffiliatefriendlynamesubaffiliateidaffiliateidemailrealtimeinvestigatorlog_omittrustedemailinvestigatoremailscancleanemailscandetectionsemailalertsemailalertsaddressshowrenewaldaysshowtrialexpireddayslastrenewreminderlastpurchasereminderdisablethreatmapsenddiagnosticemailregtenantemailregproductidemailregistrationrenewalurlupgrade=" - Source: "00000000-00002816.00000003.77656.181D0000.00000004.mdmp") Found URL "https://www.superantispyware.com/purchase_products_ex.htmlexpiretofreescanfaultcount,scanlastdefinitionchecktimerenewaldialogshown,installationtimeticompletetiextratitagtireferrertireselleridtiretrievedcomponentsverifiedlastupdateversion,subscriptionexpirationregcodeexregistrationapplicationpath,lasttrialexpiringnotificationtime,lastupdatechecktimeinstalltypeforceupdateidavallowedscanrequiredsetupwizardcompleteemailregproductidemailregistrationrenewalurlupgradeurlhttps://www.superantispyware.com/professionalupgrade.htmlpurchaseurlhttps://www.superantispyware.com/purchase_products_ex.htmlexpiretofreescanfaultcount,scanlastdefinitionchecktimerenewaldialogshown,installationtimeticompletetiextratitagtireferrertireselleridtiretrievedcomponentsverifiedlastupdateversion,subscriptionexpirationregcodeexregistrationapplicationguidapplicationpath,lasttrialexpiringnotificationtime,lastupdatechecktimeinstalltypeforceupdateidavallowedscanrequiredsetupwizardcompletesqlite" - Source: "00000000-00002816.00000003.77656.181D0000.00000004.mdmp") Found URL "https://www.superantispyware.com/purchase_products_ex.htmlexpiretofreescanfaultcount,scanlastdefinitionchecktimerenewaldialogshown,installationtimeticompletetiextratitagtireferrertireselleridtiretrievedcomponentsverifiedlastupdateversion,subscriptionexpirationregcodeexregistrationapplicationpath,lasttrialexpiringnotificationtime,lastupdatechecktimeinstalltypeforceupdateidavallowedsetupwizardcompleteemailregproductidemailregistrationrenewalurlupgradeurlhttps://www.superantispyware.com/professionalupgrade.htmlpurchaseurlhttps://www.superantispyware.com/purchase_products_ex.htmlexpiretofreescanfaultcount,scanlastdefinitionchecktimerenewaldialogshown,installationtimeticompletetiextratitagtireferrertireselleridtiretrievedcomponentsverifiedlastupdateversion,subscriptionexpirationregcodeexregistrationapplicationguidapplicationpath,lasttrialexpiringnotificationtime,lastupdatechecktimeinstalltypeforceupdateidavallowedscanrequiredsetupwizardcompletesqlite" - Source: "00000000-00002816.00000003.77656.181D0000.00000004.mdmp") Found URL "http://certs.godaddy.com/repository/1301*go" - Source: "00000000-00002816.00000003.77656.181D0000.00000004.mdmp") Found URL "http://ocsp.godaddy.com/05.0,0*$http://crl.godaddy.com/gdroot-g2.crl0f?0=0;0301%https://certs.godaddy.com/repository/0jcs1" - Source: "00000000-00002816.00000003.77656.181D0000.00000004.mdmp") Found URL "http://crl.godaddy.com/gdig2s1-4347.crl0]v0t0h0907+http://certificates.godaddy.com/repository/0j0h0$http://ocsp.godaddy.com/0@4http://certificates.godaddy.com/repository/gdig2.crt0superantispyware.comwww.superantispyware.com0'" - Source: "00000000-00002816.00000003.77656.181D0000.00000004.mdmp") Found URL "http://crl.comodoca.com/comodorsacertificationauthority.crl0qe0c0;/http://crt.comodoca.com/comodorsaaddtrustca.crt0$http://ocsp.comodoca.com0z" - Source: "00000000-00002816.00000003.77656.181D0000.00000004.mdmp") Found URL "http://ocsp.digicert.com0" - Source: "00000000-00002816.00000003.77656.181D0000.00000004.mdmp") Found URL "http://crl3.digicert.com/digicertglobalrootca.crl071http://crl4.digicert.com/digicertglobalrootca.crl0=604020*0(https://www.digicert.com/cps0s6" - Source: "00000000-00002816.00000003.77656.181D0000.00000004.mdmp") Found URL "http://crl.globalsign.net/root-r2.crl0,d1.3.6.1.4.1.311.67.1.2matchmatchmatchuwutpce\" - Source: \"00000000-00002816.00000001.68309.181D0000.00000004.mdmp\")\n Found IP URL \"http://ocsp.digicert.com0@4http://cacerts.digicert.com/digicertglobalrootca.crt0b;09071http://crl3.digicert.com/digicertglobalrootca.crl0=6040je4^=ym'quj->d1.3.6.1.4.1.311.67.1.2matchmatchmatchuwutpce\" - Source: \"00000000-00002816.00000002.70228.181D0000.00000004.mdmp\")\n Found IP URL \"http://ocsp.digicert.com0@4http://cacerts.digicert.com/digicertglobalrootca.crt0b;09071http://crl3.digicert.com/digicertglobalrootca.crl0=6040je4^=ym'quj->d1.3.6.1.4.1.311.67.1.2matchmatchmatchuwutpce\" - Source: \"00000000-00002816.00000003.77656.181D0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-3","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$37","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$38","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Network Related","name":"Found registry location strings in memory","description":"$39","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"POST /application.php HTTP/1.1Content-Type: application/x-www-form-urlencodedUser-Agent: SAS_APPHost: www.superantispyware.comContent-Length: 1302Cache-Control: no-cache\" (Indicator: \"HTTP/1.1\"; File: \"SSL\")\n file/memory contains long string with (Indicator: \"HTTP/1.1\"; File: \"SSL\")\n Found string \"GET /appdata/sas/public/20000002.XML HTTP/1.1User-Agent: SASDef_GetDescriptorHost: securedownloads.superantispyware.comCache-Control: no-cache\" (Indicator: \"HTTP/1.1\"; File: \"SSL\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was made using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"level":"informative","category":"Network Related","name":"Uses HTTPS for communication","description":"HTTPS traffic to \"44.231.57.118\" on port \"443\"\n HTTPS traffic to \"152.195.50.81\" on port \"443\"","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":3,"id":"network-38","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Remote Access Related","name":"Contains references to RPC protocol sequence strings","description":"$3a","origin":"File/Memory","mitre_attack_id":"T1090","relevance":1,"id":"string-531","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\"SUPERAntiSpyware.exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00002816)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically to used to retrieve file or directory information","description":"\"SUPERAntiSpyware.exe\" called \"NtQueryAttributesFile\" (UID: 00000000-00002816)","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-236","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"SUPERAntiSpyware.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00002816)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to opens the access token associated with a process","description":"\"SUPERAntiSpyware.exe\" called \"NtOpenProcessToken\" (UID: 00000000-00002816)","origin":"API Call","mitre_attack_id":"T1134","relevance":1,"id":"api-196","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to opens the access token associated with a thread","description":"\"SUPERAntiSpyware.exe\" called \"NtOpenThreadToken\" (UID: 00000000-00002816)","origin":"API Call","mitre_attack_id":"T1134","relevance":1,"id":"api-197","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\"SUPERAntiSpyware.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00002816)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$3b","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"Found reference to API \"GetDC\" (Indicator: \"GetDC\"; File: \"df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05.bin\")","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05.bin\")\n Found reference to API \"VersionProcessListRelated\" (Indicator: \"ProcessList\"; Source: \"00000000-00002816.00000001.68309.040D0000.00000004.mdmp, 00000000-00002816.00000001.68309.181D0000.00000004.mdmp, 00000000-00002816.00000002.70228.040D0000.00000004.mdmp, 00000000-00002816.00000002.70228.181D0000.00000004.mdmp, 00000000-00002816.00000003.77656.040D0000.00000004.mdmp, 00000000-00002816.00000003.77656.181D0000.00000004.mdmp\")\n Found reference to API \"VersionProcessList\" (Indicator: \"ProcessList\"; Source: \"00000000-00002816.00000001.68309.040D0000.00000004.mdmp, 00000000-00002816.00000001.68309.181D0000.00000004.mdmp, 00000000-00002816.00000002.70228.040D0000.00000004.mdmp, 00000000-00002816.00000002.70228.181D0000.00000004.mdmp, 00000000-00002816.00000003.77656.040D0000.00000004.mdmp, 00000000-00002816.00000003.77656.181D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersInfo\" (Indicator: \"GetAdaptersInfo\"; File: \"df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05.bin\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05.bin\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05.bin\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames (API string)","description":"Found reference to API \"GetUserNameExW\" (Indicator: \"GetUserName\"; File: \"df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05.bin\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05.bin\n Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 00000000-00002816.00000001.68309.181D0000.00000004.mdmp\n 00000000-00002816.00000002.70228.181D0000.00000004.mdmp\n 00000000-00002816.00000003.77656.181D0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"System Security","name":"Contains reference to Hijacked CLSID(s)","description":"Observed string: \"CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\" (Indicator: \"{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\") in Source: 00000000-00002816.00000001.68309.040D0000.00000004.mdmp\n 00000000-00002816.00000002.70228.040D0000.00000004.mdmp\n 00000000-00002816.00000003.77656.040D0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1546.015","relevance":1,"id":"string-342","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"SUPERAntiSpyware.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"SUPERAntiSpyware.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$3c","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"SAS_CURRENTUSER.DB3\" - Location: [%APPDATA%\\SUPERAntiSpyware.com\\SUPERAntiSpyware\\SAS_CURRENTUSER.DB3]- [targetUID: 00000000-00002816]\n Dropped file: \"SAS_CURRENTUSER.DB3-journal\" - Location: [%APPDATA%\\SUPERAntiSpyware.com\\SUPERAntiSpyware\\SAS_CURRENTUSER.DB3-journal]- [targetUID: 00000000-00002816]\n Dropped file: \"sas-data.tmp\" - Location: [%APPDATA%\\SUPERAntiSpyware.com\\SUPERAntiSpyware\\sas-data.tmp]- [targetUID: 00000000-00002816]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"SUPERAntiSpyware.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".MPRESS1 with unusual entropies 7.99981341565","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":3,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"$3d","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"1/70 Antivirus vendors marked sample as malicious (1% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"nicks@superadblocker.com\"\n Pattern match: \"pubws@qq.com\"\n Pattern match: \"_gold_6240r_cpu_@_2.40ghz\"\n Pattern match: \"premium-server@thawte.com0\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"sample.bin\" has type \"MS-DOS executable PE32+ executable (GUI) x86-64 (stripped to external PDB) for MS Windows MZ for MS-DOS\"- [targetUID: N/A]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"2.5.4.3\"\n \"2.5.4.4\"\n \"2.5.4.5\"\n \"2.5.4.6\"\n \"2.5.4.7\"\n \"2.5.4.8\"\n \"2.5.4.9\"\n \"2.5.4.10\"\n \"2.5.4.11\"\n \"2.5.4.12\"\n \"2.5.4.13\"\n \"2.5.4.14\"\n \"2.5.4.15\"\n \"2.5.4.16\"\n \"2.5.4.17\"\n \"2.5.4.18\"\n \"2.5.4.19\"\n \"2.5.4.20\"\n \"2.5.4.21\"\n \"2.5.4.22\"\n \"2.5.4.23\"\n \"2.5.4.24\"\n \"2.5.4.25\"\n \"2.5.4.26\"\n \"2.5.4.27\"\n \"2.5.4.28\"\n \"2.5.4.29\"\n \"2.5.4.30\"\n \"2.5.4.31\"\n \"2.5.4.32\"\n \"2.5.4.33\"\n \"2.5.4.34\"\n \"2.5.4.35\"\n \"2.5.4.36\"\n \"2.5.4.37\"\n \"2.5.4.38\"\n \"2.5.4.39\"\n \"2.5.4.40\"\n \"2.5.4.42\"\n \"2.5.4.43\"\n \"2.5.29.19\"\n \"2.5.29.10\"\n \"2.5.29.21\"\n \"2.5.29.37\"\n \"2.5.29.7\"\n \"2.5.29.8\"\n \"2.5.29.17\"\n \"2.5.29.18\"\n \"2.5.29.1\"\n \"2.5.29.35\"\n \"2.5.29.14\"\n \"2.5.29.15\"\n \"2.5.29.2\"\n \"2.5.29.4\"\n \"2.5.29.31\"\n \"2.5.29.46\"\n \"2.5.29.32\"\n \"2.5.29.20\"\n \"2.5.29.27\"\n \"2.5.29.28\"\n \"2.5.29.30\"\n \"2.5.29.33\"\n \"2.5.29.36\"\n \"2.5.29.5\"\n \"2.5.29.54\"\n \"2.5.29.3\"\n \"192.168.241.29\"\n Potential IP \"2.5.29.37\" found in string \"%2.5.29.37\"\n Potential IP \"2.5.29.35\" found in string \"#2.5.29.35\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 44.231.57.118 on port 443 is sent without HTTP header\n TCP traffic to 152.195.50.81 on port 443 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"SUPERAntiSpyware.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used for keylogging","description":"\"SUPERAntiSpyware.exe\" called \"GetAsyncKeyState\"\n \"SUPERAntiSpyware.exe\" called \"GetKeyState\"","origin":"API Call","mitre_attack_id":"T1056.001","relevance":10,"id":"api-40","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieves adapter information","description":"$3e","origin":"API Call","mitre_attack_id":"T1016","relevance":5,"id":"api-153","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\"SUPERAntiSpyware.exe\" marked \"C:\\ProgramData\\SUPERAntiSpyware.com\\SUPERAntiSpyware\\sas-data.tmp\" for deletion\n \"SUPERAntiSpyware.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\SUPERAntiSpyware.com\\SUPERAntiSpyware\\sas-data.tmp\" for deletion\n \"SUPERAntiSpyware.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\SUPERAntiSpyware.com\\SUPERAntiSpyware\\DELD5E4.tmp\" for deletion\n \"SUPERAntiSpyware.exe\" marked \"C:\\Users\\%OSUSER%\\AppData\\Roaming\\SUPERAntiSpyware.com\\SUPERAntiSpyware\\SAS_CURRENTUSER.DB3-journal\" for deletion\n \"SUPERAntiSpyware.exe\" marked \"C:\\ProgramData\\SUPERAntiSpyware.com\\SUPERAntiSpyware\\DELD6D0.tmp\" for deletion\n \"SUPERAntiSpyware.exe\" marked \"C:\\ProgramData\\SUPERAntiSpyware.com\\SUPERAntiSpyware\\SAS_ALLUSER.DB3-journal\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$3f","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"SUPERAntiSpyware.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"SUPERAntiSpyware.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"SUPERAntiSpyware.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"SUPERAntiSpyware.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"SUPERAntiSpyware.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05.bin\" has an entrypoint in section \".MPRESS2\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetProcAddress\n GetModuleHandleA\n GetUserNameExW\n InternetOpenA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"SUPERAntiSpyware.exe\" wrote bytes \"f02a82effe070000\" to virtual address \"0xFF8A1648\" (part of module \"WININET.DLL\")\n \"SUPERAntiSpyware.exe\" wrote bytes \"f02a82effe070000\" to virtual address \"0xF8F82050\" (part of module \"WEBIO.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Reads Antivirus engine related registry keys","description":"\"SUPERAntiSpyware.exe\" (Path: \"HKCU\\SOFTWARE\\SUPERANTISPYWARE.COM\\SUPERANTISPYWARE\")\n \"SUPERAntiSpyware.exe\" (Path: \"HKLM\\SOFTWARE\\SUPERANTISPYWARE.COM\\SUPERANTISPYWARE\")\n \"SUPERAntiSpyware.exe\" (Path: \"HKLM\\SOFTWARE\\SUPERANTISPYWARE.COM\")\n \"SUPERAntiSpyware.exe\" (Path: \"HKCU\\SOFTWARE\\SUPERANTISPYWARE.COM\")","origin":"Registry Access","mitre_attack_id":"T1518.001","relevance":8,"id":"registry-32","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"malicious","category":"General","name":"Calls an API typically used to execute an application","description":"\"SUPERAntiSpyware.exe\" called \"ShellExecuteA\" with parameter C:\\SSUPDATE64.EXE (UID: 00000000-00002816)","origin":"API Call","mitre_attack_id":"T1106","relevance":10,"id":"api-117","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"SUPERAntiSpyware.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at FAD60000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler interface DLL","description":"\"SUPERAntiSpyware.exe\" loaded module \"%WINDIR%\\System32\\mstask.dll\" at FAC90000","origin":"Loaded Module","mitre_attack_id":"T1053","relevance":5,"id":"module-5","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\"SUPERAntiSpyware.exe\" called \"FindResourceA\" with parameter \"3867334184\" - (UID: 00000000-00007752)\n \"SUPERAntiSpyware.exe\" called \"FindResourceA\" (UID: 00000000-00007752)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"Aes\"; File: \"SSL\")\n file/memory contains long string with (Indicator: \"Oid\"; File: \"SSL\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains long base64 encoded strings","description":"$40","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-500","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\SASDIFSV; Source: \"00000000-00000888.00000000.79684.7C569000.00000004.mdmp\")\n Found string - \\\\.\\SASKUTIL; Source: \"00000000-00000888.00000000.79684.7C767000.00000004.mdmp\")\n Found string - \\\\.\\SASDIFSV; Source: \"00000000-00004024.00000000.80338.0C2C9000.00000004.mdmp\")\n Found string - \\\\.\\SASKUTIL; Source: \"00000000-00004024.00000000.80338.0C4C7000.00000004.mdmp\")\n Found string - \\\\.\\SASKUTIL; Source: \"00000000-00006084.00000000.81003.07307000.00000004.mdmp\")\n Found string - \\\\.\\SASKUTIL; Source: \"00000000-00007752.00000000.79019.E0567000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00006084.00000000.81003.076E0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption and can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - RC4 Encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve operating system version","description":"Observed string: \"ver `\" (Indicator: \"ver \") in Source: 00000000-00006084.00000000.81003.05F50000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-327","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"SUPERAntiSpyware.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\SUPERANTISPYWARE.EXE\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"General","name":"Calls an API during runtime","description":"$41","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-265","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"SUPERAntiSpyware.exe\" called \"CreateProcessW\" with parameter \"\"C:\\SUPERAntiSpyware.exe\"\" - (UID: 00000000-00007752)\n \"SUPERAntiSpyware.exe\" called \"CreateProcessW\" with parameter \"\"C:\\SUPERAntiSpyware.exe\"\" - (UID: 00000000-00000888)\n \"SUPERAntiSpyware.exe\" called \"CreateProcessW\" with parameter \"\"C:\\SUPERAntiSpyware.exe\"\" - (UID: 00000000-00004024)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"$42","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"10890831654,2912,3126,,FindResourceA,kernel32.dll,\"00:20:45.078\",RX=0,PX=0\" (Indicator: \"FindResource\"; Source: \"00000000-00000888.00000000.79684.79730000.00000004.mdmp\")\n Found reference to API \"10765362384,7196,3126,,FindResourceA,kernel32.dll,\"00:20:55.296\",RX=0,PX=0\" (Indicator: \"FindResource\"; Source: \"00000000-00004024.00000000.80338.09330000.00000004.mdmp\")\n Found reference to API \"10866891362,7848,3126,,FindResourceA,kernel32.dll,\"00:21:05.671\",RX=0,PX=0\" (Indicator: \"FindResource\"; Source: \"00000000-00006084.00000000.81003.041B0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"SUPERAntiSpyware.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at F8440000\n \"SUPERAntiSpyware.exe\" loaded module \"%WINDIR%\\System32\\bcrypt.dll\" at F7260000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"General","name":"May execute SQL queries","description":"$43","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-605","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"SUPERAntiSpyware.exe\" (UID: 00000000-00000888) was launched with new environment variables: \"FPS_BROWSER_APP_PROFILE_STRING=\"Internet Explorer\", FPS_BROWSER_USER_PROFILE_STRING=\"Default\"\"","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"SUPERAntiSpyware.exe\" (UID: 00000000-00000888)\n Spawned process \"SUPERAntiSpyware.exe\" (UID: 00000000-00004024)\n Spawned process \"SUPERAntiSpyware.exe\" (UID: 00000000-00006084)\n Spawned process \"SUPERAntiSpyware.exe\" (UID: 00000000-00008160)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"SUPERAntiSpyware.exe\" (UID: 00000000-00000888)\n Spawned process \"SUPERAntiSpyware.exe\" (UID: 00000000-00004024)\n Spawned process \"SUPERAntiSpyware.exe\" (UID: 00000000-00006084)\n Spawned process \"SUPERAntiSpyware.exe\" (UID: 00000000-00008160)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Installation/Persistence","name":"Allocates virtual memory in a self process","description":"\"SUPERAntiSpyware.exe\" allocated memory in \"C:\\SUPERAntiSpyware.exe\" with (Protection: \"read/write\")","origin":"API Call","mitre_attack_id":"T1055","relevance":1,"id":"api-262","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"SUPERAntiSpyware.exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"details too long to display","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic process information of the specified process","description":"\"SUPERAntiSpyware.exe\" queries basic process information of the \"C:\\SUPERAntiSpyware.exe\" (UID: 7752)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"SUPERAntiSpyware.exe\" called \"NtQueueApcThread\" (UID: 00000000-00007752)\n \"SUPERAntiSpyware.exe\" called \"NtQueueApcThread\" (UID: 00000000-00000888)\n \"SUPERAntiSpyware.exe\" called \"NtQueueApcThread\" (UID: 00000000-00004024)\n \"SUPERAntiSpyware.exe\" called \"NtQueueApcThread\" (UID: 00000000-00006084)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"$44","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Found a reference to an external IP address lookup service","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$45","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"$46","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create string binding handle (RPC)","description":"\"SUPERAntiSpyware.exe\" called \"RpcStringBindingComposeW\" (UID: 00000000-00007752)\n \"SUPERAntiSpyware.exe\" called \"RpcStringBindingComposeW\" (UID: 00000000-00000888)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-218","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to register protocol sequence (RPC)","description":"\"SUPERAntiSpyware.exe\" called \"RpcServerUseProtseqEpW\" with parameter protseq ncalrpc & endpoint: OLE6813D62E27508AC29438D32D7D96 (UID: 00000000-00007752)\n \"SUPERAntiSpyware.exe\" called \"RpcServerUseProtseqEpW\" with parameter protseq ncalrpc & endpoint: OLE7E0706443256FC86A854E01CDCD4 (UID: 00000000-00000888)\n \"SUPERAntiSpyware.exe\" called \"RpcServerUseProtseqEpW\" with parameter protseq ncalrpc & endpoint: OLEBFB69202580B22C080827F481E30 (UID: 00000000-00004024)\n \"SUPERAntiSpyware.exe\" called \"RpcServerUseProtseqEpW\" with parameter protseq ncalrpc & endpoint: OLE1863FC4E42FA5DD4D670076D66DA (UID: 00000000-00006084)","origin":"API Call","mitre_attack_id":"T1021","relevance":3,"id":"api-220","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"SUPERAntiSpyware.exe\" called \"WinHttpReceiveResponse\" (UID: 00000000-00007752)\n \"SUPERAntiSpyware.exe\" called \"WinHttpReceiveResponse\" (UID: 00000000-00000888)\n \"SUPERAntiSpyware.exe\" called \"WinHttpReceiveResponse\" (UID: 00000000-00004024)\n \"SUPERAntiSpyware.exe\" called \"WinHttpReceiveResponse\" (UID: 00000000-00006084)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Network Related","name":"Sends GET/POST requests (HTTPS)","description":"Found HTTPS POST request to https://www.superantispyware.com/application.php","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-66","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve computer name","description":"\"SUPERAntiSpyware.exe\" called \"GetComputerNameA\" (UID: 00000000-00007752)\n \"SUPERAntiSpyware.exe\" called \"GetComputerNameW\" (UID: 00000000-00007752)\n \"SUPERAntiSpyware.exe\" called \"GetComputerNameW\" (UID: 00000000-00000888)\n \"SUPERAntiSpyware.exe\" called \"GetComputerNameA\" (UID: 00000000-00000888)\n \"SUPERAntiSpyware.exe\" called \"GetComputerNameA\" (UID: 00000000-00004024)\n \"SUPERAntiSpyware.exe\" called \"GetComputerNameW\" (UID: 00000000-00004024)\n \"SUPERAntiSpyware.exe\" called \"GetComputerNameA\" (UID: 00000000-00006084)\n \"SUPERAntiSpyware.exe\" called \"GetComputerNameW\" (UID: 00000000-00006084)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-141","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve user name","description":"\"SUPERAntiSpyware.exe\" called \"GetUserNameExW\" (UID: 00000000-00007752)\n \"SUPERAntiSpyware.exe\" called \"GetUserNameExW\" (UID: 00000000-00000888)\n \"SUPERAntiSpyware.exe\" called \"GetUserNameExW\" (UID: 00000000-00004024)\n \"SUPERAntiSpyware.exe\" called \"GetUserNameExW\" (UID: 00000000-00006084)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-135","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserNameExW\" (Indicator: \"GetUserName\"; File: \"df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05.bin\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Read system defined device setup information from registry","description":"\"SUPERAntiSpyware.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E968-E325-11CE-BFC1-08002BE10318}\\0001\"; Key: \"PRUNINGMODE\")\n \"SUPERAntiSpyware.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{4D36E97D-E325-11CE-BFC1-08002BE10318}\"; Key: \"CLASS\")\n \"SUPERAntiSpyware.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\CLASS\\{71A27CDD-812A-11D0-BEC7-08002BE2092F}\"; Key: \"CLASS\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-106","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"SUPERAntiSpyware.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00007752)\n \"SUPERAntiSpyware.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00000888)\n \"SUPERAntiSpyware.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00004024)\n \"SUPERAntiSpyware.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00006084)\n \"SUPERAntiSpyware.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00008160)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to terminate process and its threads","description":"\"SUPERAntiSpyware.exe\" called \"NtTerminateProcess\" with parameters {\"ExitStatus\": \"0\"\n \"$name\": \"C:\\\\SUPERAntiSpyware.exe\"}","origin":"API Call","mitre_attack_id":"T1489","relevance":1,"id":"api-247","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$47","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"Found reference to API \"SeDebugPrivilege\" (Indicator: \"SeDebugPrivilege\"; Source: \"00000000-00000888.00000000.79684.79730000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"informative","category":"Unusual Characteristics","name":"Calls an API typically used to map section into the virtual address space of a process","description":"$48","origin":"API Call","mitre_attack_id":"T1055","relevance":1,"id":"api-259","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"suspicious","category":"Environment Awareness","name":"Calls an API typically used to query local/system time as file time","description":"$49","origin":"API Call","mitre_attack_id":"T1070.006","relevance":3,"id":"api-223","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"SUPERAntiSpyware.exe\" reads file \"C:\\Users\\%OSUSER%\\Desktop\\desktop.ini\"\n \"SUPERAntiSpyware.exe\" reads file \"C:\\Users\\%OSUSER%\\Documents\\desktop.ini\"\n \"SUPERAntiSpyware.exe\" reads file \"C:\\Users\\%OSUSER%\\Music\\desktop.ini\"\n \"SUPERAntiSpyware.exe\" reads file \"C:\\Users\\%OSUSER%\\Pictures\\desktop.ini\"\n \"SUPERAntiSpyware.exe\" reads file \"C:\\Users\\%OSUSER%\\Videos\\desktop.ini\"\n \"SUPERAntiSpyware.exe\" reads file \"C:\\Users\\%OSUSER%\\Downloads\\desktop.ini\"\n \"SUPERAntiSpyware.exe\" reads file \"C:\\Users\\%OSUSER%\\OneDrive\\desktop.ini\"","origin":"API Call","mitre_attack_id":"T1083","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"SUPERAntiSpyware.exe\" called \"CreateProcessW\" with parameter \"\"C:\\SUPERAntiSpyware.exe\"\" - (UID: 00000000-00007752)\n \"SUPERAntiSpyware.exe\" called \"CreateProcessW\" with parameter \"\"C:\\SUPERAntiSpyware.exe\"\" - (UID: 00000000-00000888)\n \"SUPERAntiSpyware.exe\" called \"CreateProcessW\" with parameter \"\"C:\\SUPERAntiSpyware.exe\"\" - (UID: 00000000-00004024)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"SUPERAntiSpyware.exe\" allocated memory in \"C:\\SUPERAntiSpyware.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"SUPERAntiSpyware.exe\" wrote 4024 bytes to a remote process \"C:\\SUPERAntiSpyware.exe\" (Handle: 2512)\n \"SUPERAntiSpyware.exe\" wrote 8 bytes to a remote process \"C:\\SUPERAntiSpyware.exe\" (Handle: 2512)\n \"SUPERAntiSpyware.exe\" wrote 4024 bytes to a remote process \"C:\\SUPERAntiSpyware.exe\" (Handle: 2460)\n \"SUPERAntiSpyware.exe\" wrote 8 bytes to a remote process \"C:\\SUPERAntiSpyware.exe\" (Handle: 2460)\n \"SUPERAntiSpyware.exe\" wrote 4024 bytes to a remote process \"C:\\SUPERAntiSpyware.exe\" (Handle: 2440)\n \"SUPERAntiSpyware.exe\" wrote 8 bytes to a remote process \"C:\\SUPERAntiSpyware.exe\" (Handle: 2440)\n \"SUPERAntiSpyware.exe\" wrote 4024 bytes to a remote process \"C:\\SUPERAntiSpyware.exe\" (Handle: 2468)\n \"SUPERAntiSpyware.exe\" wrote 8 bytes to a remote process \"C:\\SUPERAntiSpyware.exe\" (Handle: 2468)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"$4a","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Spawns a lot of processes","description":"Spawned process \"SUPERAntiSpyware.exe\" (UID: 00000000-00007752)\n Spawned process \"SUPERAntiSpyware.exe\" (UID: 00000000-00000888)\n Spawned process \"SUPERAntiSpyware.exe\" (UID: 00000000-00004024)\n Spawned process \"SUPERAntiSpyware.exe\" (UID: 00000000-00006084)\n Spawned process \"SUPERAntiSpyware.exe\" (UID: 00000000-00008160)","origin":"Monitored Target","mitre_attack_id":"T1057","relevance":8,"id":"target-14","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"Evasive","details_count":7,"details":[{"detail":"Marks file for deletion"},{"detail":"Reads Antivirus engine related registry keys"},{"detail":"Possibly checks for the presence of a forensics/monitoring tool"},{"detail":"Possibly checks for the presence of an Antivirus engine"},{"detail":"PE file has a section name known to be used by a packer/protector"},{"detail":"PE file is packed with MPress Packer"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 3 domains and 3 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]}]},"activity":{"stats":{"process_count":5,"spawned_processes_count":5,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":41,"imported_dlls_count":119,"dropped_files_count":0,"extracted_files_count":15,"files_written_count":20,"files_deleted_count":0,"registry_keys_created_count":41,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":41,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":3,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Network Traffic","Extracted Files","Decrypted SSL traffic","Multi-Process","Sample not shared"],"sandbox_reports":[{"id":"6461e5a0d2ceb4b5a30b3a45","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":56,"malware_family":"Ransom.Win64.Zbot","contacted_countries":["USA"],"submit_name":"SUPERAntiSpyware.exe","analysis_start_time":"2023-05-15T07:56:17+00:00","indicators_count":{"informative":117,"suspicious":50,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files","Sample not shared","Decrypted SSL traffic"],"is_in_unified_schema":true},{"id":"6456a7e0dae8e5367701cdd3","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":56,"malware_family":"BehavesLike.Win64.PWSZbot","contacted_countries":["USA"],"submit_name":"SUPERAntiSpyware.exe","analysis_start_time":"2023-05-06T19:17:53+00:00","indicators_count":{"informative":101,"suspicious":51,"malicious":4},"tags":["Network Traffic","Extracted Files","Decrypted SSL traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"44.231.57.118","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"address":"152.195.50.81","port":443,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]}],"dns_resolutions":[{"domain":"securedownloads.superantispyware.com","address":"152.195.50.81","ttl":21600,"country":"United States","registrar_name":"GoDaddy.com, LLC","registrar_organization":"Support.com, Inc","registrar_name_servers":"NS41.DOMAINCONTROL.COM","registrar_creation_date":"2005-02-18T17:43:03+00:00","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"domain":"teredo.ipv6.microsoft.com","ttl":295,"country":"-","registrar_name":"MarkMonitor, Inc.","registrar_organization":"Microsoft Corporation","registrar_name_servers":"NS1.MSFT.NET","registrar_creation_date":"1991-05-02T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"domain":"www.superantispyware.com","address":"44.231.57.118","ttl":18834,"country":"United States","registrar_name":"GoDaddy.com, LLC","registrar_organization":"Support.com, Inc","registrar_name_servers":"NS41.DOMAINCONTROL.COM","registrar_creation_date":"2005-02-18T17:43:03+00:00","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}],"processes":[{"pid":7752,"ppid":0,"name":"SUPERAntiSpyware.exe","command_line":"","sha256":"df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05","normalized_path":"C:\\SUPERAntiSpyware.exe","uid":"00000000-00007752","icon":"$4b"},{"pid":888,"ppid":7752,"name":"SUPERAntiSpyware.exe","command_line":"","sha256":"df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05","normalized_path":"C:\\SUPERAntiSpyware.exe","parent_uid":"00000000-00007752","uid":"00000000-00000888"},{"pid":4024,"ppid":888,"name":"SUPERAntiSpyware.exe","command_line":"","sha256":"df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05","normalized_path":"C:\\SUPERAntiSpyware.exe","parent_uid":"00000000-00000888","uid":"00000000-00004024"},{"pid":6084,"ppid":4024,"name":"SUPERAntiSpyware.exe","command_line":"","sha256":"df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05","normalized_path":"C:\\SUPERAntiSpyware.exe","parent_uid":"00000000-00004024","uid":"00000000-00006084"},{"pid":8160,"ppid":6084,"name":"SUPERAntiSpyware.exe","command_line":"","sha256":"df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05","normalized_path":"C:\\SUPERAntiSpyware.exe","parent_uid":"00000000-00006084","uid":"00000000-00008160"}],"all_imported_dlls":["userenv.dll","msctf.dll","api-ms-win-core-synch-l1-2-0.dll","nlaapi.dll","ole32.dll","bcryptprimitives.dll","kernel32.dll","msimg32.dll","wsock32.dll","iertutil.dll","RpcRtRemote.dll","Wldap32.dll","shell32.dll","VxSSL64.dll","credssp.dll","user32.dll","shlwapi.dll","cryptbase.dll","cfgmgr32.dll","ncrypt.dll","QAGENTRT.DLL","imm32.dll","samcli.dll","ntdll.dll","comctl32.dll","crypt32.dll","msasn1.dll","wintrust.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","rpcrt4.dll","winnsi.dll","webio.dll","secur32.dll","sspicli.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","urlmon.dll","npmproxy.dll","rpcss.dll","GdiPlus.dll","psapi.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","advapi32.dll","IPHLPAPI.DLL","wininet.dll","sechost.dll","netprofm.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","dnsapi.dll","taskschd.dll","KernelBase.dll","lpk.dll","netapi32.dll","netutils.dll","dwmapi.dll","wuaueng.dll","gdi32.dll","usp10.dll","version.dll","normaliz.dll","propsys.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","uxtheme.dll","setupapi.dll","bcrypt.dll","gpapi.dll","nsi.dll","ws2_32.dll","srvcli.dll","oleaut32.dll","wship6.dll","fveui.dll","winhttp.dll","api-ms-win-downlevel-user32-l1-1-0.dll","profapi.dll","wkscli.dll","dhcpcsvc6.dll","fltLib.dll","WSHTCPIP.DLL","cryptsp.dll","msvcrt.dll","comdlg32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","FWPUCLNT.DLL","rasadhlp.dll","rsaenh.dll","winmm.dll","devobj.dll","dhcpcsvc.dll","mstask.dll","ntmarta.dll","mswsock.dll","schannel.dll","wshqos.dll","cldapi.dll","ucrtbase.dll","aepic.dll","kernel.appcore.dll","msvcp_win.dll","winmmbase.dll","OnDemandConnRouteHelper.dll","imagehlp.dll","ncryptsslp.dll","Windows.StateRepositoryPS.dll","win32u.dll","ntasn1.dll","powrprof.dll","mskeyprotect.dll","msIso.dll","dbgcore.dll","dpapi.dll","gdi32full.dll","combase.dll","clbcatq.dll","edputil.dll","apphelp.dll","SHCore.dll","dbghelp.dll","windows.storage.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"SAS_ALLUSER.DB3","sha256":"e3d9f8ee63c5e09ab6e2d0c2f401e426f3fbb5d2a7dd82662450bf83ff58c201","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"SAS_ALLUSER.DB3-journal","sha256":"83f6f60ed5a191c3dddc7108ee4a2f6a0910782bd1ebbd9b56e754ff925a79e7","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"sas-data.tmp","sha256":"a9d35ae9c3c32b5e42ddaefc88d026bf2ecf55ec56396ff0bdc6ce37f3886a18","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"SAS_CURRENTUSER.DB3","sha256":"536881685da46dd71319082436808f3463868e2e47d79e17a6980e3612a83d09","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"SAS_CURRENTUSER.DB3-journal","sha256":"05a621ba5c0da59b8611052c3d20293af9cb8811cb64844f102fe1f096897008","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"SUPERANTISPYWARE-5-6-2023_ 19-20-56 _.SDB","sha256":"6056a22cae1c85c5e674a92a7354c2b013ffe17c91c12382b9021f8d084793dd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"name":"APPLOGS.ZIP","sha256":"bba677f95dace3d4931f8f1a5fcc4f56e26bc2688daa0001adf3744a4c252b1d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"SASMDMP5-15--1-2-20.dmp","sha256":"1481614769f1c51357dbfa08f0efafa9bb412336c6cbcd7e0c46b37c84e1ed00","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"SASMDMP5-15--1-2-30.dmp","sha256":"4949c62e3583c2f4737d8c36bb634638441554507b637b5b990257998dc88a67","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"SASMDMP5-15--1-2-40.dmp","sha256":"d5afa33fac68c37dd7e1555bac6a1a3f1086d236dfaab641899fec6c3f491229","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"SASMDMP5-15--1-2-9.dmp","sha256":"37c83c95b5da82abac221f931cd2861a1e90bd3cc9a3ee12abde53b3f3e787d4","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"SUPERANTISPYWARE-5-15-2023_ 1-2-28 _.SDB","sha256":"b00f9e0ce497b1639d9ef6cd80b4832b10c448cee654359f53f3875fe2a1bd6f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"SUPERANTISPYWARE-5-15-2023_ 1-2-38 _.SDB","sha256":"552569c34572647ef425fa834ce9379b0da8c07aefed410f4c1f820431fc3cdc","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"SUPERANTISPYWARE-5-15-2023_ 1-2-18 _.SDB","sha256":"ab01558589e1ce2f41d869e1ce26bfeec46cd112f4cbe593cd6bb782242994bf","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"SUPERANTISPYWARE-5-15-2023_ 1-2-8 _.SDB","sha256":"95eedf87bc71f90c1a81e4a37cd6e7aa2181289ec31e8023f9397c16f2b3db5b","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"path":"%ALLUSERSPROFILE%\\SUPERAntiSpyware.com\\SUPERAntiSpyware\\AppLogs\\SUPERANTISPYWARE-5-6-2023( 19-20-56 ).SDB","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"path":"%ALLUSERSPROFILE%\\SUPERAntiSpyware.com\\SUPERAntiSpyware\\SUPERANTISPYWARE.DB3","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"path":"%APPDATA%\\SUPERAntiSpyware.com\\SUPERAntiSpyware\\Quarantine","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"path":"%APPDATA%\\SUPERAntiSpyware.com\\SUPERAntiSpyware\\SAS_CURRENTUSER.DB3","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"path":"%ALLUSERSPROFILE%\\SUPERAntiSpyware.com\\SUPERAntiSpyware\\SAS_ALLUSER.DB3","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"path":"%ALLUSERSPROFILE%\\SUPERAntiSpyware.com\\SUPERAntiSpyware\\AppLogs","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"path":"%ALLUSERSPROFILE%\\SUPERAntiSpyware.com","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"path":"%ALLUSERSPROFILE%\\SUPERAntiSpyware.com\\SUPERAntiSpyware","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\SECURITYPROVIDERS\\SCHANNEL\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\ENTERPRISECERTIFICATES\\CA\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKCUHKCU\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CERTIFICATES\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CRLS\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\SYSTEMCERTIFICATES\\DISALLOWED\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\CTLS\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\ROOT\\","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\sasapp","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\sasappruleupdate","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"Global\\sasappruleupdate","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"Local\\sasapp","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6456a7e0dae8e5367701cdd3"},{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7752:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7752:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\sasapp","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"\\BaseNamedObjects\\SyncRootManager","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7752:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"Local\\SM0:7752:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"Local\\SM0:7752:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"sasapp","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"SM0:7752:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:888:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:888:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:888:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"Local\\SM0:888:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"Local\\SM0:888:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"SM0:888:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4024:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:4024:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:4024:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"Local\\SM0:4024:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"Local\\SM0:4024:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"SM0:4024:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6084:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6084:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6084:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"Local\\SM0:6084:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"Local\\SM0:6084:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"SM0:6084:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:8160:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:8160:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"SM0:8160:120:WilError_01","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]},{"name":"Local\\SM0:8160:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6461e5a0d2ceb4b5a30b3a45"}]}]}},"report_ids":{"sandbox_job_ids":["6461e5a0d2ceb4b5a30b3a45","6456a7e0dae8e5367701cdd3"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample df2bd537b83f… — Score 56/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample df2bd537b83f…. Threat score 56/100. 0/0 AV engines flagged this file. 9 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample df2bd537b83f… — Score 56/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample df2bd537b83f…. Threat score 56/100. 0/0 AV engines flagged this file. 9 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/df2bd537b83f664cc9024618ec7db8b2c5839045234c6068a8db0b5b92b07e05"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample df2bd537b83f… — Score 56/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample df2bd537b83f…. Threat score 56/100. 0/0 AV engines flagged this file. 9 malicious and 18 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L4c","11",{}]]